Function at 0x180033700
Capabilities:
Get installed programs
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x3a0
mov qword [rsp + 0xf8], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x18013a210]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov esi, edx
mov rdi, rcx
lea r12, [rcx + 0x1bd8]
mov rbx, qword [r12 + 0x30]
mov rax, qword [rbx + 8]
nop word [rax + rax]
cmp byte [rax + 0x29], 0
jne 0x180033769
cmp dword [rax + 0x18], edx
jge 0x180033761
mov rax, qword [rax + 0x10]
jmp 0x180033750
mov rbx, rax
mov rax, qword [rax]
jmp 0x180033750
mov qword [rsp + 0x78], rbx
test r12, r12
jne 0x180033778
call fcn.1800bf138
mov rax, qword [r12]
mov qword [rsp + 0x70], rax
mov r13, qword [r12 + 0x30]
test rax, rax
je 0x180033790
cmp rax, rax
je 0x180033795
call fcn.1800bf138
cmp rbx, r13
je 0x1800337a6
cmp esi, dword [rbx + 0x18]
jl 0x1800337a6
lea rcx, [rsp + 0x70]
jmp 0x1800337be
mov rax, qword [r12 + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [r12]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
mov rax, qword [rcx]
mov qword [rdi + 0x1c18], rax
mov rax, qword [rcx + 8]
mov qword [rdi + 0x1c20], rax
mov rbx, qword [rdi + 0x1c08]
mov rax, qword [rdi + 0x1c18]
test rax, rax
je 0x1800337ef
cmp rax, qword [rdi + 0x1bd8]
je 0x1800337f4
call fcn.1800bf138
cmp qword [rdi + 0x1c20], rbx
je 0x1800340ff
mov rax, qword [rdi + 0x1c18]
test rax, rax
jne 0x180033825
call fcn.1800bf138
mov rax, qword [rdi + 0x1c18]
test rax, rax
jne 0x180033825
xor ebx, ebx
mov rax, rbx
jmp 0x18003382a
mov rax, qword [rax]
xor ebx, ebx
mov rax, qword [rax + 0x30]
cmp qword [rdi + 0x1c20], rax
jne 0x18003383c
call fcn.1800bf138
mov rax, qword [rdi + 0x1c20]
mov rcx, qword [rax + 0x20]
cmp dword [rdi + 0x1758], 1
jne 0x180033d6c
sub esi, dword [rdi + 0x3558]
add esi, 0xffffffb0
mov rcx, qword [0x180142f08]
mov r8, qword [0x180142f00]
sub rcx, r8
movabs r12, 0x6666666666666667
mov rax, r12
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rsi, rdx
jb 0x18003389d
call fcn.1800bf138
mov r8, qword [0x180142f00]
lea rax, [rsi + rsi*4]
lea rdx, [r8 + rax*8]
mov qword [rsp + 0x170], 7
mov qword [rsp + 0x168], rbx
mov word [rsp + 0x158], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x150]
call fcn.180003570
nop
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x598
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, [rsp + 0x100]
mov rcx, rdi
call fcn.180032cc0
nop
cmp qword [rsp + 0x118], 0
jne 0x180033963
cmp qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 8
jb 0x180033928
mov rcx, qword [rsp + 0x108]
call fcn.1800bd964
mov qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 7
mov qword [rsp + 0x118], rbx
mov word [rsp + 0x108], bx
cmp qword [rsp + 0x170], 8
jb 0x18003395c
mov rcx, qword [rsp + 0x158]
call fcn.1800bd964
xor eax, eax
jmp 0x180034101
mov rcx, qword [0x180142f08]
mov r8, qword [0x180142f00]
sub rcx, r8
mov rax, r12
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rsi, rdx
jb 0x180033999
call fcn.1800bf138
mov r8, qword [0x180142f00]
lea rax, [rsi + rsi*4]
lea rdx, [r8 + rax*8]
mov qword [rsp + 0x148], 7
mov qword [rsp + 0x140], rbx
mov word [rsp + 0x130], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x128]
call fcn.180003570
nop
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0xb0], bx
mov r8d, 1
lea rdx, [0x180105b74]
lea rcx, [rsp + 0xa8]
call fcn.180012d90
nop
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
mov r8d, 3
lea rdx, [0x180105b78]
lea rcx, [rsp + 0x48]
call fcn.180012d90
nop
mov qword [rsp + 0xa0], 7
mov qword [rsp + 0x98], rbx
mov word [rsp + 0x88], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x80]
call fcn.180003570
nop
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xd0]
mov rcx, rdi
call fcn.18002f810
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.180003570
nop
cmp qword [rsp + 0xf0], 8
jb 0x180033adf
mov rcx, qword [rsp + 0xd8]
call fcn.1800bd964
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x108]
cmp qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 8
cmovae rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0xa8]
call fcn.180008610
mov rsi, rax
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
mov r8d, 0xa
lea rdx, str.__SEARCH__
lea rcx, [rsp + 0x48]
call fcn.180012d90
nop
mov qword [rsp + 0xa0], 7
mov qword [rsp + 0x98], rbx
mov word [rsp + 0x88], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x80]
call fcn.180003570
nop
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xd0]
mov rcx, rdi
call fcn.18002f810
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.180003570
nop
cmp qword [rsp + 0xf0], 8
jb 0x180033bd7
mov rcx, qword [rsp + 0xd8]
call fcn.1800bd964
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
cmp qword [rdi + 0x15e8], 8
jb 0x180033c01
mov rdx, qword [rdi + 0x15d0]
jmp 0x180033c08
lea rdx, [rdi + 0x15d0]
lea rcx, [rsp + 0xa8]
call fcn.180008610
mov rsi, rax
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
mov r8d, 7
lea rdx, str.__AFF__
lea rcx, [rsp + 0x48]
call fcn.180012d90
nop
mov qword [rsp + 0xa0], 7
mov qword [rsp + 0x98], rbx
mov word [rsp + 0x88], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x80]
call fcn.180003570
nop
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xd0]
mov rcx, rdi
call fcn.18002f810
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.180003570
nop
cmp qword [rsp + 0xf0], 8
jb 0x180033ccf
mov rcx, qword [rsp + 0xd8]
call fcn.1800bd964
xor r8d, r8d
lea rdx, [rsp + 0x128]
mov rcx, rdi
call fcn.18002fc40
nop
cmp qword [rsp + 0x148], 8
jb 0x180033cfb
mov rcx, qword [rsp + 0x130]
call fcn.1800bd964
mov qword [rsp + 0x148], 7
mov qword [rsp + 0x140], rbx
mov word [rsp + 0x130], bx
cmp qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 8
jb 0x180033d2f
mov rcx, qword [rsp + 0x108]
call fcn.1800bd964
mov qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 7
mov qword [rsp + 0x118], rbx
mov word [rsp + 0x108], bx
cmp qword [rsp + 0x170], 8
jb 0x1800340f8
mov rcx, qword [rsp + 0x158]
call fcn.1800bd964
jmp 0x1800340f8
mov edx, dword [rcx + 0x1fc]
cmp edx, 4
jne 0x180033d9b
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
mov edx, 0x59b
lea r8d, [r9 + 1]
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1800340f8
cmp edx, 0xd
je 0x1800340f8
cmp edx, 3
je 0x1800340f8
cmp edx, 0x13
jne 0x180033dcc
mov rdx, rcx
mov rcx, rdi
call fcn.180033690
mov edx, esi
mov rcx, rdi
call fcn.180034b20
jmp 0x1800340f8
cmp edx, 5
jne 0x180033dde
mov rcx, rdi
call fcn.1800332c0
jmp 0x1800340f8
cmp edx, 0x14
jne 0x180033df0
mov rcx, rdi
call fcn.1800333f0
jmp 0x1800340f8
cmp edx, 0x15
jne 0x180033e02
mov rcx, rdi
call fcn.180033430
jmp 0x1800340f8
cmp edx, 0x16
jne 0x180033e14
mov rcx, rdi
call fcn.180033470
jmp 0x1800340f8
cmp edx, 0x1a
je 0x1800340f0
cmp edx, 0x1b
je 0x1800340f0
cmp edx, 0x1d
je 0x1800340f0
cmp edx, 0x1c
je 0x1800340f0
cmp edx, 0x17
jne 0x180033e54
mov rcx, rdi
call fcn.180033650
mov edx, esi
mov rcx, rdi
call fcn.180034b20
jmp 0x1800340f8
cmp edx, 0x18
jne 0x180033e70
mov rcx, rdi
call fcn.1800335e0
mov edx, esi
mov rcx, rdi
call fcn.180034b20
jmp 0x1800340f8
cmp edx, 0x19
jne 0x180033ea3
lea rdx, [rcx + 0x100]
lea rcx, [rsp + 0xd0]
call fcn.180002e40
mov rdx, rax
mov rcx, rdi
call fcn.180033540
mov edx, esi
mov rcx, rdi
call fcn.180034b20
jmp 0x1800340f8
cmp edx, 0x12
jne 0x1800340bf
mov rsi, rbx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], ebx
call fcn.180067400
mov edi, 0x20219
mov ecx, 0x20119
test eax, eax
cmovne edi, ecx
mov qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 7
mov qword [rsp + 0x118], rbx
mov word [rsp + 0x108], bx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallF009657E_18AE_4744_A253_2FE9452A0BDC
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18003404e
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x70], rsi
and edi, 0x300
mov dword [rsp + 0x78], edi
mov word [rsp + 0x180], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x182]
call fcn.1800c1250
mov dword [rsp + 0x40], 0x208
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.UninstallString
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x180034004
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x180033ffa
cmp edx, 2
jbe 0x180033fda
cmp edx, 7
jne 0x180033ffa
test cl, 1
jne 0x180033fd0
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x180033fd0
mov rdx, rcx
shr rdx, 1
cmp word [rsp + rdx*2 + 0x17e], 0
jne 0x180033fd0
cmp eax, 1
jbe 0x18003400c
cmp word [rsp + rdx*2 + 0x17c], 0
je 0x18003400c
mov word [rsp + 0x180], bx
jmp 0x18003403d
test cl, 1
jne 0x180033ff0
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0x17e], 0
je 0x18003400c
mov word [rsp + 0x180], bx
jmp 0x18003403d
mov word [rsp + 0x180], bx
jmp 0x18003403d
mov word [rsp + 0x180], bx
test edi, edi
jne 0x18003403d
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x180]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x100]
call fcn.180010af0
test rsi, rsi
je 0x18003404e
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, rbx
cmp qword [rsp + 0x118], 0
je 0x18003407b
lea rcx, [rsp + 0x108]
cmp qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 8
cmovae rcx, qword [rsp + 0x108]
xor edx, edx
call fcn.1800684b0
nop
cmp qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 8
jb 0x180034093
mov rcx, qword [rsp + 0x108]
call fcn.1800bd964
mov qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 7
mov qword [rsp + 0x118], rbx
mov word [rsp + 0x108], bx
test rsi, rsi
je 0x1800340f8
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1800340f8
lea rcx, [rdi + 0x1c18]
call fcn.180035fe0
mov rcx, qword [rax + 8]
cmp dword [rcx + 0x20c], 0
jne 0x1800340f8
lea rdx, [rcx + 0xa8]
mov r8d, dword [rcx + 0xf8]
mov rcx, rdi
call fcn.18002fc40
jmp 0x1800340f8
mov rcx, rdi
call fcn.180034f70
mov eax, 1
jmp 0x180034101
xor eax, eax
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.1800bd980
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret