Function at 0x180035030
Capabilities:
Get installed programs
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
sub rsp, 0x3a0
mov qword [rsp + 0xf8], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x18013e1e0]
xor rax, rsp
mov qword [rsp + 0x390], rax
mov esi, edx
mov rdi, rcx
lea r12, [rcx + 0x1bd8]
mov rbx, qword [r12 + 0x30]
mov rax, qword [rbx + 8]
nop word [rax + rax]
cmp byte [rax + 0x29], 0
jne 0x180035099
cmp dword [rax + 0x18], edx
jge 0x180035091
mov rax, qword [rax + 0x10]
jmp 0x180035080
mov rbx, rax
mov rax, qword [rax]
jmp 0x180035080
mov qword [rsp + 0x78], rbx
test r12, r12
jne 0x1800350a8
call fcn.1800c1088
mov rax, qword [r12]
mov qword [rsp + 0x70], rax
mov r13, qword [r12 + 0x30]
test rax, rax
je 0x1800350c0
cmp rax, rax
je 0x1800350c5
call fcn.1800c1088
cmp rbx, r13
je 0x1800350d6
cmp esi, dword [rbx + 0x18]
jl 0x1800350d6
lea rcx, [rsp + 0x70]
jmp 0x1800350ee
mov rax, qword [r12 + 0x30]
mov qword [rsp + 0x38], rax
mov rax, qword [r12]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
mov rax, qword [rcx]
mov qword [rdi + 0x1c18], rax
mov rax, qword [rcx + 8]
mov qword [rdi + 0x1c20], rax
mov rbx, qword [rdi + 0x1c08]
mov rax, qword [rdi + 0x1c18]
test rax, rax
je 0x18003511f
cmp rax, qword [rdi + 0x1bd8]
je 0x180035124
call fcn.1800c1088
cmp qword [rdi + 0x1c20], rbx
je 0x180035a2f
mov rax, qword [rdi + 0x1c18]
test rax, rax
jne 0x180035155
call fcn.1800c1088
mov rax, qword [rdi + 0x1c18]
test rax, rax
jne 0x180035155
xor ebx, ebx
mov rax, rbx
jmp 0x18003515a
mov rax, qword [rax]
xor ebx, ebx
mov rax, qword [rax + 0x30]
cmp qword [rdi + 0x1c20], rax
jne 0x18003516c
call fcn.1800c1088
mov rax, qword [rdi + 0x1c20]
mov rcx, qword [rax + 0x20]
cmp dword [rdi + 0x1758], 1
jne 0x18003569c
sub esi, dword [rdi + 0x3558]
add esi, 0xffffffb0
mov rcx, qword [0x180146f08]
mov r8, qword [0x180146f00]
sub rcx, r8
movabs r12, 0x6666666666666667
mov rax, r12
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rsi, rdx
jb 0x1800351cd
call fcn.1800c1088
mov r8, qword [0x180146f00]
lea rax, [rsi + rsi*4]
lea rdx, [r8 + rax*8]
mov qword [rsp + 0x170], 7
mov qword [rsp + 0x168], rbx
mov word [rsp + 0x158], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x150]
call fcn.180003570
nop
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x598
call qword [sym.imp.USER32.dll_PostMessageW]
lea rdx, [rsp + 0x100]
mov rcx, rdi
call fcn.1800345f0
nop
cmp qword [rsp + 0x118], 0
jne 0x180035293
cmp qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 8
jb 0x180035258
mov rcx, qword [rsp + 0x108]
call fcn.1800bf8b4
mov qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 7
mov qword [rsp + 0x118], rbx
mov word [rsp + 0x108], bx
cmp qword [rsp + 0x170], 8
jb 0x18003528c
mov rcx, qword [rsp + 0x158]
call fcn.1800bf8b4
xor eax, eax
jmp 0x180035a31
mov rcx, qword [0x180146f08]
mov r8, qword [0x180146f00]
sub rcx, r8
mov rax, r12
imul rcx
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rsi, rdx
jb 0x1800352c9
call fcn.1800c1088
mov r8, qword [0x180146f00]
lea rax, [rsi + rsi*4]
lea rdx, [r8 + rax*8]
mov qword [rsp + 0x148], 7
mov qword [rsp + 0x140], rbx
mov word [rsp + 0x130], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x128]
call fcn.180003570
nop
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0xb0], bx
mov r8d, 1
lea rdx, [0x180108bb4]
lea rcx, [rsp + 0xa8]
call fcn.180014810
nop
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
mov r8d, 3
lea rdx, [0x180108bb8]
lea rcx, [rsp + 0x48]
call fcn.180014810
nop
mov qword [rsp + 0xa0], 7
mov qword [rsp + 0x98], rbx
mov word [rsp + 0x88], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x80]
call fcn.180003570
nop
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xd0]
mov rcx, rdi
call fcn.180031140
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.180003570
nop
cmp qword [rsp + 0xf0], 8
jb 0x18003540f
mov rcx, qword [rsp + 0xd8]
call fcn.1800bf8b4
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x108]
cmp qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 8
cmovae rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0xa8]
call fcn.180008f40
mov rsi, rax
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
mov r8d, 0xa
lea rdx, str.__SEARCH__
lea rcx, [rsp + 0x48]
call fcn.180014810
nop
mov qword [rsp + 0xa0], 7
mov qword [rsp + 0x98], rbx
mov word [rsp + 0x88], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x80]
call fcn.180003570
nop
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xd0]
mov rcx, rdi
call fcn.180031140
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.180003570
nop
cmp qword [rsp + 0xf0], 8
jb 0x180035507
mov rcx, qword [rsp + 0xd8]
call fcn.1800bf8b4
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x40], rax
cmp qword [rdi + 0x15e8], 8
jb 0x180035531
mov rdx, qword [rdi + 0x15d0]
jmp 0x180035538
lea rdx, [rdi + 0x15d0]
lea rcx, [rsp + 0xa8]
call fcn.180008f40
mov rsi, rax
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
mov r8d, 7
lea rdx, str.__AFF__
lea rcx, [rsp + 0x48]
call fcn.180014810
nop
mov qword [rsp + 0xa0], 7
mov qword [rsp + 0x98], rbx
mov word [rsp + 0x88], bx
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x80]
call fcn.180003570
nop
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xd0]
mov rcx, rdi
call fcn.180031140
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0x128]
call fcn.180003570
nop
cmp qword [rsp + 0xf0], 8
jb 0x1800355ff
mov rcx, qword [rsp + 0xd8]
call fcn.1800bf8b4
xor r8d, r8d
lea rdx, [rsp + 0x128]
mov rcx, rdi
call fcn.180031570
nop
cmp qword [rsp + 0x148], 8
jb 0x18003562b
mov rcx, qword [rsp + 0x130]
call fcn.1800bf8b4
mov qword [rsp + 0x148], 7
mov qword [rsp + 0x140], rbx
mov word [rsp + 0x130], bx
cmp qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 8
jb 0x18003565f
mov rcx, qword [rsp + 0x108]
call fcn.1800bf8b4
mov qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 7
mov qword [rsp + 0x118], rbx
mov word [rsp + 0x108], bx
cmp qword [rsp + 0x170], 8
jb 0x180035a28
mov rcx, qword [rsp + 0x158]
call fcn.1800bf8b4
jmp 0x180035a28
mov edx, dword [rcx + 0x1fc]
cmp edx, 4
jne 0x1800356cb
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_GetParent]
xor r9d, r9d
mov edx, 0x59b
lea r8d, [r9 + 1]
mov rcx, rax
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x180035a28
cmp edx, 0xd
je 0x180035a28
cmp edx, 3
je 0x180035a28
cmp edx, 0x13
jne 0x1800356fc
mov rdx, rcx
mov rcx, rdi
call fcn.180034fc0
mov edx, esi
mov rcx, rdi
call fcn.180036450
jmp 0x180035a28
cmp edx, 5
jne 0x18003570e
mov rcx, rdi
call fcn.180034bf0
jmp 0x180035a28
cmp edx, 0x14
jne 0x180035720
mov rcx, rdi
call fcn.180034d20
jmp 0x180035a28
cmp edx, 0x15
jne 0x180035732
mov rcx, rdi
call fcn.180034d60
jmp 0x180035a28
cmp edx, 0x16
jne 0x180035744
mov rcx, rdi
call fcn.180034da0
jmp 0x180035a28
cmp edx, 0x1a
je 0x180035a20
cmp edx, 0x1b
je 0x180035a20
cmp edx, 0x1d
je 0x180035a20
cmp edx, 0x1c
je 0x180035a20
cmp edx, 0x17
jne 0x180035784
mov rcx, rdi
call fcn.180034f80
mov edx, esi
mov rcx, rdi
call fcn.180036450
jmp 0x180035a28
cmp edx, 0x18
jne 0x1800357a0
mov rcx, rdi
call fcn.180034f10
mov edx, esi
mov rcx, rdi
call fcn.180036450
jmp 0x180035a28
cmp edx, 0x19
jne 0x1800357d3
lea rdx, [rcx + 0x100]
lea rcx, [rsp + 0xd0]
call fcn.180002e40
mov rdx, rax
mov rcx, rdi
call fcn.180034e70
mov edx, esi
mov rcx, rdi
call fcn.180036450
jmp 0x180035a28
cmp edx, 0x12
jne 0x1800359ef
mov rsi, rbx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], ebx
call fcn.180069830
mov edi, 0x20219
mov ecx, 0x20119
test eax, eax
cmovne edi, ecx
mov qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 7
mov qword [rsp + 0x118], rbx
mov word [rsp + 0x108], bx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallF009657E_18AE_4744_A253_2FE9452A0BDC
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18003597e
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x70], rsi
and edi, 0x300
mov dword [rsp + 0x78], edi
mov word [rsp + 0x180], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x182]
call fcn.1800c31a0
mov dword [rsp + 0x40], 0x208
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.UninstallString
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov ecx, dword [rsp + 0x40]
test ecx, ecx
je 0x180035934
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x18003592a
cmp edx, 2
jbe 0x18003590a
cmp edx, 7
jne 0x18003592a
test cl, 1
jne 0x180035900
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x180035900
mov rdx, rcx
shr rdx, 1
cmp word [rsp + rdx*2 + 0x17e], 0
jne 0x180035900
cmp eax, 1
jbe 0x18003593c
cmp word [rsp + rdx*2 + 0x17c], 0
je 0x18003593c
mov word [rsp + 0x180], bx
jmp 0x18003596d
test cl, 1
jne 0x180035920
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0x17e], 0
je 0x18003593c
mov word [rsp + 0x180], bx
jmp 0x18003596d
mov word [rsp + 0x180], bx
jmp 0x18003596d
mov word [rsp + 0x180], bx
test edi, edi
jne 0x18003596d
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x180]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x100]
call fcn.180012440
test rsi, rsi
je 0x18003597e
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, rbx
cmp qword [rsp + 0x118], 0
je 0x1800359ab
lea rcx, [rsp + 0x108]
cmp qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 8
cmovae rcx, qword [rsp + 0x108]
xor edx, edx
call fcn.180075b50
nop
cmp qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 8
jb 0x1800359c3
mov rcx, qword [rsp + 0x108]
call fcn.1800bf8b4
mov qword [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], 7
mov qword [rsp + 0x118], rbx
mov word [rsp + 0x108], bx
test rsi, rsi
je 0x180035a28
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180035a28
lea rcx, [rdi + 0x1c18]
call fcn.180037910
mov rcx, qword [rax + 8]
cmp dword [rcx + 0x20c], 0
jne 0x180035a28
lea rdx, [rcx + 0xa8]
mov r8d, dword [rcx + 0xf8]
mov rcx, rdi
call fcn.180031570
jmp 0x180035a28
mov rcx, rdi
call fcn.1800368a0
mov eax, 1
jmp 0x180035a31
xor eax, eax
mov rcx, qword [rsp + 0x390]
xor rcx, rsp
call fcn.1800bf8d0
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret