Function at 0x1400039d5
Capabilities:
Get installed programs

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3e8
lea rdx, str.__Regdump_:_n
lea rsi, section..data
mov rbx, rcx
lea rdi, [rsp + 0x170]
call fcn.14000154a
lea rax, [rsp + 0x80]
mov ecx, 0x24
lea rdx, str.SoftwareSimonTathamPuTTY
rep movsd dword [rdi], dword [rsi]
lea rsi, [rsp + 0x200]
mov qword [rsp + 0x70], rax
xor eax, eax
mov rcx, rsi
mov qword [rsp + 0x78], rax
mov byte [rsp + 0x80], 0
call fcn.14000154a
lea rcx, [rsp + 0x220]
lea rdx, str.SoftwareMicrosoftInternet_ExplorerTypeURLS
call fcn.14000154a
jmp 0x140003a60
lea rcx, [rsp + 0x240]
lea rdx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstall
call fcn.14000154a
jmp 0x140003a80
lea rcx, [rsp + 0x260]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
call fcn.14000154a
jmp 0x140003aa0
lea rcx, [rsp + 0x280]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerWordWheelQuery
call fcn.14000154a
jmp 0x140003ac0
lea rcx, [rsp + 0x2a0]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.14000154a
jmp 0x140003ae0
lea rcx, [rsp + 0x2c0]
lea rdx, str.SYSTEMCurrentControlSetEnum
call fcn.14000154a
jmp 0x140003b00
lea rcx, [rsp + 0x2e0]
lea rdx, str.SYSTEMMountedDevices
call fcn.14000154a
jmp 0x140003b20
lea rcx, [rsp + 0x300]
lea rdx, str.SYSTEMHardwareConfigCurrent
call fcn.14000154a
jmp 0x140003b40
lea rcx, [rsp + 0x320]
lea rdx, str.SYSTEMControlSet001Controlhivelist
call fcn.14000154a
jmp 0x140003b60
lea rcx, [rsp + 0x340]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
call fcn.14000154a
jmp 0x140003b80
lea rcx, [rsp + 0x360]
lea rdx, str.SoftwareRegisteredApplicationsPackagedApps
call fcn.14000154a
jmp 0x140003ba0
lea rcx, [rsp + 0x380]
lea rdx, str.SystemControlSet001ServiceslanmanserverShares
call fcn.14000154a
jmp 0x140003bc0
lea rcx, [rsp + 0x3a0]
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkList
call fcn.14000154a
jmp 0x140003be0
lea rcx, [rsp + 0x3c0]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
call fcn.14000154a
lea rax, [rsp + 0xb0]
lea rdi, [rsp + 0x170]
mov qword [rsp + 0x50], rax
jmp 0x140003dbc
lea rax, [rsp + 0xf0]
lea r15, [0x1400d44ea]
mov rdx, r15
mov rcx, rax
mov qword [rsp + 0x48], rax
call fcn.14000154a
lea rax, [rsp + 0x110]
mov rdx, qword [rsp + 0x48]
mov r8, r14
mov rcx, rax
mov qword [rsp + 0x40], rax
call fcn.1400c8260
mov rax, qword [rsp + 0x138]
lea rdx, [rsp + 0x120]
add rax, qword [rsp + 0x118]
cmp qword [rsp + 0x110], rdx
je 0x140003de9
cmp qword [rsp + 0x120], rax
jae 0x140003e0e
lea rcx, [rsp + 0x140]
mov edx, 0xf
cmp qword [rsp + 0x130], rcx
jne 0x140003e01
cmp rdx, rax
jb 0x140003e0e
mov r8, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor edx, edx
call fcn.1400aa730
mov rdx, rax
lea rcx, [rsp + 0x150]
call fcn.1400ab7e0
lea rax, [rsp + 0x150]
mov rcx, rbx
mov rdx, rax
mov qword [rsp + 0x38], rax
call fcn.140001698
mov rcx, qword [rsp + 0x38]
mov rbp, rsi
call fcn.1400a8d40
mov rcx, qword [rsp + 0x40]
call fcn.1400a8d40
mov rcx, qword [rsp + 0x48]
call fcn.1400a8d40
mov rcx, qword [rsp + 0x30]
call fcn.1400a8d40
lea rcx, [rsp + 0x90]
mov rdx, rbp
call fcn.1400ab9a0
lea rax, [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x140003e22
lea rcx, [rsp + 0x90]
add rbp, 0x20
call fcn.1400a8d40
lea rax, [rsp + 0x3e0]
cmp rbp, rax
jne 0x140003d0d
mov rax, qword [rbx + 8]
test rax, rax
jne 0x140003fb4
lea rbp, [rsp + 0x150]
lea rdx, str._n___n
mov rcx, rbp
call fcn.14000154a
mov rdx, rbp
mov rcx, rbx
call fcn.140001698
mov rcx, qword [rsp + 0x38]
call fcn.1400a8d40
mov rax, qword [rbx + 8]
test rax, rax
jne 0x140003fd7
add rdi, 0x10
cmp rdi, rsi
je 0x140003ffa
mov rax, qword [rdi]
lea rdx, str._:___n
mov r14, qword [rdi + 8]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x130]
mov rcx, rax
mov qword [rsp + 0x30], rax
call fcn.14000154a
jmp 0x140003c15
cmp rax, 0xf
jbe 0x140003e0e
lea rdx, [rsp + 0x140]
cmp qword [rsp + 0x130], rdx
je 0x140003e0e
mov rdx, qword [rsp + 0x140]
jmp 0x140003ca0
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
call fcn.1400aa0b0
jmp 0x140003cba
lea rdx, [0x1400d47b3]
mov rcx, rbx
call fcn.14000169e
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
call fcn.14000154a
lea r12, [rsp + 0x150]
lea rdx, [0x1400d40ba]
mov rcx, r12
call fcn.14000154a
mov rcx, qword [rsp + 0x30]
lea rdx, [0x1400d40bd]
call fcn.14000154a
mov r8, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
call fcn.140001795
mov rcx, qword [rsp + 0x30]
lea r12, [rsp + 0xd0]
call fcn.1400a8d40
mov rcx, qword [rsp + 0x38]
call fcn.1400a8d40
mov rdx, r14
mov rcx, r12
call fcn.14000154a
mov rcx, qword [rsp + 0x48]
mov r8, r12
mov rdx, r15
call fcn.1400c8290
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
lea r8, [0x1400d40ba]
call fcn.1400c8260
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
call fcn.1400aa0b0
mov rcx, qword [rsp + 0x30]
mov rdx, rax
lea r13, [rsp + 0x150]
call fcn.1400ab7e0
mov rdx, qword [rsp + 0x30]
lea r8, str._:__n
mov rcx, r13
call fcn.1400c8260
mov rdx, r13
mov rcx, rbx
call fcn.140001698
mov rcx, qword [rsp + 0x38]
call fcn.1400a8d40
mov rcx, qword [rsp + 0x30]
call fcn.1400a8d40
mov rcx, qword [rsp + 0x40]
call fcn.1400a8d40
mov rcx, qword [rsp + 0x48]
call fcn.1400a8d40
mov rcx, r12
call fcn.1400a8d40
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x90]
call fcn.1400ab9a0
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x38]
call fcn.140003927
mov rdx, qword [rsp + 0x38]
lea r12, [rsp + 0x70]
mov rcx, r12
call fcn.14000158e
mov rcx, qword [rsp + 0x38]
call fcn.1400a8d40
mov rcx, qword [rsp + 0x30]
call fcn.1400a8d40
mov rdx, r12
mov rcx, rbx
call fcn.140001698
lea rdx, str.__n__n
mov rcx, rbx
call fcn.14000169e
mov rcx, qword [rsp + 0x50]
call fcn.1400a8d40
jmp 0x140003d4b
mov rdx, qword [rbx]
cmp byte [rdx + rax - 3], 0x7d
jne 0x140003d76
mov rcx, rbx
call fcn.1400ab410
mov rcx, rbx
call fcn.1400ab410
jmp 0x140003d76
mov rdx, qword [rbx]
cmp byte [rdx + rax - 3], 0x5d
je 0x140003daf
mov rcx, rbx
call fcn.1400ab410
mov rcx, rbx
call fcn.1400ab410
jmp 0x140003daf
cmp qword [rbx + 8], 0
je 0x140004011
mov rcx, rbx
call fcn.1400ab410
mov rcx, rbx
call fcn.1400ab410
lea rdx, str._n_n_n
mov rcx, rbx
call fcn.14000169e
lea rsi, [rsp + 0x3e0]
lea rdi, [rsp + 0x200]
sub rsi, 0x20
mov rcx, rsi
call fcn.1400a8d40
cmp rsi, rdi
jne 0x140004030
jmp 0x140004175
lea rcx, [rsp + 0x70]
call fcn.1400a8d40
mov rax, rbx
add rsp, 0x3e8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret