Function at 0x14016f13c
Capabilities:
Get installed programs
Persist via run registry key

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x658]
sub rsp, 0x730
xor r14d, r14d
mov r8d, 0x104
lea rdx, [rbp + 0x520]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp + 0x520]
mov qword [rsp + 0x30], rax
lea rcx, [rbp + 0x520]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], r14b
jne 0x14016f195
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140162e48
nop
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x40]
call fcn.14016cf00
nop
lea rdx, [rbp]
mov rcx, rax
call fcn.140160304
nop
lea rcx, [rbp - 0x20]
call fcn.140162508
nop
lea rcx, [rsp + 0x40]
call fcn.140162508
lea rdx, [rbp]
lea rcx, [rbp - 0x78]
call fcn.14016d918
nop
mov r15, 0xffffffff80000001
mov qword [rbp + 0x160], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x178], r14
mov qword [rbp + 0x180], r14
mov esi, reloc.WS2_32.dll_gethostname
mov r8d, esi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU
lea rcx, [rbp + 0x168]
call fcn.140159cd4
nop
mov qword [rbp + 0x188], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1a0], xmm1
lea r12d, [rsi + 0x12]
mov r8d, r12d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSavePidlMRU
lea rcx, [rbp + 0x190]
call fcn.140159cd4
nop
mov qword [rbp + 0x1b0], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b8], xmm0
mov qword [rbp + 0x1c8], r14
mov qword [rbp + 0x1d0], r14
lea r8d, [rsi + 0x15]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedPidlMRU
lea rcx, [rbp + 0x1b8]
call fcn.140159cd4
nop
mov qword [rbp + 0x1d8], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1f0], xmm1
lea edi, [rsi + 4]
mov r8d, edi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs
lea rcx, [rbp + 0x1e0]
call fcn.140159cd4
nop
mov qword [rbp + 0x200], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x208], xmm0
mov qword [rbp + 0x218], r14
mov qword [rbp + 0x220], r14
mov r8d, edi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
lea rcx, [rbp + 0x208]
call fcn.140159cd4
nop
mov qword [rbp + 0x228], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x240], xmm1
lea r8d, [rsi - 0x13]
lea rdx, str.SoftwareMicrosoftWindowsShellNoRoam
lea rcx, [rbp + 0x230]
call fcn.140159cd4
nop
mov qword [rbp + 0x250], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x258], xmm0
mov qword [rbp + 0x268], r14
mov qword [rbp + 0x270], r14
lea r8d, [rsi + 3]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerStreamMRU
lea rcx, [rbp + 0x258]
call fcn.140159cd4
nop
mov qword [rbp + 0x278], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x280], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x290], xmm1
lea r8d, [rsi + 2]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionSearchRecentApps
lea rcx, [rbp + 0x280]
call fcn.140159cd4
nop
mov qword [rbp + 0x2a0], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x2a8], xmm0
mov qword [rbp + 0x2b8], r14
mov qword [rbp + 0x2c0], r14
lea ebx, [rsi + 0x20]
mov r8d, ebx
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore
lea rcx, [rbp + 0x2a8]
call fcn.140159cd4
nop
mov qword [rbp + 0x2c8], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2e0], xmm1
mov r8d, r12d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched
lea rcx, [rbp + 0x2d0]
call fcn.140159cd4
nop
mov qword [rbp + 0x2f0], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f8], xmm0
mov qword [rbp + 0x308], r14
mov qword [rbp + 0x310], r14
lea r8d, [rsi + 0x13]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFeatureUsageShowJumpView
lea rcx, [rbp + 0x2f8]
call fcn.140159cd4
nop
mov qword [rbp + 0x318], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x320], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x330], xmm1
lea r8d, [rsi + 0x10]
lea rdx, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
lea rcx, [rbp + 0x320]
call fcn.140159cd4
nop
mov qword [rbp + 0x340], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x348], xmm0
mov qword [rbp + 0x358], r14
mov qword [rbp + 0x360], r14
lea r8d, [rsi + 8]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerWordWheelQuery
lea rcx, [rbp + 0x348]
call fcn.140159cd4
nop
lea r12, [r15 + 1]
mov qword [rbp + 0x368], r12
xorps xmm0, xmm0
movups xmmword [rbp + 0x370], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x380], xmm1
lea r8d, [rsi - 0x18]
lea rdx, str.SYSTEMCurrentControlSetServices
lea rcx, [rbp + 0x370]
call fcn.140159cd4
nop
mov qword [rbp + 0x390], r12
xorps xmm0, xmm0
movups xmmword [rbp + 0x398], xmm0
mov qword [rbp + 0x3a8], r14
mov qword [rbp + 0x3b0], r14
lea r8d, [rsi + 0x48]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionAppModelStateRepositoryCacheApplicationIndexPackageAndPackageRelativeApplicationId
lea rcx, [rbp + 0x398]
call fcn.140159cd4
nop
mov qword [rbp + 0x3b8], r12
xorps xmm0, xmm0
movups xmmword [rbp + 0x3c0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3d0], xmm1
mov r8d, ebx
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantStore
lea rcx, [rbp + 0x3c0]
call fcn.140159cd4
nop
mov qword [rbp + 0x3e0], r12
xorps xmm0, xmm0
movups xmmword [rbp + 0x3e8], xmm0
mov qword [rbp + 0x3f8], r14
mov qword [rbp + 0x400], r14
lea r8d, [rsi + 0x16]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerVolumeCachesTemporary_Files
lea rcx, [rbp + 0x3e8]
call fcn.140159cd4
nop
mov qword [rbp + 0x408], r12
xorps xmm0, xmm0
movups xmmword [rbp + 0x410], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x420], xmm1
lea r8d, [rsi - 6]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea rcx, [rbp + 0x410]
call fcn.140159cd4
nop
mov qword [rbp + 0x430], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x438], xmm0
mov qword [rbp + 0x448], r14
mov qword [rbp + 0x450], r14
lea r8d, [rsi + 0xe]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSaveMRU
lea rcx, [rbp + 0x438]
call fcn.140159cd4
nop
mov qword [rbp + 0x458], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x460], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x470], xmm1
lea r8d, [rsi + 0x11]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32LastVisitedMRU
lea rcx, [rbp + 0x460]
call fcn.140159cd4
nop
mov qword [rbp + 0x480], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x488], xmm0
mov qword [rbp + 0x498], r14
mov qword [rbp + 0x4a0], r14
mov r8d, esi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU
lea rcx, [rbp + 0x488]
call fcn.140159cd4
nop
mov qword [rbp + 0x4a8], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x4b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x4c0], xmm1
mov r8d, edi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs
lea rcx, [rbp + 0x4b0]
call fcn.140159cd4
nop
mov qword [rbp + 0x4d0], r12
xorps xmm0, xmm0
movups xmmword [rbp + 0x4d8], xmm0
mov qword [rbp + 0x4e8], r14
mov qword [rbp + 0x4f0], r14
lea r8d, [rsi - 0xc]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rbp + 0x4d8]
call fcn.140159cd4
nop
mov qword [rbp + 0x4f8], r12
xorps xmm0, xmm0
movups xmmword [rbp + 0x500], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x510], xmm1
lea r8d, [rsi + 9]
lea rdx, str.SOFTWARESOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
lea rcx, [rbp + 0x500]
call fcn.140159cd4
nop
lea rax, [rbp + 0x160]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x520]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x40]
call fcn.1401722d8
nop
lea r9, [fcn.14016fbb0]
lea edx, [rsi - 0x11]
lea r8d, [rsi - 0x21]
lea rcx, [rbp + 0x160]
call fcn.140cd8b14
mov rsi, qword [rbp - 0x38]
lea r12d, [rdi - 0x1e]
mov r13d, 0x1000
mov rdi, qword [rbp - 0x40]
cmp rdi, rsi
je 0x14016f8ae
add rdi, 8
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x14016f789
mov rdx, qword [rdi]
lea rax, [rbp + 0x660]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, qword [rdi - 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14016f7ce
lea r8, [rbp - 0x78]
mov rdx, qword [rbp + 0x660]
call fcn.140170a84
mov rcx, qword [rbp + 0x660]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14016f89d
mov rbx, qword [0x1410a1040]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov r8, r12
lea rdx, str.Failed_to_open_registry_key:_
lea rcx, [rsp + 0x40]
call fcn.140159cd4
nop
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x78], r14
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rsp + 0x70]
movaps xmmword [rbp - 0x20], xmm1
movsd xmm0, qword [rbp - 0x80]
movsd qword [rbp - 0x10], xmm0
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x60]
mov r8d, 3
lea rdx, [rbp - 0x20]
mov rcx, qword [rbx]
call fcn.140173bfc
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14016f89d
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, r13
jb 0x14016f898
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r12
ja 0x14016fba8
call fcn.140cd8948
add rdi, 0x28
lea rax, [rdi - 8]
cmp rax, rsi
jne 0x14016f77c
mov qword [rbp + 0x20], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], r14
mov r8d, 0x4b
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFeatureUsageAppSwitched
lea rcx, [rbp + 0x28]
call fcn.140159cd4
nop
mov qword [rbp + 0x48], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x60], xmm1
mov r8d, 0x1e
lea rdx, str.SoftwareMicrosoftDirectInput
lea rcx, [rbp + 0x50]
call fcn.140159cd4
nop
mov qword [rbp + 0x70], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], r14
mov qword [rbp + 0x90], r14
mov ebx, 0x3d
mov r8d, ebx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerTypedPaths
lea rcx, [rbp + 0x78]
call fcn.140159cd4
nop
mov qword [rbp + 0x98], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xb0], xmm1
lea edi, [rbx - 4]
mov r8d, edi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionAppletsRegedit
lea rcx, [rbp + 0xa0]
call fcn.140159cd4
nop
mov qword [rbp + 0xc0], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0xc8], xmm0
mov qword [rbp + 0xd8], r14
mov qword [rbp + 0xe0], r14
mov r8d, edi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU
lea rcx, [rbp + 0xc8]
call fcn.140159cd4
nop
mov qword [rbp + 0xe8], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
mov r8d, ebx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerTypedPaths
lea rcx, [rbp + 0xf0]
call fcn.140159cd4
nop
mov qword [rbp + 0x110], r15
xorps xmm0, xmm0
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], r14
mov qword [rbp + 0x130], r14
mov r8d, ebx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUserAssist
lea rcx, [rbp + 0x118]
call fcn.140159cd4
nop
mov qword [rbp + 0x138], 0xffffffff80000002
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x150], xmm1
lea r8d, [rbx + 2]
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerAppCompatCache
lea rcx, [rbp + 0x140]
call fcn.140159cd4
nop
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x160]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x58]
call fcn.1401722d8
nop
lea r9, [fcn.14016fbb0]
lea edx, [rbx - 0x15]
lea r8d, [rbx - 0x35]
lea rcx, [rbp + 0x20]
call fcn.140cd8b14
mov rdi, qword [rbp - 0x50]
mov rbx, qword [rbp - 0x58]
cmp rbx, rdi
je 0x14016faf2
add rbx, 8
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14016faa5
mov rdx, qword [rbx]
lea rax, [rbp + 0x660]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, qword [rbx - 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14016fae5
lea r8, [rbp - 0x78]
mov rdx, qword [rbp + 0x660]
call fcn.14017122c
mov rcx, qword [rbp + 0x660]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rbx, 0x28
lea rax, [rbx - 8]
cmp rax, rdi
jne 0x14016fa98
lea rcx, [rbp - 0x58]
call fcn.14017285c
nop
lea rcx, [rbp - 0x40]
call fcn.14017285c
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14016fb38
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, r13
jb 0x14016fb33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r12
ja 0x14016fba2
call fcn.140cd8948
movdqa xmm0, xmmword [0x140fcf500]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], r14b
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14016fb7b
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, r13
jb 0x14016fb76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r12
ja 0x14016fb9c
call fcn.140cd8948
lea r11, [rsp + 0x730]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140cf5acc
nop
call fcn.140cf5acc
nop
call fcn.140cf5acc
int3