Function at 0x140068e90
Capabilities:
Get installed programs

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r15
sub rsp, 0x8a0
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov rax, r9
mov rbx, rcx
mov qword [rsp + 0x58], rcx
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x68], r8
mov r15, rdx
lea rdx, str.CRegistryIF
lea r9, str.lpszOem_s__lpszCurMdlPath_s__strUninstallKey_x
lea r8, str.GetUninstallKeyName
mov qword [rsp + 0x60], rax
call fcn.140081070
mov rcx, qword [rbx]
lea rax, [rsp + 0x48]
lea rsi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea r9, str.hKey_x__lpszSubKey_s__phSubKey_x
mov qword [rsp + 0x30], rax
lea r8, str.OpenSubKey
lea rdx, str.CRegistryIF
mov qword [rsp + 0x28], rsi
xor ebp, ebp
mov qword [rsp + 0x20], 0xffffffff80000002
call fcn.140081070
lea rax, [rsp + 0x50]
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
xor edi, edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140068f6a
mov rax, qword [rsp + 0x50]
mov edi, 1
mov qword [rsp + 0x48], rax
mov rcx, qword [rbx]
mov qword [rsp + 0x898], r12
lea r9, [0x1400fb428]
lea r8, str.OpenSubKey
lea rdx, str.CRegistryIF
mov qword [rsp + 0x890], r13
mov qword [rsp + 0x888], r14
mov dword [rsp + 0x20], edi
call fcn.140081270
test edi, edi
je 0x1400691f8
mov rdx, qword [rsp + 0x48]
mov rcx, rbx
call fcn.1400672f0
test rax, rax
mov r13, rax
je 0x1400691ed
mov rcx, qword [rax + 0x10]
xor r8d, r8d
test rcx, rcx
mov edi, r8d
mov dword [rsp + 0x40], r8d
mov r14d, r8d
mov rsi, r8
jle 0x1400691de
test edi, edi
jne 0x1400691de
test rsi, rsi
js 0x140069007
cmp rsi, rcx
jge 0x140069007
test rsi, rsi
js 0x1400691d8
mov rax, qword [r13 + 8]
mov r12, qword [rax + rsi*8]
jmp 0x14006900a
mov r12, r8
test r15, r15
je 0x140069057
mov ecx, 0x7fffffff
mov rax, r15
mov edx, r8d
nop
nop
cmp word [rax], 0
je 0x14006903a
add rax, 2
sub rcx, 1
jne 0x140069020
mov edx, 0x80070057
mov rax, r8
jmp 0x140069051
test rcx, rcx
jne 0x140069049
mov edx, 0x80070057
mov rax, r8
jmp 0x140069051
mov eax, 0x7fffffff
sub rax, rcx
test edx, edx
jns 0x140069065
jmp 0x14006905c
mov edx, 0x80070057
mov rax, r8
test edx, edx
cmovs rax, r8
movsxd r8, eax
mov rdx, r12
mov rcx, r15
call fcn.1400ce2c0
test eax, eax
jne 0x1400691bc
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400691bc
mov rdx, qword [rsp + 0x50]
lea r8, str.UninstallString
mov rcx, rbx
call fcn.1400678e0
test rax, rax
mov rbx, rax
je 0x1400691ac
mov r9, qword [rsp + 0x68]
test r9, r9
je 0x140069116
xor ebp, ebp
mov edx, 0x7fffffff
mov rcx, r9
mov edi, ebp
nop
nop
cmp word [rcx], di
je 0x1400690f9
add rcx, 2
sub rdx, 1
jne 0x1400690e0
mov edi, 0x80070057
mov rax, rbp
jmp 0x140069110
test rdx, rdx
jne 0x140069108
mov edi, 0x80070057
mov rax, rbp
jmp 0x140069110
mov eax, 0x7fffffff
sub rax, rdx
test edi, edi
jns 0x140069126
jmp 0x14006911d
mov edi, 0x80070057
xor ebp, ebp
mov rax, rbp
test edi, edi
cmovs rax, rbp
movsxd r8, eax
mov rdx, rbx
mov rcx, r9
call fcn.1400ce2c0
test eax, eax
sete bpl
test ebp, ebp
je 0x1400691a8
mov r9, r12
mov r12, qword [rsp + 0x58]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov rcx, qword [r12 + 8]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x20], 0x400
call fcn.140013060
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
mov ebp, eax
xor eax, eax
lea rdx, [rsp + 0x70]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rcx, qword [rsp + 0x60]
call fcn.140003940
mov rcx, qword [r12 + 8]
mov r8, rbx
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, 1
mov dword [rsp + 0x40], edi
jmp 0x1400691ac
mov edi, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
mov rcx, qword [r13 + 0x10]
add r14d, 1
add rsi, 1
movsxd rax, r14d
cmp rax, rcx
jge 0x1400691de
xor r8d, r8d
jmp 0x140068fe2
call fcn.1400a0610
int3
mov rax, qword [r13]
mov edx, 1
mov rcx, r13
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx]
lea r9, [0x1400fb428]
lea r8, str.GetUninstallKeyName
lea rdx, str.CRegistryIF
mov dword [rsp + 0x20], ebp
call fcn.140081270
mov r14, qword [rsp + 0x888]
mov r13, qword [rsp + 0x890]
mov r12, qword [rsp + 0x898]
mov eax, ebp
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.1400cd6e0
add rsp, 0x8a0
pop r15
pop rdi
pop rsi
pop rbp
pop rbx
ret