Function at 0x140003d10
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x6d0
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x140087990]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x44], ebp
mov qword [r11 - 0x628], 7
mov qword [r11 - 0x630], rbp
mov word [rsp + 0x98], bp
xor r8d, r8d
lea rdx, [0x140073800]
lea rcx, [r11 - 0x648]
call fcn.14003b810
nop
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140003ded
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rbp
mov word [rbx + 8], bp
xor r8d, r8d
lea rdx, [0x140073800]
mov rcx, rbx
call fcn.14003b810
nop
cmp qword [rsp + 0xb0], 8
jb 0x140003de5
mov rcx, qword [rsp + 0x98]
call fcn.140044814
mov rax, rbx
jmp 0x140004006
mov esi, ebp
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x2c0]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x140003fb8
test eax, eax
jne 0x140003f75
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x2c0]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140003f7f
mov dword [rsp + 0x48], 0x200
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003f6a
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.SystemComponent
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140003f6a
mov qword [rsp + 0x80], 7
mov qword [rsp + 0x78], rbp
mov word [rsp + 0x68], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x60]
call fcn.14003b810
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x90]
call fcn.14003b540
nop
cmp qword [rsp + 0x80], 8
jb 0x140003f50
mov rcx, qword [rsp + 0x68]
call fcn.140044814
mov r8d, 2
lea rdx, [0x1400738d0]
lea rcx, [rsp + 0x90]
call fcn.14003b690
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x2c0]
mov edx, esi
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x140003e30
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rbp
mov word [rbx + 8], bp
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x90]
mov rcx, rbx
call fcn.140039eb0
nop
cmp qword [rsp + 0xb0], 8
jb 0x140004003
mov rcx, qword [rsp + 0x98]
call fcn.140044814
mov rax, rbx
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.140044830
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret