Function at 0x14008a540
Capabilities:
Get installed programs
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x22880]
mov eax, 0x22980
call fcn.140216080
sub rsp, rax
mov rax, qword [0x14033e810]
xor rax, rsp
mov qword [rbp + 0x22870], rax
mov r15, r8
mov r12, rdx
mov r13, rcx
mov ebx, 0x20019
mov rdi, 0xffffffff80000002
xor eax, eax
mov dword [rbp - 0x7c], eax
mov rsi, 0xffffffff80000001
mov r14, rsi
movups xmm0, xmmword [str.REGISTRYHKEY_CURRENT_USER_]
movaps xmmword [rbp + 0x260], xmm0
movups xmm1, xmmword [0x1402f6b58]
movaps xmmword [rbp + 0x270], xmm1
movups xmm0, xmmword [0x1402f6b68]
movaps xmmword [rbp + 0x280], xmm0
movsd xmm1, qword [0x1402f6b78]
movsd qword [rbp + 0x290], xmm1
xor edx, edx
mov r8d, 0x3c8
lea rcx, [rbp + 0x298]
call fcn.140241ba0
lea rcx, [rbp + 0x110]
call fcn.14001fb40
nop
cmp dword [r13 + 0x360], 0
jne 0x14008a624
lea r8, [0x1402e82f0]
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x260]
call fcn.140057530
cmp eax, 1
cmove r14, qword [rbp + 0x118]
xor ecx, ecx
mov esi, ecx
nop dword [rax + rax]
movaps xmm0, xmmword [0x1402eddb0]
movaps xmmword [rbp + 0x660], xmm0
movaps xmm1, xmmword [0x1402eddc0]
movaps xmmword [rbp + 0x670], xmm1
movaps xmm0, xmmword [0x1402eddd0]
movaps xmmword [rbp + 0x680], xmm0
movaps xmm1, xmmword [0x1402edde0]
movaps xmmword [rbp + 0x690], xmm1
movaps xmm0, xmmword [0x1402eddf0]
movaps xmmword [rbp + 0x6a0], xmm0
movaps xmm1, xmmword [0x1402ede00]
movaps xmmword [rbp + 0x6b0], xmm1
movsd xmm0, qword [0x1402ede10]
movsd qword [rbp + 0x6c0], xmm0
xor edx, edx
mov r8d, 0x798
lea rcx, [rbp + 0x6c8]
call fcn.140241ba0
mov ecx, esi
test esi, esi
je 0x14008a6d8
sub ecx, 1
je 0x14008a6ce
sub ecx, 1
je 0x14008a6c7
cmp ecx, 1
jne 0x14008a6e4
mov rdi, r14
mov ebx, 0x20219
jmp 0x14008a6e4
mov ebx, 0x20219
jmp 0x14008a6dd
mov rdi, r14
mov ebx, 0x20119
jmp 0x14008a6e4
mov ebx, 0x20119
mov rdi, 0xffffffff80000002
mov ecx, 0x400
lea rax, [rbp + 0x660]
cmp word [rax], 0
je 0x14008a700
add rax, 2
sub rcx, 1
jne 0x14008a6f0
mov eax, 0x400
sub rax, rcx
test rcx, rcx
mov r10d, 0
cmove rax, r10
je 0x14008a76e
mov edx, 0x400
sub rdx, rax
lea rcx, [rbp + 0x660]
lea rcx, [rcx + rax*2]
je 0x14008a75f
mov r8d, 0x7ffffffe
lea r9, [0x1402ed690]
sub r9, rcx
nop dword [rax]
test r8, r8
je 0x14008a75f
movzx eax, word [rcx + r9]
test ax, ax
je 0x14008a75f
mov word [rcx], ax
add rcx, 2
dec r8
sub rdx, 1
jne 0x14008a740
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r10w
mov ecx, 0x400
lea rax, [rbp + 0x660]
nop word [rax + rax]
cmp word [rax], r10w
je 0x14008a790
add rax, 2
sub rcx, 1
jne 0x14008a780
mov eax, 0x400
sub rax, rcx
test rcx, rcx
cmove rax, r10
je 0x14008a7f0
mov edx, 0x400
sub rdx, rax
lea rcx, [rbp + 0x660]
lea rcx, [rcx + rax*2]
je 0x14008a7e1
mov r8d, 0x7ffffffe
mov r9, r12
sub r9, rcx
test r8, r8
je 0x14008a7e1
movzx eax, word [rcx + r9]
test ax, ax
je 0x14008a7e1
mov word [rcx], ax
add rcx, 2
dec r8
sub rdx, 1
jne 0x14008a7c2
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r10w
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, [rbp + 0x660]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008a905
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1870]
call fcn.140241ba0
mov dword [rbp - 0x7c], 0x800
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1870]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UninstallString
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete cl
test eax, eax
je 0x14008a898
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1870]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.UninstallTWestAnsiStrng
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete cl
test cl, cl
je 0x14008a8fb
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x1070]
call fcn.140241ba0
mov dword [rbp - 0x78], 0x800
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1070]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008a8fb
lea rcx, [rbp + 0x1070]
call fcn.14002e250
test eax, eax
jne 0x14008adb4
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
cmp esi, 4
jl 0x14008a630
lea rcx, [rbp]
call fcn.1400a64e0
nop
xor edx, edx
mov r8d, 0x20000
lea rcx, [rbp + 0x2870]
call fcn.140241ba0
xor ecx, ecx
mov dword [rbp - 0x80], ecx
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp - 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x58], rcx
movdqa xmm0, xmmword [0x1402fa1b0]
movdqu xmmword [rbp - 0x38], xmm0
mov r8, r12
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp]
call fcn.1400a6854
lea rcx, [rbp - 0x28]
call fcn.1400a64e0
nop
lea r8, str.Uninstall
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x28]
call fcn.1400a6854
mov edx, 0x10000
lea rcx, [rbp + 0x2870]
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea rax, [rbp + 0x2870]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14008a9d3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14008a9d3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14008a9b0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
xor r12d, r12d
mov word [rax], r12w
mov edi, dword [r13 + 0x3e4]
mov r15, 0xffffffff80000001
mov rbx, r15
lea rcx, [rbp + 0x30]
call fcn.14001fb40
nop
lea rsi, [r12 - 1]
lea r14d, [r12 + 1]
cmp dword [r13 + 0x360], r12d
jne 0x14008aa37
lea r8, [0x1402eddb0]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x2870]
call fcn.140057530
test eax, eax
je 0x14008aa37
mov rbx, qword [rbp + 0x38]
test rbx, rbx
je 0x14008aa9e
mov dword [rsp + 0x78], r12d
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], edi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2870]
lea r8, [0x1402eddb0]
mov rdx, rbx
mov rcx, r13
call fcn.1400584f0
nop
lea rcx, [rbp + 0x30]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rbp + 0x2870]
lea r8, [0x1402f3770]
lea rax, [rbp + 0x2870]
sub r8, rax
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14008aae7
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14008aae7
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14008aac4
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
mov ebx, dword [r13 + 0x3e4]
lea rcx, [rbp + 0x180]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], r12d
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
lea rax, [rbp - 0x28]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2870]
lea r8, [0x1402eddb0]
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400584f0
nop
lea rcx, [rbp + 0x180]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rbp + 0x2870]
lea r8, str.REGISTRYHKEY_CURRENT_USERSOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall
lea rax, [rbp + 0x2870]
sub r8, rax
nop
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14008abc3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14008abc3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14008aba0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
mov ebx, dword [r13 + 0x3e4]
lea rcx, [rbp + 0xa0]
call fcn.14001fb40
nop
lea rdi, [0x1402f3a70]
cmp dword [r13 + 0x360], 0
jne 0x14008ac1d
mov r8, rdi
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x2870]
call fcn.140057530
test eax, eax
je 0x14008ac1d
mov r15, qword [rbp + 0xa8]
test r15, r15
je 0x14008ac80
mov dword [rsp + 0x78], r12d
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
lea rax, [rbp - 0x28]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2870]
mov r8, rdi
mov rdx, r15
mov rcx, r13
call fcn.1400584f0
nop
lea rcx, [rbp + 0xa0]
call fcn.14001feb0
mov edx, 0x10000
lea rcx, [rbp + 0x2870]
lea r8, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall
lea rax, [rbp + 0x2870]
sub r8, rax
nop dword [rax]
lea rax, [rdx + 0x7ffefffe]
test rax, rax
je 0x14008acd3
movzx eax, word [r8 + rcx]
test ax, ax
je 0x14008acd3
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x14008acb0
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r12w
mov ebx, dword [r13 + 0x3e4]
lea rcx, [rbp + 0x1f0]
call fcn.14001fb40
nop
mov dword [rsp + 0x78], r12d
mov dword [rsp + 0x70], r12d
mov dword [rsp + 0x68], r14d
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], 2
mov dword [rsp + 0x40], ebx
lea rax, [rbp - 0x28]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2870]
mov r8, rdi
mov rdx, 0xffffffff80000002
mov rcx, r13
call fcn.1400584f0
nop
lea rcx, [rbp + 0x1f0]
call fcn.14001feb0
nop
call fcn.1400a2364
mov rcx, rax
test rax, rax
je 0x14008b0c0
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x68], rax
lea rax, [rbp + 0x260]
cmp rax, 0x10000
jae 0x14008af1a
lea rax, [rbp + 0x260]
movzx edx, ax
lea rcx, [rbp - 0x68]
call fcn.14000d610
jmp 0x14008af42
lea rcx, [r15 + 0x18]
lea rdx, [rbp + 0x660]
mov rsi, 0xffffffffffffffff
mov rax, rsi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14008add0
mov r8d, eax
lea rdx, [rbp + 0x660]
call fcn.14000df90
lea rcx, [r15 + 0x10]
lea rdx, [rbp + 0xe60]
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14008ae00
mov r8d, eax
lea rdx, [rbp + 0xe60]
call fcn.14000df90
mov eax, dword [r13 + 0x3e4]
mov dword [r15 + 0x3c], eax
mov r14d, 1
mov dword [r15 + 0x38], r14d
lea rcx, [rbp + 0x1070]
mov rax, rsi
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14008ae40
mov r8d, eax
lea rdx, [rbp + 0x1070]
mov rcx, r15
call fcn.14000df90
lea rcx, [r15 + 8]
lea rdx, [rbp + 0x1870]
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14008ae70
mov r8d, eax
lea rdx, [rbp + 0x1870]
call fcn.14000df90
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x2070]
call fcn.140241ba0
mov dword [rbp - 0x78], 0x800
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2070]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.InstallLocation
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008af0b
lea rdx, [rbp + 0x2070]
mov rcx, r13
call fcn.14008b5a0
test eax, eax
je 0x14008af0b
lea rcx, [r15 + 0x20]
lea rax, [rbp + 0x2070]
inc rsi
cmp word [rax + rsi*2], 0
jne 0x14008aef2
mov r8d, esi
lea rdx, [rbp + 0x2070]
call fcn.14000df90
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14008b087
lea rcx, [rbp + 0x260]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], 0
jne 0x14008af24
mov r8d, eax
lea rdx, [rbp + 0x260]
lea rcx, [rbp - 0x68]
call fcn.14000df90
nop
mov rax, rsi
inc rax
cmp word [rdi + rax*2], 0
jne 0x14008af45
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.1400157c0
mov r15, qword [rbp - 0x58]
mov rbx, qword [rbp - 0x68]
test r15, r15
je 0x14008b030
nop
mov rdi, qword [r15 + 0x10]
mov r15, qword [r15]
mov rdx, rbx
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008b027
lea rdx, str.REGISTRYHKEY_LOCAL_MACHINESOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14008b027
mov rcx, qword [r13 + 0x3f0]
mov rdx, qword [rdi + 0x10]
cmp dword [r13 + 0x3e4], 0
je 0x14008afd0
call fcn.140055020
mov rcx, rax
test rax, rax
je 0x14008b010
mov dword [rax + 0x20], 2
jmp 0x14008afe1
call fcn.140055020
mov rcx, rax
test rax, rax
je 0x14008b010
mov dword [rax + 0x20], r14d
mov eax, dword [rax + 0x24]
test eax, eax
je 0x14008aff6
cmp eax, 2
jne 0x14008b00c
mov dword [rcx + 0x24], 5
jmp 0x14008b00c
mov rax, qword [rcx + 0x28]
cmp qword [rax + 0x18], 0
jne 0x14008b00c
cmp qword [rcx + 8], 0
jne 0x14008b00c
mov dword [rcx + 0x24], r14d
mov dword [rcx + 0x24], r14d
cmp dword [rdi + 0x30], 0
je 0x14008b01f
mov rcx, qword [rdi + 0x28]
call fcn.140095d64
mov rcx, rdi
call fcn.14005dc90
test r15, r15
jne 0x14008af70
mov r14d, r12d
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14008b04b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rbp - 0x28]
call fcn.1400a6500
nop
lea rax, vtable.CList_struct_FoundRegData____ptr64__struct_FoundRegData____ptr64_.0
mov qword [rbp - 0x60], rax
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x58], r12
mov rcx, qword [rbp - 0x38]
call fcn.1400ad45c
mov qword [rbp - 0x38], r12
lea rcx, [rbp]
call fcn.1400a6500
nop
lea rcx, [rbp + 0x110]
call fcn.14001feb0
mov eax, r14d
mov rcx, qword [rbp + 0x22870]
xor rcx, rsp
call fcn.1402155d0
mov rbx, qword [rsp + 0x229d8]
add rsp, 0x22980
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400080b0
int3