Function at 0x4ed92b
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51348d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xfb0
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x658], 0
lea ecx, [ebp - 0x654]
call sub.MFC42.DLL_CStringArray::CStringArray
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x424]
call sub.MFC42.DLL_CStringArray::CStringArray
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa78]
call sub.MFC42.DLL_CStringArray::CStringArray
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x53c]
call sub.MFC42.DLL_CStringArray::CStringArray
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x528]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x424]
call fcn.0050f5b0
lea ecx, [ebp - 0xa78]
call fcn.0050f5b0
lea ecx, [ebp - 0x53c]
call fcn.0050f5b0
lea ecx, [ebp - 0x654]
call fcn.0050f5b0
push 0x5a5190
lea ecx, [ebp - 0x654]
call fcn.0050f680
push str.SoftwareWOW6432nodeMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x654]
call fcn.0050f680
mov dword [ebp - 0x660], 0
jmp 0x4eda21
mov eax, dword [ebp - 0x660]
add eax, 1
mov dword [ebp - 0x660], eax
lea ecx, [ebp - 0x654]
call fcn.0050f110
cmp dword [ebp - 0x660], eax
jge 0x4edc24
mov ecx, dword [ebp - 0x660]
push ecx
lea ecx, [ebp - 0x654]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x63c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov dword [ebp - 0x658], 0
lea eax, [ebp - 0x664]
push eax
push 0x20119
push 0
lea ecx, [ebp - 0x63c]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4edc1f
push 0x100
lea edx, [ebp - 0x524]
push edx
mov eax, dword [ebp - 0x658]
mov dword [ebp - 0xf90], eax
mov ecx, dword [ebp - 0xf90]
push ecx
mov edx, dword [ebp - 0x664]
push edx
mov eax, dword [ebp - 0x658]
add eax, 1
mov dword [ebp - 0x658], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4edc12
lea ecx, [ebp - 0x524]
push ecx
mov edx, dword [ebp - 0x660]
push edx
lea ecx, [ebp - 0x654]
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push 0x5a5204
lea ecx, [ebp - 0xf78]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5a520c
lea edx, [ebp - 0xf78]
push edx
push 0x80000002
lea eax, [ebp - 0xf7c]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0xf94], eax
mov ecx, dword [ebp - 0xf94]
mov dword [ebp - 0xf98], ecx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0xf98]
push edx
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xf7c]
call sub.MFC42.DLL_CString::CString
push 0x5a5218
lea eax, [ebp - 0xf78]
push eax
push 0x80000002
lea ecx, [ebp - 0xf80]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0xf9c], eax
mov edx, dword [ebp - 0xf9c]
mov dword [ebp - 0xfa0], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0xfa0]
push eax
lea ecx, [ebp - 0x528]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xf80]
call sub.MFC42.DLL_CString::CString
push 0x5a5228
lea ecx, [ebp - 0x410]
push ecx
call fcn.0050f630
and eax, 0xff
test eax, eax
je 0x4edc0d
push 0x5a5230
lea edx, [ebp - 0x528]
push edx
call fcn.0050f630
and eax, 0xff
test eax, eax
je 0x4edc0d
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x424]
call fcn.0050f0c0
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0xa78]
call fcn.0050f0c0
jmp 0x4eda93
mov edx, dword [ebp - 0x664]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4eda12
lea eax, [ebp - 0x664]
push eax
push 0x20119
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4eddcb
mov dword [ebp - 0x658], 0
push 0x100
lea ecx, [ebp - 0x524]
push ecx
mov edx, dword [ebp - 0x658]
mov dword [ebp - 0xfa4], edx
mov eax, dword [ebp - 0xfa4]
push eax
mov ecx, dword [ebp - 0x664]
push ecx
mov edx, dword [ebp - 0x658]
add edx, 1
mov dword [ebp - 0x658], edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4eddbe
lea eax, [ebp - 0x524]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_s
lea ecx, [ebp - 0xf78]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.DisplayName
lea edx, [ebp - 0xf78]
push edx
push 0x80000001
lea eax, [ebp - 0xf84]
push eax
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0xfa8], eax
mov ecx, dword [ebp - 0xfa8]
mov dword [ebp - 0xfac], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0xfac]
push edx
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xf84]
call sub.MFC42.DLL_CString::CString
push str.UninstallString
lea eax, [ebp - 0xf78]
push eax
push 0x80000001
lea ecx, [ebp - 0xf88]
push ecx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0xfb0], eax
mov edx, dword [ebp - 0xfb0]
mov dword [ebp - 0xfb4], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0xfb4]
push eax
lea ecx, [ebp - 0x528]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xf88]
call sub.MFC42.DLL_CString::CString
push 0x5a52c0
lea ecx, [ebp - 0x410]
push ecx
call fcn.0050f630
and eax, 0xff
test eax, eax
je 0x4eddb9
push 0x5a52c8
lea edx, [ebp - 0x528]
push edx
call fcn.0050f630
and eax, 0xff
test eax, eax
je 0x4eddb9
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x424]
call fcn.0050f0c0
lea ecx, [ebp - 0x528]
push ecx
lea ecx, [ebp - 0xa78]
call fcn.0050f0c0
jmp 0x4edc54
mov edx, dword [ebp - 0x664]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x660], 0
jmp 0x4edde6
mov eax, dword [ebp - 0x660]
add eax, 1
mov dword [ebp - 0x660], eax
lea ecx, [ebp - 0x424]
call fcn.0050f110
cmp dword [ebp - 0x660], eax
jge 0x4f0801
mov ecx, dword [ebp - 0x660]
push ecx
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
call fcn.00401fca
add esp, 4
push str.360_TOTAL_SECURITY
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.50_FREE_MP3S
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ACELERAR_EL_PC
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ACTIVERIS_ANTIMALWARE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ACTSYS
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ADBLOCKER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ADDITIONAL_OFFER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ADVANCED_DISK_RECOVERY
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push 0x5a535c
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ADVANCED_SYSTEM_PROTECTOR
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ADVANCEELITE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ALL_MEDIA_CONVERTER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ALLGENIUS
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ALLIN1CONVERT
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.AMAZON_1BUTTON_APP
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.AMIGO
push 0x5b6504
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f07de
push str.ANONYMIZERGADGET
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ANY_ANGLE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ANYPROTECT
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ANYSEND
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.APPENABLE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.APPSHAT_MOBILE_APPS
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ARTICLE_POINT
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ASK_TOOLBAR
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.ASSETS_MANAGER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.AVG_PC_TUNEUP
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.AVG_SAFEGUARD_TOOLBAR
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BESTWEB
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BETTERBROWSE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BETTERDEALS
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BETTERMARKIT
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BINGOMASTER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BINGPROVIDEDSEARCH
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BLOCKANDSURF
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BOBROWSER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BOOSTER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BOX_ROCK
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BOXORE_CLIENT
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BROWSER_EXTENSIONS
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BROWSER_GUARD
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BROWSER_KEEPER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BROWSER_WARDEN
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BROWSERCOMPANION
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BROWSERPROTECT
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BROWSESTUDIO
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BUBBLE_ADS
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BUBBLE_DOCK
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BUENOSEARCH_TOOLBAR
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BULLGUARD_ANTIVIRUS
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BUZZDOCK
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.BYTEFENCE_ANTI_MALWARE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CASHREMINDER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CHECKED_LIST
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CHECKMEUP
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CHROMIUM
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CLEANBROWSER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CLEARTHINK
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CLICUP
push 0x5b6504
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f07de
push str.CLOCK_HAND
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CLOUDSCOUT_PARENTAL_CONTROL
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.COMMONSHARE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.COMODO_DRAGON
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.COMPATIBLE_URL
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CONTEXT2PRO
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CONTEXTFREE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CONTEXTTRUE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.COUPON_CHAMPION
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.COUPON_MARVEL
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.COUPON_SERVER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.COUPONARIFIC
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CRIMEWATCH
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CROSSBROWSE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CURRENCY_CALC
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CUT_AND_PASTE_GREYSCALE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.CYTI_WEB
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DAILYPCCLEAN
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DC_LOCKNET
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DCCC_DEC_1.00
push 0x5b6504
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f07de
push str.DELTASEARCH
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DESK_365
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DESKTOP_IMPROVE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DESKTOPDOCK
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DESKTOPWEATHERALERTS
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DIZZYDING
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DMUNINSTALLER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DNS_UNLOCKER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DOCTOPDFCONVERTER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DOLPHIN_DEALS
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DOMAIQ
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DOWNSPEEDTEST
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DREGOL
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DRIVER_PRO
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DRIVERFIGHTER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DRIVERFINDER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.DRIVERSCANNER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.EASY_SPEED_CHECK
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.EASY_SPEED_PC
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.EAZELBAR
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.EFAST
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.EPSANDRIVE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.EVAPICTURE
push 0x5b6504
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
je 0x4f07de
push str.EXTERNAL_HARD_DRIVE_OUTLINE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.EZDOWNLOADER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FABULOUS_DISCOUNTS
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FACEMOODS_TOOLBAR
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FARLABUNINSTALLER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FAST_SEARCH
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FFDSHOW
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FILESFROG_UPDATE_CHECKER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FINANCEALERT
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FINDWIDE.COM
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FLASH_ENHANCER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FLIPORA___MOOD_AWARE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FLOWSURF
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FLWSRF
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FRAMED_DISPLAY
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FREE_GAMES_111
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FREE_RIDE_GAMES_PLAYER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FREE_VPN_VERSION
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FREESOFTTODAY
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FRESH_OUTLOOK
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FROMDOCTOPDF
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FST_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
push str.FUN_BRICK_BREAKER
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f07de
mov edx, dword [ebp - 0x660]
push edx
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
push eax
lea ecx, [ebp - 0x53c]
call fcn.0050f0c0
jmp 0x4eddd7
mov dword [ebp - 0x660], 0
jmp 0x4f081c
mov eax, dword [ebp - 0x660]
add eax, 1
mov dword [ebp - 0x660], eax
lea ecx, [ebp - 0x424]
call fcn.0050f110
cmp dword [ebp - 0x660], eax
jge 0x4f099c
mov ecx, dword [ebp - 0x660]
push ecx
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
lea edx, [ebp - 0xa64]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0xa64]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
mov dword [ebp - 0x65c], eax
mov dword [0x5b84b8], 0
mov dword [ebp - 0x640], 0
jmp 0x4f0896
mov ecx, dword [0x5b84b8]
add ecx, 1
mov dword [0x5b84b8], ecx
mov edx, dword [0x5b84b8]
cmp edx, dword [ebp - 0x65c]
jge 0x4f08e2
mov eax, dword [0x5b84b8]
movsx ecx, byte [ebp + eax - 0xa64]
cmp ecx, 0x20
jne 0x4f08b8
jmp 0x4f0887
mov edx, dword [ebp - 0x640]
mov eax, dword [0x5b84b8]
mov cl, byte [ebp + eax - 0xa64]
mov byte [ebp + edx - 0xa64], cl
mov edx, dword [ebp - 0x640]
add edx, 1
mov dword [ebp - 0x640], edx
jmp 0x4f0887
mov eax, dword [ebp - 0x640]
mov byte [ebp + eax - 0xa64], 0
lea ecx, [ebp - 0xa64]
push ecx
push str.SystemCurrentControlSetServicesService_Mgr__s
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push str.ImagePath
push 0x5b6504
push 0x80000002
lea edx, [ebp - 0xf8c]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0xfb8], eax
mov eax, dword [ebp - 0xfb8]
mov dword [ebp - 0xfbc], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0xfbc]
push ecx
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xf8c]
call sub.MFC42.DLL_CString::CString
push 0x5a6b08
lea edx, [ebp - 0x410]
push edx
call fcn.0050f630
and eax, 0xff
test eax, eax
je 0x4f0997
mov eax, dword [ebp - 0x660]
push eax
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
push eax
lea ecx, [ebp - 0x53c]
call fcn.0050f0c0
jmp 0x4f080d
mov dword [ebp - 0x660], 0
jmp 0x4f09b7
mov ecx, dword [ebp - 0x660]
add ecx, 1
mov dword [ebp - 0x660], ecx
lea ecx, [ebp - 0xa78]
call fcn.0050f110
cmp dword [ebp - 0x660], eax
jge 0x4f107a
mov edx, dword [ebp - 0x660]
push edx
lea ecx, [ebp - 0xa78]
call fcn.0050f5d0
mov ecx, eax
call fcn.0050f0b0
push eax
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
push 0x5b6504
call fcn.00401fca
add esp, 4
mov eax, dword [ebp - 0x660]
push eax
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str._sUninstall.exe__fcp1
lea edx, [ebp - 0xa64]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0xa64]
push eax
call fcn.00401fca
add esp, 4
lea ecx, [ebp - 0xa64]
push ecx
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f0a72
mov edx, dword [ebp - 0x660]
push edx
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
push eax
lea ecx, [ebp - 0x53c]
call fcn.0050f0c0
mov eax, dword [ebp - 0x660]
push eax
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
mov ecx, dword [eax]
push ecx
push str._sxBin_
lea edx, [ebp - 0xa64]
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0xa64]
push eax
call fcn.00401fca
add esp, 4
mov ecx, dword [ebp - 0x660]
push ecx
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
mov edx, dword [eax]
push edx
push str._szBin_
lea eax, [ebp - 0xe78]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0xe78]
push ecx
call fcn.00401fca
add esp, 4
mov edx, dword [ebp - 0x660]
push edx
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push str._s
lea ecx, [ebp - 0x40c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x40c]
push edx
call fcn.00401fca
add esp, 4
push str.RUNDLL32.EXE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f0bcf
lea eax, [ebp - 0xa64]
push eax
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0b83
lea ecx, [ebp - 0xe78]
push ecx
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0b83
lea edx, [ebp - 0x40c]
push edx
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f0bcf
push str..DLL__2
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0bb1
push str..DLL__1
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f0bcf
mov eax, dword [ebp - 0x660]
push eax
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
push eax
lea ecx, [ebp - 0x53c]
call fcn.0050f0c0
push str..exe___s__n__i:_ExecuteCommands_UninstallCommands____
lea ecx, [ebp - 0xa64]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0xa64]
push edx
call fcn.00401fca
add esp, 4
lea eax, [ebp - 0xa64]
push eax
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f0c29
mov ecx, dword [ebp - 0x660]
push ecx
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
push eax
lea ecx, [ebp - 0x53c]
call fcn.0050f0c0
push str..exe___x:1__s__n__i:_ExecuteCommands_UninstallCommands_
lea edx, [ebp - 0xa64]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0xa64]
push eax
call fcn.00401fca
add esp, 4
lea ecx, [ebp - 0xa64]
push ecx
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f0c83
mov edx, dword [ebp - 0x660]
push edx
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
push eax
lea ecx, [ebp - 0x53c]
call fcn.0050f0c0
push str.UninstallManager.exe___ptid
lea eax, [ebp - 0xa64]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
lea ecx, [ebp - 0xa64]
push ecx
call fcn.00401fca
add esp, 4
lea edx, [ebp - 0xa64]
push edx
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f0cdd
mov eax, dword [ebp - 0x660]
push eax
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
push eax
lea ecx, [ebp - 0x53c]
call fcn.0050f0c0
push str..dll___uninstall__un
lea ecx, [ebp - 0xa64]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0xa64]
push edx
call fcn.00401fca
add esp, 4
lea eax, [ebp - 0xa64]
push eax
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f0d37
mov ecx, dword [ebp - 0x660]
push ecx
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
push eax
lea ecx, [ebp - 0x53c]
call fcn.0050f0c0
push str._trusted_publisher_
lea edx, [ebp - 0xa64]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0xa64]
push eax
call fcn.00401fca
add esp, 4
push str..exe___uninstall
lea ecx, [ebp - 0xe78]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0xe78]
push edx
call fcn.00401fca
add esp, 4
lea eax, [ebp - 0xa64]
push eax
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f0dcd
lea ecx, [ebp - 0xe78]
push ecx
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f0dcd
mov edx, dword [ebp - 0x660]
push edx
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
push eax
lea ecx, [ebp - 0x53c]
call fcn.0050f0c0
push str.7K7KWEB_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0f65
push str.ADSAFEUNINST.EXE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0f65
push str.BAIDUBROWSERPROTECT_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0f65
push str.HAO123JUZIBROWSER_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0f65
push str.HOMECAREUNINSTALL.EXE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0f65
push str.IQIYI_VIDEO_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0f65
push str.KELE55UNINST.EXE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0f65
push str.KINGSOFTKINGSOFT_ANTIVIRUS_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0f65
push str.MAIL.RU_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0f65
push str.MTV2016
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0f65
push str.PPTASSISTUTILITYUNINST.EXE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0f65
push str.RSAFEBROWSERUNINSTALL.EXE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0f65
push str.TAOTAOSOUTTKUNINSTALL.EXE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0f65
push str.TENCENTQQBROWSER_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0f65
push str.TENCENTQQPCMGR_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x4f0f65
push str.YEAPLAYERUNINS000.EXE
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f0f83
mov eax, dword [ebp - 0x660]
push eax
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
push eax
lea ecx, [ebp - 0x53c]
call fcn.0050f0c0
push str.DESKTOP_IMPROVER_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f0ffc
push 0x5b8f00
mov ecx, dword [ebp - 0x660]
push ecx
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4f0fde
push str.Desktop_Improver
mov edx, dword [ebp - 0x660]
push edx
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
mov ecx, eax
call fcn.005104b4
mov eax, dword [ebp - 0x660]
push eax
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
push eax
lea ecx, [ebp - 0x53c]
call fcn.0050f0c0
push str.EFASTAPPLICATION_
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x4f1075
push 0x5b8f04
mov ecx, dword [ebp - 0x660]
push ecx
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
push eax
call fcn.0050f610
and eax, 0xff
test eax, eax
je 0x4f1057
push str.eFast
mov edx, dword [ebp - 0x660]
push edx
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
mov ecx, eax
call fcn.005104b4
mov eax, dword [ebp - 0x660]
push eax
lea ecx, [ebp - 0x424]
call fcn.0050f5d0
push eax
lea ecx, [ebp - 0x53c]
call fcn.0050f0c0
jmp 0x4f09a8
lea ecx, [ebp - 0x53c]
call fcn.0050f110
test eax, eax
je 0x4f112c
push str.Detectados_Programas_Potencialmente_No_Deseados__PUPs_._nEjecute_el_EliPUPs_para_proceder_con_su_Desinstalaci
push 0x5b6504
call sub.MSVCRT.dll_strcpy
add esp, 8
cmp dword [0x5b851c], 0
jne 0x4f10b6
push 0
push 0
push 0x5b6504
call sub.MFC42.DLL_AfxMessageBox
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
mov dword [ebp - 0x660], 0
jmp 0x4f10e0
mov ecx, dword [ebp - 0x660]
add ecx, 1
mov dword [ebp - 0x660], ecx
lea ecx, [ebp - 0x53c]
call fcn.0050f110
cmp dword [ebp - 0x660], eax
jge 0x4f112c
mov edx, dword [ebp - 0x660]
push edx
lea ecx, [ebp - 0x53c]
call fcn.0050f5d0
mov eax, dword [eax]
push eax
push str.__s__n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x4f10d1
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x528]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x53c]
call fcn.0051046c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa78]
call fcn.0051046c
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x424]
call fcn.0051046c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x654]
call fcn.0051046c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret