Function at 0x1008b5a0
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101e9377
mov eax, dword fs:[0]
push eax
mov eax, 0x1054
call fcn.101ae1b0
mov eax, dword [0x102683e0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1048], ecx
mov dword [ebp - 0x1058], 0
mov dword [ebp - 0x1054], 0
mov dword [ebp - 0x1050], 0
mov dword [ebp - 4], 0
mov esi, 0x20219
mov dword [ebp - 0x1034], 0
test dl, dl
jne 0x1008b615
mov esi, 0x20119
lea eax, [ebp - 0x1034]
mov dword [ebp - 0x1038], esi
push eax
push esi
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1008ba4b
mov ebx, dword [ebp - 0x1034]
and esi, 0x300
mov dword [ebp - 0x104c], esi
xor edi, edi
mov dword [ebp - 0x1054], esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1058], ebx
jmp 0x1008b670
lea eax, [ebp - 0x1060]
mov dword [ebp - 0x1034], 0x400
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x1034]
push eax
lea eax, [ebp - 0x1010]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1008b83e
xor esi, esi
inc edi
mov dword [ebp - 0x1044], esi
mov dword [ebp - 0x1040], esi
mov dword [ebp - 0x103c], esi
lea eax, [ebp - 0x1030]
mov dword [ebp - 0x1030], esi
push eax
push dword [ebp - 0x1038]
lea eax, [ebp - 0x1010]
push esi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1008b7ff
mov esi, dword [ebp - 0x1030]
mov ecx, dword [ebp - 0x104c]
mov dword [ebp - 0x1044], esi
mov dword [ebp - 0x1040], ecx
test eax, eax
jne 0x1008b7ff
mov dword [ebp - 0x1018], 7
mov dword [ebp - 0x101c], eax
mov word [ebp - 0x102c], ax
mov byte [ebp - 4], 2
mov dword [ebp - 0x1034], eax
lea eax, [ebp - 0x1030]
push eax
lea eax, [ebp - 0x1010]
mov dword [ebp - 0x1030], 0x800
push eax
lea eax, [ebp - 0x1014]
push eax
push 0
push str.DisplayName
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1008b7e8
mov eax, dword [ebp - 0x1014]
cmp eax, 1
je 0x1008b76a
cmp eax, 2
jne 0x1008b7e8
mov ecx, dword [ebp - 0x1030]
test ecx, ecx
je 0x1008b791
test cl, 1
jne 0x1008b7e8
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x1012], 0
jne 0x1008b7e8
mov ax, word [ebp - 0x1010]
jmp 0x1008b79a
xor eax, eax
mov word [ebp - 0x1010], ax
shr ecx, 1
mov dword [ebp - 0x1034], ecx
test ax, ax
jne 0x1008b7ab
xor ecx, ecx
jmp 0x1008b7c3
lea ecx, [ebp - 0x1010]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1008b7b4
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x102c]
call fcn.10003c10
mov ecx, dword [ebp - 0x1048]
lea eax, [ebp - 0x102c]
push eax
call fcn.1008bad0
cmp dword [ebp - 0x1018], 8
jb 0x1008b7ff
push dword [ebp - 0x102c]
call fcn.101a02f0
add esp, 4
mov byte [ebp - 4], 0
test esi, esi
je 0x1008b829
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
mov dword [ebp - 0x1044], 0
mov dword [ebp - 0x1040], 0
jmp 0x1008b670
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1040], 0
jmp 0x1008b670
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x1038]
lea ecx, [ebp - 0x1058]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push SysReAllocStringLen
call fcn.10078480
mov edi, dword [ebp - 0x1058]
test eax, eax
jne 0x1008ba44
xor ebx, ebx
nop
lea eax, [ebp - 0x1060]
mov dword [ebp - 0x1034], 0x400
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x1034]
push eax
lea eax, [ebp - 0x810]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1008ba3e
xor esi, esi
inc ebx
mov dword [ebp - 0x1044], esi
mov dword [ebp - 0x1040], esi
mov dword [ebp - 0x103c], esi
lea eax, [ebp - 0x1030]
mov dword [ebp - 0x1030], esi
push eax
push dword [ebp - 0x1038]
lea eax, [ebp - 0x810]
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1008b9ff
mov esi, dword [ebp - 0x1030]
mov ecx, dword [ebp - 0x104c]
mov dword [ebp - 0x1044], esi
mov dword [ebp - 0x1040], ecx
test eax, eax
jne 0x1008b9ff
mov dword [ebp - 0x1018], 7
mov dword [ebp - 0x101c], eax
mov word [ebp - 0x102c], ax
mov byte [ebp - 4], 4
mov dword [ebp - 0x1034], eax
lea eax, [ebp - 0x1030]
push eax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x1030], 0x800
push eax
lea eax, [ebp - 0x1014]
push eax
push 0
push str.DisplayName
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1008b9e8
mov eax, dword [ebp - 0x1014]
cmp eax, 1
je 0x1008b96a
cmp eax, 2
jne 0x1008b9e8
mov ecx, dword [ebp - 0x1030]
test ecx, ecx
je 0x1008b991
test cl, 1
jne 0x1008b9e8
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x812], 0
jne 0x1008b9e8
mov ax, word [ebp - 0x810]
jmp 0x1008b99a
xor eax, eax
mov word [ebp - 0x810], ax
shr ecx, 1
mov dword [ebp - 0x1034], ecx
test ax, ax
jne 0x1008b9ab
xor ecx, ecx
jmp 0x1008b9c3
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1008b9b4
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x102c]
call fcn.10003c10
mov ecx, dword [ebp - 0x1048]
lea eax, [ebp - 0x102c]
push eax
call fcn.1008bad0
cmp dword [ebp - 0x1018], 8
jb 0x1008b9ff
push dword [ebp - 0x102c]
call fcn.101a02f0
add esp, 4
mov byte [ebp - 4], 0
test esi, esi
je 0x1008ba29
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
mov dword [ebp - 0x1044], 0
mov dword [ebp - 0x1040], 0
jmp 0x1008b870
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1040], 0
jmp 0x1008b870
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
je 0x1008ba4b
push edi
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101a0193
mov esp, ebp
pop ebp
ret