Function at 0x4093f0
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57c20e
mov eax, dword fs:[0]
push eax
sub esp, 0x420
mov eax, dword [0x61b660]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x400], ecx
lea eax, [ebp - 0x30d]
mov dword [ebp - 0x30c], eax
mov ecx, dword [ebp - 0x400]
mov dword [ecx], 0
mov edx, dword [ebp - 0x400]
mov dword [edx + 4], 0
mov eax, dword [ebp - 0x400]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0x400]
mov dword [ebp - 0x404], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x1cc]
call fcn.0040a020
mov byte [ebp - 4], 1
call fcn.0042a53b
push eax
lea ecx, [ebp - 0x2dc]
call fcn.0040ab50
mov byte [ebp - 4], 2
call fcn.0042a53b
push eax
lea ecx, [ebp - 0x118]
call fcn.0040ab50
mov byte [ebp - 4], 3
mov dword [ebp - 0x11c], 0
mov byte [ebp - 0x114], 0
push 0xfe
push 0
lea edx, [ebp - 0x113]
push edx
call fcn.00529d40
add esp, 0xc
mov byte [ebp - 0x2d4], 0
push 0xfe
push 0
lea eax, [ebp - 0x2d3]
push eax
call fcn.00529d40
add esp, 0xc
mov dword [ebp - 0x2ec], 0xff
mov dword [ebp - 0x2d8], 0xff
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x2e8], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x120], str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x1d0]
push ecx
push 0xf003f
push 0
mov edx, dword [ebp - 0x120]
push edx
mov eax, dword [ebp - 0x2e8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0
jne 0x409a50
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x2ec]
push ecx
lea edx, [ebp - 0x114]
push edx
mov eax, dword [ebp - 0x11c]
push eax
mov ecx, dword [ebp - 0x1d0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x409a43
mov edx, dword [ebp - 0x11c]
add edx, 1
mov dword [ebp - 0x11c], edx
lea eax, [ebp - 0x114]
push eax
push 0x5a7340
lea ecx, [ebp - 0x2dc]
push ecx
call fcn.0040b640
add esp, 0xc
mov edx, dword [ebp - 0x2dc]
mov eax, dword [edx - 0xc]
mov dword [ebp - 0x314], eax
xor ecx, ecx
cmp dword [ebp - 0x314], 0
sete cl
movzx edx, cl
test edx, edx
jne 0x409a3e
mov eax, dword [ebp - 0x120]
push eax
lea ecx, [ebp - 0x2f0]
call fcn.0040a400
mov dword [ebp - 0x408], eax
mov ecx, dword [ebp - 0x408]
mov dword [ebp - 0x40c], ecx
mov byte [ebp - 4], 4
push 0x5a6ff8
mov edx, dword [ebp - 0x40c]
push edx
lea eax, [ebp - 0x2f4]
push eax
call fcn.0040a5a0
add esp, 0xc
mov dword [ebp - 0x410], eax
mov ecx, dword [ebp - 0x410]
mov dword [ebp - 0x414], ecx
mov byte [ebp - 4], 5
lea edx, [ebp - 0x2dc]
push edx
mov eax, dword [ebp - 0x414]
push eax
lea ecx, [ebp - 0x2f8]
push ecx
call fcn.0040a4c0
add esp, 0xc
mov dword [ebp - 0x418], eax
mov edx, dword [ebp - 0x418]
mov dword [ebp - 0x320], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x320]
push eax
lea ecx, [ebp - 0x118]
call fcn.0040abf0
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2f8]
call fcn.0040abb0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2f4]
call fcn.0040abb0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2f0]
call fcn.0040abb0
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 0x330], ecx
lea edx, [ebp - 0x2e4]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x330]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409a1e
lea ecx, [ebp - 0x2d8]
push ecx
lea edx, [ebp - 0x2d4]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.DisplayName
mov ecx, dword [ebp - 0x2e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x2d4]
push edx
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x334]
push eax
lea ecx, [ebp - 0x2d4]
push ecx
lea ecx, [ebp - 0x1cc]
call fcn.004064c0
mov dword [ebp - 0x2d8], 0xff
push 0xff
push 0
lea edx, [ebp - 0x2d4]
push edx
call fcn.00529d40
add esp, 0xc
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0x2d4]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push str.DisplayVersion
mov eax, dword [ebp - 0x2e4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x338], eax
mov edx, dword [ebp - 0x338]
push edx
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x1b0]
call fcn.004064c0
mov dword [ebp - 0x2d8], 0xff
push 0xff
push 0
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.00529d40
add esp, 0xc
lea edx, [ebp - 0x2d8]
push edx
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push str.InstallLocation
mov edx, dword [ebp - 0x2e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x2d4]
push eax
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x33c], eax
mov ecx, dword [ebp - 0x33c]
push ecx
lea edx, [ebp - 0x2d4]
push edx
lea ecx, [ebp - 0x194]
call fcn.004064c0
mov dword [ebp - 0x2d8], 0xff
push 0xff
push 0
lea eax, [ebp - 0x2d4]
push eax
call fcn.00529d40
add esp, 0xc
lea ecx, [ebp - 0x2d8]
push ecx
lea edx, [ebp - 0x2d4]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.Publisher
mov ecx, dword [ebp - 0x2e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x2d4]
push edx
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x340]
push eax
lea ecx, [ebp - 0x2d4]
push ecx
lea ecx, [ebp - 0x178]
call fcn.004064c0
mov dword [ebp - 0x2d8], 0xff
lea edx, [ebp - 0x2d8]
push edx
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push str.DisplayIcon
mov edx, dword [ebp - 0x2e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x2d4]
push eax
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x344], eax
mov ecx, dword [ebp - 0x344]
push ecx
lea edx, [ebp - 0x2d4]
push edx
lea ecx, [ebp - 0x15c]
call fcn.004064c0
mov dword [ebp - 0x2d8], 0xff
push 0xff
push 0
lea eax, [ebp - 0x2d4]
push eax
call fcn.00529d40
add esp, 0xc
lea ecx, [ebp - 0x2d8]
push ecx
lea edx, [ebp - 0x2d4]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.UninstallString
mov ecx, dword [ebp - 0x2e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x2d4]
push edx
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
push eax
lea ecx, [ebp - 0x2d4]
push ecx
lea ecx, [ebp - 0x140]
call fcn.004064c0
mov dword [ebp - 0x2d8], 0xff
push 0xff
push 0
lea edx, [ebp - 0x2d4]
push edx
call fcn.00529d40
add esp, 0xc
xor eax, eax
cmp dword [ebp - 0x1bc], 0
sete al
movzx ecx, al
test ecx, ecx
jne 0x409a1e
xor edx, edx
jl 0x4099a0
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x34c], ecx
cmp dword [ebp - 0x34c], 0
jge 0x4099aa
push 0x80070057
call fcn.0040a000
mov edx, dword [ebp - 0x2dc]
mov al, byte [edx]
mov byte [ebp - 0x34d], al
movsx ecx, byte [ebp - 0x34d]
cmp ecx, 0x4b
jne 0x409a0c
mov edx, 1
test edx, edx
jl 0x4099e5
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x354], ecx
cmp dword [ebp - 0x354], 1
jge 0x4099ef
push 0x80070057
call fcn.0040a000
mov edx, dword [ebp - 0x2dc]
mov al, byte [edx + 1]
mov byte [ebp - 0x355], al
movsx ecx, byte [ebp - 0x355]
cmp ecx, 0x42
jne 0x409a0c
jmp 0x409a1e
lea edx, [ebp - 0x1cc]
push edx
mov ecx, dword [ebp - 0x400]
call fcn.0040a6e0
mov dword [ebp - 0x2ec], 0xff
push 0xff
push 0
lea eax, [ebp - 0x114]
push eax
call fcn.00529d40
add esp, 0xc
jmp 0x409547
mov ecx, dword [ebp - 0x1d0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2e8], VariantInit
mov dword [ebp - 0x120], str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea edx, [ebp - 0x1d0]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x120]
push eax
mov ecx, dword [ebp - 0x2e8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 0
jne 0x409fa2
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x2ec]
push edx
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x1d0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x409f95
mov eax, dword [ebp - 0x11c]
add eax, 1
mov dword [ebp - 0x11c], eax
lea ecx, [ebp - 0x114]
push ecx
push 0x5a7340
lea edx, [ebp - 0x2dc]
push edx
call fcn.0040b640
add esp, 0xc
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [eax - 0xc]
mov dword [ebp - 0x360], ecx
xor edx, edx
cmp dword [ebp - 0x360], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x409f90
mov ecx, dword [ebp - 0x120]
push ecx
lea ecx, [ebp - 0x2fc]
call fcn.0040a400
mov dword [ebp - 0x41c], eax
mov edx, dword [ebp - 0x41c]
mov dword [ebp - 0x420], edx
mov byte [ebp - 4], 7
push 0x5a6ff8
mov eax, dword [ebp - 0x420]
push eax
lea ecx, [ebp - 0x300]
push ecx
call fcn.0040a5a0
add esp, 0xc
mov dword [ebp - 0x424], eax
mov edx, dword [ebp - 0x424]
mov dword [ebp - 0x428], edx
mov byte [ebp - 4], 8
lea eax, [ebp - 0x2dc]
push eax
mov ecx, dword [ebp - 0x428]
push ecx
lea edx, [ebp - 0x304]
push edx
call fcn.0040a4c0
add esp, 0xc
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x374], eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x374]
push ecx
lea ecx, [ebp - 0x118]
call fcn.0040abf0
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x304]
call fcn.0040abb0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x300]
call fcn.0040abb0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2fc]
call fcn.0040abb0
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x384], edx
lea eax, [ebp - 0x2e4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp - 0x384]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409f70
lea edx, [ebp - 0x2d8]
push edx
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push str.DisplayName
mov edx, dword [ebp - 0x2e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x2d4]
push eax
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x388], eax
mov ecx, dword [ebp - 0x388]
push ecx
lea edx, [ebp - 0x2d4]
push edx
lea ecx, [ebp - 0x1cc]
call fcn.004064c0
mov dword [ebp - 0x2d8], 0xff
push 0xff
push 0
lea eax, [ebp - 0x2d4]
push eax
call fcn.00529d40
add esp, 0xc
lea ecx, [ebp - 0x2d8]
push ecx
lea edx, [ebp - 0x2d4]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.DisplayVersion
mov ecx, dword [ebp - 0x2e4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x2d4]
push edx
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x390], eax
mov eax, dword [ebp - 0x390]
push eax
lea ecx, [ebp - 0x2d4]
push ecx
lea ecx, [ebp - 0x1b0]
call fcn.004064c0
mov dword [ebp - 0x2d8], 0xff
push 0xff
push 0
lea edx, [ebp - 0x2d4]
push edx
call fcn.00529d40
add esp, 0xc
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0x2d4]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push str.InstallLocation
mov eax, dword [ebp - 0x2e4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x398], eax
mov edx, dword [ebp - 0x398]
push edx
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x194]
call fcn.004064c0
mov dword [ebp - 0x2d8], 0xff
push 0xff
push 0
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.00529d40
add esp, 0xc
lea edx, [ebp - 0x2d8]
push edx
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push str.Publisher
mov edx, dword [ebp - 0x2e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x2d4]
push eax
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x3a0], eax
mov ecx, dword [ebp - 0x3a0]
push ecx
lea edx, [ebp - 0x2d4]
push edx
lea ecx, [ebp - 0x178]
call fcn.004064c0
mov dword [ebp - 0x2d8], 0xff
lea eax, [ebp - 0x2d8]
push eax
lea ecx, [ebp - 0x2d4]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push str.DisplayIcon
mov eax, dword [ebp - 0x2e4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x3a8], eax
mov edx, dword [ebp - 0x3a8]
push edx
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x15c]
call fcn.004064c0
mov dword [ebp - 0x2d8], 0xff
push 0xff
push 0
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.00529d40
add esp, 0xc
lea edx, [ebp - 0x2d8]
push edx
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push str.UninstallString
mov edx, dword [ebp - 0x2e4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x2d4]
push eax
call fcn.005291f0
add esp, 4
mov dword [ebp - 0x3b0], eax
mov ecx, dword [ebp - 0x3b0]
push ecx
lea edx, [ebp - 0x2d4]
push edx
lea ecx, [ebp - 0x140]
call fcn.004064c0
mov dword [ebp - 0x2d8], 0xff
push 0xff
push 0
lea eax, [ebp - 0x2d4]
push eax
call fcn.00529d40
add esp, 0xc
xor ecx, ecx
cmp dword [ebp - 0x1bc], 0
sete cl
movzx edx, cl
test edx, edx
jne 0x409f70
xor eax, eax
jl 0x409ef2
mov ecx, dword [ebp - 0x2dc]
mov edx, dword [ecx - 0xc]
mov dword [ebp - 0x3c0], edx
cmp dword [ebp - 0x3c0], 0
jge 0x409efc
push 0x80070057
call fcn.0040a000
mov eax, dword [ebp - 0x2dc]
mov cl, byte [eax]
mov byte [ebp - 0x3c1], cl
movsx edx, byte [ebp - 0x3c1]
cmp edx, 0x4b
jne 0x409f5e
mov eax, 1
test eax, eax
jl 0x409f37
mov ecx, dword [ebp - 0x2dc]
mov edx, dword [ecx - 0xc]
mov dword [ebp - 0x3c8], edx
cmp dword [ebp - 0x3c8], 1
jge 0x409f41
push 0x80070057
call fcn.0040a000
mov eax, dword [ebp - 0x2dc]
mov cl, byte [eax + 1]
mov byte [ebp - 0x3c9], cl
movsx edx, byte [ebp - 0x3c9]
cmp edx, 0x42
jne 0x409f5e
jmp 0x409f70
lea eax, [ebp - 0x1cc]
push eax
mov ecx, dword [ebp - 0x400]
call fcn.0040a6e0
mov dword [ebp - 0x2ec], 0xff
push 0xff
push 0
lea ecx, [ebp - 0x114]
push ecx
call fcn.00529d40
add esp, 0xc
jmp 0x409a99
mov edx, dword [ebp - 0x1d0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x118]
call fcn.0040abb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2dc]
call fcn.0040abb0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1cc]
call fcn.0040a190
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x400]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0052927b
mov esp, ebp
pop ebp
ret