Function at 0x46d690
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c1d02
mov eax, dword fs:[0]
push eax
sub esp, 0x4c0
mov eax, dword [0x50b080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x498], ecx
mov al, byte [ebp + 8]
lea ecx, [ebp - 0x490]
mov byte [ebp - 0x491], al
movzx eax, al
inc eax
mov dword [ebp - 0x490], 0
push ecx
shl eax, 8
or eax, 0x20019
push eax
push 0
push str.SOFTWAREMICROSOFTWINDOWSCURRENTVERSIONUNINSTALL
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x46dded
push 0x200
xor ebx, ebx
lea eax, [ebp - 0x214]
push ebx
push eax
call fcn.00492970
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
add esp, 0xc
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x200
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x46dddc
mov dword [ebp - 0x48c], eax
lea eax, [ebp - 0x48c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x46dd05
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x488], 0x200
push eax
lea eax, [ebp - 0x418]
push eax
push 2
push str.DisplayName
push esi
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x46dcf3
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46d7d0
sub eax, edx
sar eax, 1
cmp eax, 0xc
jb 0x46d80e
mov esi, 0xc
xor edx, edx
nop dword [eax + eax]
movzx ecx, word [ebp + edx - 0x414]
movzx eax, word [edx + 0x4ed5c0]
cmp cx, ax
jne 0x46d817
add edx, 2
sub esi, 1
jne 0x46d7f0
jmp 0x46d840
cmp eax, 0xa
jb 0x46db52
mov esi, 0xa
xor edx, edx
nop
movzx ecx, word [ebp + edx - 0x414]
movzx eax, word [edx + str.ThreatDown]
cmp cx, ax
jne 0x46db52
add edx, 2
sub esi, 1
jne 0x46d820
lea ecx, [ebp - 0x484]
call fcn.0046d570
lea ecx, [ebp - 0x414]
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d860
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x468]
call fcn.0040db20
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d890
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x480]
call fcn.0040db20
mov al, byte [ebp - 0x491]
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 0x420], al
call fcn.00467d30
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x46d8d8
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.D:JenkinsworkspaceN_SUCommon_VS2022_srcSUCommonInstalledProducts.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
cmp byte [ebp - 0x491], 0
mov ecx, str.__64_
mov esi, str.__32_
cmove esi, ecx
mov ecx, eax
push 0x3a
call fcn.0040f7e0
mov edx, str.:_Found
mov ecx, eax
call fcn.00411050
lea edx, [ebp - 0x414]
mov ecx, eax
call fcn.0041ba80
mov edx, str._installed_as
mov ecx, eax
call fcn.00411050
lea edx, [ebp - 0x214]
mov ecx, eax
call fcn.0041ba80
mov edx, esi
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 0
add esp, 4
mov ecx, dword [ebp - 0x49c]
cmp ecx, 7
jbe 0x46d9a5
mov edx, dword [ebp - 0x4b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x46d99b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46debe
push ecx
push edx
call fcn.004906cd
add esp, 8
lea eax, [ebp - 0x488]
mov dword [ebp - 0x488], 0x200
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
push eax
push 2
push str.DisplayVersion
push 0
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x46da04
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d9e2
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.0040db20
lea eax, [ebp - 0x488]
push eax
push 0
lea eax, [ebp - 0x418]
push eax
push 2
push str.InstallLocation
push 0
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x46da98
mov eax, dword [ebp - 0x488]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00490916
add esp, 4
mov esi, eax
lea eax, [ebp - 0x488]
push eax
push esi
lea eax, [ebp - 0x418]
push eax
push 2
push str.InstallLocation
push 0
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x46da8f
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46da73
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x438]
call fcn.0040db20
push esi
call fcn.004906db
add esp, 4
lea ecx, [ebp - 0x4b0]
call fcn.00467d30
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x46dab2
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.D:JenkinsworkspaceN_SUCommon_VS2022_srcSUCommonInstalledProducts.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x49
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_DisplayVersion
mov ecx, eax
call fcn.00411050
cmp dword [ebp - 0x43c], 7
lea edx, [ebp - 0x450]
push dword [ebp - 0x440]
cmova edx, dword [ebp - 0x450]
mov ecx, eax
call fcn.00412550
add esp, 4
mov edx, str.__InstallLocation
mov ecx, eax
call fcn.00411050
cmp dword [ebp - 0x424], 7
lea edx, [ebp - 0x438]
push dword [ebp - 0x428]
cmova edx, dword [ebp - 0x438]
mov ecx, eax
call fcn.00412550
add esp, 4
push eax
call fcn.004113d0
mov byte [ebp - 4], 0
jmp 0x46dc89
lea eax, [ebp - 0x214]
push str.949D1792_E377_4348_8BC4_6D643EF49B21
push eax
call fcn.0049a53c
add esp, 8
test eax, eax
jne 0x46dcf3
lea ecx, [ebp - 0x484]
call fcn.0046d570
push 0x19
push str.ThreatDown_Endpoint_Agent
lea ecx, [ebp - 0x468]
mov dword [ebp - 4], 3
call fcn.0040db20
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46dba0
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x480]
call fcn.0040db20
mov al, byte [ebp - 0x491]
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 0x420], al
call fcn.00467d30
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x46dbe8
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.D:JenkinsworkspaceN_SUCommon_VS2022_srcSUCommonInstalledProducts.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x52
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Found
mov ecx, eax
call fcn.00411050
cmp dword [ebp - 0x454], 7
lea edx, [ebp - 0x468]
push dword [ebp - 0x458]
cmova edx, dword [ebp - 0x468]
mov ecx, eax
call fcn.00412550
add esp, 4
mov ecx, str.__64_
cmp byte [ebp - 0x491], 0
mov esi, str.__32_
mov edx, str._installed_as
cmove esi, ecx
mov ecx, eax
call fcn.00411050
lea edx, [ebp - 0x214]
mov ecx, eax
call fcn.0041ba80
mov edx, esi
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x49c]
add esp, 4
cmp ecx, 7
jbe 0x46dccc
mov edx, dword [ebp - 0x4b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x46dcc2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46debe
push ecx
push edx
call fcn.004906cd
add esp, 8
mov ecx, dword [ebp - 0x498]
lea eax, [ebp - 0x484]
push eax
lea ecx, [ecx + 4]
call fcn.0046ff10
lea ecx, [ebp - 0x484]
mov dword [ebp - 4], 0xffffffff
call fcn.00462470
push dword [ebp - 0x48c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
jmp 0x46d724
lea ecx, [ebp - 0x4b0]
call fcn.00467d30
mov dword [ebp - 4], 5
cmp dword [eax + 0x14], 7
mov edi, dword [eax + 0x10]
jbe 0x46dd22
mov eax, dword [eax]
push edi
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.D:JenkinsworkspaceN_SUCommon_VS2022_srcSUCommonInstalledProducts.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x5a
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Error_opening_uninstall_key__
mov ecx, eax
call fcn.00411050
lea edx, [ebp - 0x214]
mov ecx, eax
call fcn.0041ba80
mov edx, 0x4f8090
mov ecx, eax
call fcn.00411050
push esi
mov ecx, eax
call fcn.0041b830
mov edx, 0x4f808c
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov ecx, dword [ebp - 0x49c]
cmp ecx, 7
jbe 0x46dddc
mov edx, dword [ebp - 0x4b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x46ddd2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46debe
push ecx
push edx
call fcn.004906cd
add esp, 8
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46dea0
lea ecx, [ebp - 0x4c8]
call fcn.00467d30
mov dword [ebp - 4], 6
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x46de0a
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50e6d0
call fcn.00412550
add esp, 4
mov edx, str.D:JenkinsworkspaceN_SUCommon_VS2022_srcSUCommonInstalledProducts.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4eb568
mov ecx, eax
call fcn.00411050
push 0x62
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Error_opening_root_uninstall_key__
mov ecx, eax
call fcn.00411050
push esi
mov ecx, eax
call fcn.0041b830
mov edx, 0x4f808c
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x4b4]
add esp, 4
cmp ecx, 7
jbe 0x46dea0
mov edx, dword [ebp - 0x4c8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x46de96
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46dec3
push ecx
push edx
call fcn.004906cd
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00490396
mov esp, ebp
pop ebp
ret 4
call fcn.004958ff
call fcn.004958ff
int3