Function at 0x466039
Capabilities:
Enumerate processes
Get installed programs

Disassembly:
push 0x330
mov eax, 0x5df8ed
call fcn.005d2642
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x338]
xor ebx, ebx
mov dword [ebp - 0x33c], eax
mov edi, ebx
mov dword [ebp - 0x338], ebx
mov dword [ebp - 0x32c], edi
mov dword [ebp - 0x334], ebx
call fcn.00466e50
mov dword [ebp - 0x338], eax
mov dword [ebp - 4], ebx
call fcn.004547b0
test al, al
je 0x466096
pop eax
push esi
pop eax
pop esp
pop edx
pop ebp
pop ebx
push edi
push edx
push edi
pop edx
push edx
push ebp
push eax
push ebp
push edx
xor ebx, ebx
push 0x22c
lea eax, [ebp - 0x314]
push ebx
push eax
call fcn.0047be90
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4660c1
mov edi, ebx
jmp 0x4667a2
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x466178
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
cmp word [ebp - 0x2f0], ax
jne 0x4660fa
mov eax, ebx
jmp 0x466107
lea eax, [ebp - 0x2f0]
push eax
call fcn.0048cd3b
pop ecx
push eax
lea eax, [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x40]
call fcn.00403000
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.0045af6f
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.0041e4c0
lea eax, [ebp - 0x28]
push eax
call fcn.0045ab4e
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x338]
push eax
call fcn.00466de2
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.0040c250
lea eax, [ebp - 0x314]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4660dd
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebp - 0x14], 7
mov esi, 0x5e28c4
mov dword [ebp - 0x18], ebx
push esi
mov word [ebp - 0x28], ax
call fcn.0048cd3b
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403000
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.0045af6f
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.0041e4c0
mov eax, dword [ebp - 0x338]
mov ebx, dword [eax]
mov dword [ebp - 0x320], ebx
mov dword [ebp - 0x318], ebx
cmp ebx, eax
je 0x4663cc
call fcn.00454543
test al, al
je 0x466214
pop ecx
pop eax
pop edx
pop esi
pop ebx
push edi
push esi
push esi
pop edx
pop eax
pop esp
push ebx
pop ecx
pop ebx
pop ebp
pop edx
push ebx
pop eax
pop eax
pop ebp
push eax
pop ebp
push esi
mov ebx, dword [ebp - 0x320]
call fcn.004544b9
test al, al
je 0x46622e
pop esi
push edx
push edx
pop edi
pop esi
pop eax
pop esi
push edi
push esi
pop edx
pop edi
push ebx
pop esp
push edi
pop ecx
push eax
pop edx
call fcn.0045483a
test al, al
je 0x466251
push edx
pop edi
push esp
push eax
push eax
pop esp
pop ebp
pop edi
pop eax
push edx
pop edx
push esi
push ecx
push eax
push edx
push ebp
pop edi
push ebx
pop edi
pop eax
push esi
pop edx
pop edx
pop esp
pop ebp
push edi
add ebx, 0x10
cmp dword [ebx + 0x14], 0x10
jb 0x46625c
mov ebx, dword [ebx]
push ebx
lea ecx, [ebp - 0x58]
call fcn.00405f10
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x40]
call fcn.00454d9b
mov ebx, 0x5e375c
mov byte [ebp - 4], 8
push ebx
call fcn.0048ccb0
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.00405980
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xd0]
push eax
lea ecx, [ebp - 0x40]
call fcn.00405880
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.00454d9b
lea eax, [ebp - 0x70]
push eax
call fcn.0045987b
add esp, 0x1c
mov ebx, dword [ebp + 0xc]
mov byte [ebp - 4], 9
mov esi, dword [ebx]
jmp 0x466310
cmp dword [esi + 0x14], 0x10
jb 0x4662d1
mov eax, dword [esi]
jmp 0x4662d3
mov eax, esi
push eax
lea ecx, [ebp - 0x88]
call fcn.00405f10
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x70]
call fcn.00467075
neg eax
sbb al, al
add al, 1
jne 0x466363
push 0
push 1
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 9
call fcn.0040c250
add esi, 0x18
cmp esi, dword [ebx + 4]
jne 0x4662c7
xor esi, esi
lea ecx, [ebp - 0x70]
push esi
push 1
call fcn.0040c250
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.0040c250
push esi
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 6
call fcn.0040c250
lea ecx, [ebp - 0x318]
call fcn.00475aab
mov ebx, dword [ebp - 0x318]
mov dword [ebp - 0x320], ebx
cmp ebx, dword [ebp - 0x338]
jne 0x4661ee
mov edi, esi
jmp 0x4663ce
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.0045a966
pop ecx
pop ecx
mov ecx, dword [ebp - 0x33c]
push eax
call fcn.00403950
xor esi, esi
lea ecx, [ebp - 0xa0]
xor ebx, ebx
push esi
inc ebx
push ebx
call fcn.0041e4c0
push esi
mov edi, ebx
lea ecx, [ebp - 0x88]
push ebx
mov dword [ebp - 0x32c], edi
call fcn.0040c250
push esi
push ebx
lea ecx, [ebp - 0x70]
call fcn.0040c250
push esi
push ebx
lea ecx, [ebp - 0x40]
call fcn.0040c250
push esi
push ebx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 6
call fcn.0040c250
jmp 0x4663ce
xor esi, esi
call fcn.004547b0
test al, al
je 0x4663e7
pop eax
push esi
pop eax
pop esp
pop edx
pop ebp
pop ebx
push edi
push edx
push edi
pop edx
push edx
push ebp
push eax
push ebp
push edx
test edi, edi
jne 0x466794
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x328], esi
mov dword [ebp - 0x324], esi
call fcn.00466e50
mov dword [ebp - 0x328], eax
push 7
pop ebx
push esi
mov dword [ebp - 0x78], esi
lea ecx, [ebp - 0x88]
xor eax, eax
mov byte [ebp - 4], 0xb
mov esi, 0x5e266c
mov dword [ebp - 0x74], ebx
push esi
mov word [ebp - 0x88], ax
call fcn.00403000
mov dword [ebp - 0x5c], ebx
lea ecx, [ebp - 0x70]
xor ebx, ebx
mov byte [ebp - 4], 0xc
push ebx
xor eax, eax
mov dword [ebp - 0x60], ebx
push esi
mov word [ebp - 0x70], ax
call fcn.00403000
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x318]
push eax
push 0x109
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x318], ebx
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x46649f
lea eax, [ebp - 0x328]
push eax
push dword [ebp - 0x318]
call fcn.00471dce
pop ecx
pop ecx
push dword [ebp - 0x318]
call esi
lea eax, [ebp - 0x318]
push eax
push 9
push ebx
push 0x5e50e0
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x4664d5
lea eax, [ebp - 0x328]
push eax
push dword [ebp - 0x318]
call fcn.00471dce
pop ecx
pop ecx
push dword [ebp - 0x318]
call esi
lea eax, [ebp - 0x318]
push eax
push 9
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
call edi
test eax, eax
jne 0x46650b
lea eax, [ebp - 0x328]
push eax
push dword [ebp - 0x318]
call fcn.00471dce
pop ecx
pop ecx
push dword [ebp - 0x318]
call esi
lea eax, [ebp - 0x318]
push eax
push 0x109
push ebx
push str.SoftwareMicrosoft_
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x466544
lea eax, [ebp - 0x328]
push eax
push dword [ebp - 0x318]
call fcn.00471dce
pop ecx
pop ecx
push dword [ebp - 0x318]
call esi
mov eax, dword [ebp - 0x328]
mov ebx, dword [eax]
mov dword [ebp - 0x330], ebx
cmp ebx, eax
je 0x466768
call fcn.00454543
test al, al
je 0x46657e
pop esp
pop ecx
pop ecx
push edx
pop esp
pop edx
push ecx
pop edi
push esi
pop ecx
pop ecx
pop ecx
push esi
pop ebp
push edx
push ebx
pop edx
push ecx
pop edx
push ebx
pop esi
push edi
push ebp
pop edx
push ebp
push esi
pop ecx
add ebx, 0x10
cmp dword [ebx + 0x14], 0x10
jb 0x466589
mov ebx, dword [ebx]
push ebx
lea ecx, [ebp - 0x40]
call fcn.00405f10
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x58]
call fcn.00454d9b
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0xf
push eax
call fcn.0045ab4e
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.00454d9b
mov ebx, 0x5e375c
mov byte [ebp - 4], 0x10
push ebx
call fcn.0048ccb0
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.00405980
push 0xffffffffffffffff
xor esi, esi
lea eax, [ebp - 0xd0]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.00405880
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00454d9b
lea eax, [ebp - 0xa0]
push eax
call fcn.0045987b
add esp, 0x1c
mov edi, dword [ebp + 0x10]
mov byte [ebp - 4], 0x11
mov ebx, dword [edi]
jmp 0x46669d
call fcn.004543ea
test al, al
je 0x46662e
push edi
pop esi
push ebx
push esi
push ebx
pop eax
push esi
push esp
push ebp
push edi
pop esi
push ebx
pop esp
pop esi
pop ebp
push esp
call fcn.00454726
test al, al
je 0x466650
push ebp
push ebx
push ebp
pop ebx
pop esi
push edi
pop edi
push edx
pop edi
pop eax
push edi
pop ebp
pop esp
pop esp
push edi
pop ecx
mov ebx, dword [ebp - 0x320]
mov edi, dword [ebp + 0x10]
cmp dword [ebx + 0x14], 0x10
jb 0x46665a
mov eax, dword [ebx]
jmp 0x46665c
mov eax, ebx
push eax
lea ecx, [ebp - 0xb8]
call fcn.00405f10
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0xb8]
call fcn.00467075
neg eax
sbb al, al
add al, 1
jne 0x4666fd
xor esi, esi
mov byte [ebp - 4], 0x11
push esi
push 1
lea ecx, [ebp - 0xb8]
call fcn.0040c250
add ebx, 0x18
mov dword [ebp - 0x320], ebx
cmp ebx, dword [edi + 4]
jne 0x466615
xor ebx, ebx
lea ecx, [ebp - 0xa0]
push esi
inc ebx
push ebx
call fcn.0040c250
push esi
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040c250
push esi
push ebx
lea ecx, [ebp - 0x58]
call fcn.0040c250
push esi
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xd
call fcn.0040c250
lea ecx, [ebp - 0x330]
call fcn.00475aab
mov ebx, dword [ebp - 0x330]
cmp ebx, dword [ebp - 0x328]
jne 0x46655a
jmp 0x46676a
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.0045a966
pop ecx
pop ecx
mov ecx, dword [ebp - 0x33c]
push eax
call fcn.00403950
xor esi, esi
lea ecx, [ebp - 0xe8]
push esi
push 1
call fcn.0041e4c0
xor edi, edi
lea ecx, [ebp - 0xb8]
push esi
inc edi
push edi
call fcn.0040c250
push esi
push edi
lea ecx, [ebp - 0xa0]
call fcn.0040c250
push esi
push edi
lea ecx, [ebp - 0x28]
call fcn.0040c250
push esi
push edi
lea ecx, [ebp - 0x58]
call fcn.0040c250
push esi
push edi
lea ecx, [ebp - 0x40]
call fcn.0040c250
jmp 0x466770
xor esi, esi
mov edi, dword [ebp - 0x32c]
push esi
push 1
lea ecx, [ebp - 0x70]
call fcn.0041e4c0
push esi
push 1
lea ecx, [ebp - 0x88]
call fcn.0041e4c0
lea ecx, [ebp - 0x328]
call fcn.00463ab1
push esi
push 1
lea ecx, [ebp - 0xd0]
call fcn.0040c250
lea ecx, [ebp - 0x338]
call fcn.00463ab1
mov eax, edi
call fcn.005d25ec
ret