Function at 0x408c60
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2084
call fcn.004166c0
mov eax, dword [0x446054]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x2080]
mov dword [ebp - 0x2084], ecx
push eax
push 0x20119
push 0
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x2080], 0
push eax
mov ecx, 0x1a
mov dword [ebp - 0x207c], 0
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov dword [ebp - 0x2074], 0xf003f
lea edi, [ebp - 0x6c]
mov dword [ebp - 0x2070], 0
rep movsd dword es:[edi], dword [esi]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x408ce9
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415ea4
mov esp, ebp
pop ebp
ret
push ebx
xor bl, bl
xor esi, esi
nop
test bl, bl
jne 0x408ed7
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2070]
mov dword [ebp - 0x2070], 0x800
push eax
lea eax, [ebp - 0x186c]
push eax
push esi
push dword [ebp - 0x2080]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
jne 0x408ece
lea eax, [ebp - 0x186c]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x206c]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x207c]
push eax
push 0x20119
push edi
lea eax, [ebp - 0x206c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408ef6
lea eax, [ebp - 0x2070]
mov dword [ebp - 0x2070], 0x800
push eax
lea eax, [ebp - 0x86c]
push eax
lea eax, [ebp - 0x2074]
push eax
push edi
push str.DisplayName
push dword [ebp - 0x207c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408dbf
lea eax, [ebp - 0x86c]
push eax
push 0x442148
call fcn.00406ba0
add esp, 8
mov ecx, str.FortiSIEM_Log_Agent
lea eax, [ebp - 0x86c]
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x408df6
test dx, dx
je 0x408df2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x408df6
add eax, 4
add ecx, 4
test dx, dx
jne 0x408dd0
xor eax, eax
jmp 0x408dfb
sbb eax, eax
or eax, 1
test eax, eax
je 0x408e43
mov eax, str.FortiSIEM_Windows_Agent
lea ecx, [ebp - 0x86c]
nop word [eax + eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x408e36
test dx, dx
je 0x408e32
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x408e36
add ecx, 4
add eax, 4
test dx, dx
jne 0x408e10
xor eax, eax
jmp 0x408e3b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x408ec2
lea eax, [ebp - 0x2078]
mov dword [ebp - 0x2078], 0x400
push eax
lea eax, [ebp - 0x106c]
push eax
lea eax, [ebp - 0x2074]
push eax
push 0
push str.UninstallString
push dword [ebp - 0x207c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408ec2
lea ecx, [ebp - 0x106c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408e82
mov ebx, dword [ebp - 0x2084]
lea eax, [ebp - 0x106c]
sub ecx, edx
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.0040d2b0
push ecx
push 0x4421cc
mov ecx, ebx
call fcn.0040b910
push 1
sub esp, 8
mov ecx, ebx
push eax
call fcn.0040d110
mov bl, 1
push dword [ebp - 0x207c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
test edi, edi
je 0x408cf0
push dword [ebp - 0x2080]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00415ea4
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x207c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0x2080]
call ebx
lea eax, [ebp - 0x186c]
push eax
push str.couldnt_open__s_n
call fcn.00406ba0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
xor al, al
pop ebx
pop edi
pop esi
call fcn.00415ea4
mov esp, ebp
pop ebp
ret