Function at 0x10097220
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x9fb4
call fcn.10126240
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x9fb0], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0xfff
lea eax, [esp + 0x8fbd]
push ebx
push eax
mov byte [esp + 0x8fc4], bl
call fcn.10116880
add esp, 0xc
push 0xfff
lea ecx, [esp + 0x1945]
push ebx
push ecx
mov byte [esp + 0x194c], bl
call fcn.10116880
add esp, 0xc
push 0xfff
lea edx, [esp + 0x436d]
push ebx
push edx
mov byte [esp + 0x4374], bl
call fcn.10116880
add esp, 0xc
push 0xfff
lea eax, [esp + 0x6fbd]
push ebx
push eax
mov byte [esp + 0x6fc4], bl
call fcn.10116880
add esp, 0xc
push 0xfff
lea ecx, [esp + 0x7fbd]
push ebx
push ecx
mov byte [esp + 0x7fc4], bl
call fcn.10116880
add esp, 0xc
push 0xfff
lea edx, [esp + 0x2945]
push ebx
push edx
mov byte [esp + 0x294c], bl
call fcn.10116880
add esp, 0xc
cmp dword [0x1018e0b4], 0xffffffff
jne 0x1009730f
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x1009730f
mov dword [0x1018e0b4], ebx
cmp dword [0x10191cb8], ebx
jne 0x10098908
push str.ModuleUsage_RegKey...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
add esp, 0xc
lea eax, [esp + 0x1940]
push str.SoftwareMicrosoftWindowsCurrentVersionModuleUsage
push eax
call fcn.1010d6a8
lea ecx, [esp + 0x1948]
push ecx
lea edx, [esp + 0x4374]
push str.HKLM_s
push edx
call fcn.1010d6a8
add esp, 0x14
lea eax, [esp + 0x10]
push eax
push 9
push ebx
lea ecx, [esp + 0x194c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x100974b0
xor esi, esi
cmp dword [0x10191cb8], ebx
jne 0x100974b0
mov eax, dword [esp + 0x10]
push 0x410
lea edx, [esp + 0x944]
push edx
push esi
push eax
mov byte [esp + 0x950], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x100974a5
cmp dword [0x10191874], ebx
je 0x100973dc
push 0x10191c8c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0x940]
push ecx
lea edx, [esp + 0x7fbc]
mov edi, 1
add dword [0x10191cbc], edi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x940]
push 0x2f
push eax
call fcn.1010d780
add esp, 8
cmp eax, ebx
je 0x10097426
mov byte [eax], 0x5c
inc eax
push 0x2f
push eax
call fcn.1010d780
add esp, 8
cmp eax, ebx
jne 0x10097413
push ebx
push ebx
xor edx, edx
lea ecx, [esp + 0x948]
call fcn.10044660
add esp, 8
test eax, eax
jne 0x10097441
add esi, edi
jmp 0x10097497
cmp dword [0x10191874], ebx
je 0x10097454
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cc4], edi
cmp dword [0x1018e0b4], 0xffffffff
jne 0x10097478
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x10097478
mov dword [0x1018e0b4], ebx
push 0
push edi
push 6
lea ecx, [esp + 0x4374]
lea ebx, [esp + 0x94c]
call fcn.10093730
add esp, 0xc
add esi, edi
xor ebx, ebx
cmp dword [0x10191cb8], ebx
je 0x100973a0
jmp 0x100974b0
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.ExternalApp_RegKey...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
add esp, 0xc
lea edx, [esp + 0x1940]
push str.SoftwareNetscapeNetscape_NavigatorUser_Trusted_External_Applications
push edx
call fcn.1010d6a8
lea eax, [esp + 0x1948]
push eax
lea ecx, [esp + 0x4374]
push str.HKCU_s
push ecx
call fcn.1010d6a8
add esp, 0x14
lea edx, [esp + 0x10]
push edx
push 9
push ebx
lea eax, [esp + 0x194c]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x10097657
mov dword [esp + 0xc], ebx
cmp dword [0x10191cb8], ebx
jne 0x10097657
jmp 0x10097540
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x944]
push edx
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x2954]
push edx
push eax
mov ebx, 0x1000
push ecx
mov byte [esp + 0x960], 0
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1009764a
push eax
push eax
xor edx, edx
lea ecx, [esp + 0x2948]
call fcn.10044660
add esp, 8
test eax, eax
jne 0x100975ae
inc dword [esp + 0xc]
jmp 0x1009763b
lea edx, [esp + 0x2940]
push edx
lea eax, [esp + 0x577c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edi, edi
lea esi, [esp + 0x5778]
call fcn.10014dd0
mov esi, 1
cmp eax, esi
je 0x10097637
cmp dword [0x10191874], edi
je 0x100975ee
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cc4], esi
cmp dword [0x1018e0b4], 0xffffffff
jne 0x10097616
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x10097616
mov dword [0x1018e0b4], 0
push 0
push 2
push 7
lea ecx, [esp + 0x4374]
lea ebx, [esp + 0x294c]
call fcn.10093730
add esp, 0xc
mov ebx, 0x1000
add dword [esp + 0xc], esi
cmp dword [0x10191cb8], 0
je 0x10097540
jmp 0x1009765c
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1009765c
mov ebx, 0x1000
push str.SharedDLL_RegKey...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
add esp, 0xc
lea edx, [esp + 0x1940]
push str.SoftwareMicrosoftWindowsCurrentVersionSharedDlls
push edx
call fcn.1010d6a8
lea eax, [esp + 0x1948]
push eax
lea ecx, [esp + 0x4374]
push str.HKLM_s
push ecx
call fcn.1010d6a8
add esp, 0x14
lea edx, [esp + 0x10]
push edx
push 9
push 0
lea eax, [esp + 0x194c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x100977f4
mov dword [esp + 0xc], esi
cmp dword [0x10191cb8], esi
jne 0x100977f4
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x944]
push edx
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x2954]
push edx
push eax
push ecx
mov byte [esp + 0x960], 0
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x100977e9
push eax
push eax
xor edx, edx
lea ecx, [esp + 0x2948]
call fcn.10044660
add esp, 8
test eax, eax
jne 0x1009774d
inc dword [esp + 0xc]
jmp 0x100977da
lea edx, [esp + 0x2940]
push edx
lea eax, [esp + 0x5b8c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edi, edi
lea esi, [esp + 0x5b88]
call fcn.10014dd0
mov esi, 1
cmp eax, esi
je 0x100977d6
cmp dword [0x10191874], edi
je 0x1009778d
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cc4], esi
cmp dword [0x1018e0b4], 0xffffffff
jne 0x100977b5
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x100977b5
mov dword [0x1018e0b4], 0
push 0
push 2
push 8
lea ecx, [esp + 0x4374]
lea ebx, [esp + 0x294c]
call fcn.10093730
add esp, 0xc
mov ebx, 0x1000
add dword [esp + 0xc], esi
cmp dword [0x10191cb8], 0
je 0x100976e4
jmp 0x100977f4
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.MUICache_1_...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
add esp, 0xc
lea edx, [esp + 0x1940]
push str.SoftwareMicrosoftWindowsShellNoRoamMUICache
push edx
call fcn.1010d6a8
lea eax, [esp + 0x1948]
push eax
lea ecx, [esp + 0x4374]
push str.HKCU_s
push ecx
call fcn.1010d6a8
add esp, 0x14
lea edx, [esp + 0x10]
push edx
push 9
push 0
lea eax, [esp + 0x194c]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x100979ec
mov dword [esp + 0xc], esi
cmp dword [0x10191cb8], esi
jne 0x100979ec
lea esp, [esp]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x944]
push edx
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x2954]
push edx
push eax
push ecx
mov byte [esp + 0x960], 0
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x100979e1
cmp byte [esp + 0x2940], 0x40
je 0x100979ce
cmp dword [esp + 0x1c], 3
je 0x100979ce
cmp byte [esp + 0x2941], 0x3a
jne 0x100979ce
lea edx, [esp + 0x2940]
push edx
call sym.EncDec.dll_IsFileOnNetworkDrive
test eax, eax
jne 0x100979ce
push eax
push eax
xor edx, edx
lea ecx, [esp + 0x2948]
call fcn.10044660
add esp, 8
test eax, eax
je 0x100979ce
lea eax, [esp + 0x2940]
push eax
lea ecx, [esp + 0x3b4c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edi, edi
lea esi, [esp + 0x3b48]
call fcn.10014dd0
mov esi, 1
cmp eax, esi
je 0x100979c8
push str.FriendlyAppName
lea ecx, [esp + 0x3b4c]
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x100979c8
push str.ApplicationCompany
lea ecx, [esp + 0x3b4c]
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x100979c8
cmp dword [0x10191874], edi
je 0x10097996
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cc4], esi
call fcn.100935b0
push 0
push 2
push 0xc
lea ecx, [esp + 0x4374]
lea ebx, [esp + 0x294c]
call fcn.10093730
add esp, 0xc
add dword [esp + 0xc], esi
mov ebx, 0x1000
jmp 0x100979d2
add dword [esp + 0xc], esi
jmp 0x100979d2
inc dword [esp + 0xc]
cmp dword [0x10191cb8], 0
je 0x10097880
jmp 0x100979ec
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.MUICache_2_...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
add esp, 0xc
lea eax, [esp + 0x1940]
push str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
push eax
call fcn.1010d6a8
lea ecx, [esp + 0x1948]
push ecx
lea edx, [esp + 0x4374]
push str.HKCU_s
push edx
call fcn.1010d6a8
add esp, 0x14
lea eax, [esp + 0x10]
push eax
push 9
push 0
lea ecx, [esp + 0x194c]
push ecx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x10097be0
mov dword [esp + 0xc], esi
cmp dword [0x10191cb8], esi
jne 0x10097be0
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x944]
push eax
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
push 0
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
lea eax, [esp + 0x2954]
push eax
push ecx
push edx
mov byte [esp + 0x960], 0
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x10097bd5
cmp byte [esp + 0x2940], 0x40
je 0x10097bc2
cmp dword [esp + 0x1c], 3
je 0x10097bc2
cmp byte [esp + 0x2941], 0x3a
jne 0x10097bc2
lea eax, [esp + 0x2940]
push eax
call sym.EncDec.dll_IsFileOnNetworkDrive
test eax, eax
jne 0x10097bc2
push eax
push eax
xor edx, edx
lea ecx, [esp + 0x2948]
call fcn.10044660
add esp, 8
test eax, eax
je 0x10097bc2
lea ecx, [esp + 0x2940]
push ecx
lea edx, [esp + 0x3944]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edi, edi
lea esi, [esp + 0x3940]
call fcn.10014dd0
mov esi, 1
cmp eax, esi
je 0x10097bbc
push str.FriendlyAppName
lea ecx, [esp + 0x3944]
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10097bbc
push str.ApplicationCompany
lea ecx, [esp + 0x3944]
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10097bbc
cmp dword [0x10191874], edi
je 0x10097b8a
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cc4], esi
call fcn.100935b0
push 0
push 2
push 0xc
lea ecx, [esp + 0x4374]
lea ebx, [esp + 0x294c]
call fcn.10093730
add esp, 0xc
add dword [esp + 0xc], esi
mov ebx, 0x1000
jmp 0x10097bc6
add dword [esp + 0xc], esi
jmp 0x10097bc6
inc dword [esp + 0xc]
cmp dword [0x10191cb8], 0
je 0x10097a74
jmp 0x10097be0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Firewall_authorized_applications_1_...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
add esp, 0xc
lea ecx, [esp + 0x1940]
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyDomainProfileAuthorizedApplicationsList
push ecx
call fcn.1010d6a8
lea edx, [esp + 0x1948]
push edx
lea eax, [esp + 0x4374]
push str.HKLM_s
push eax
call fcn.1010d6a8
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
push 9
push 0
lea edx, [esp + 0x194c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x10097d74
mov dword [esp + 0xc], esi
cmp dword [0x10191cb8], esi
jne 0x10097d74
mov eax, 0x1000
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x944]
push ecx
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x2954]
push ecx
push edx
push eax
mov byte [esp + 0x960], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x10097d69
lea ecx, [esp + 0x2940]
push ecx
lea edx, [esp + 0x4164]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x4160]
push eax
call sym.EncDec.dll_IsFileOnNetworkDrive
test eax, eax
jne 0x10097d51
xor edi, edi
lea esi, [esp + 0x4160]
call fcn.10014dd0
mov esi, 1
cmp eax, esi
je 0x10097d56
cmp dword [0x10191874], edi
je 0x10097d0b
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cc4], esi
cmp dword [0x1018e0b4], 0xffffffff
jne 0x10097d33
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x10097d33
mov dword [0x1018e0b4], 0
push 0
push 2
push 0xd
lea ecx, [esp + 0x4374]
lea ebx, [esp + 0x294c]
call fcn.10093730
add esp, 0xc
jmp 0x10097d56
mov esi, 1
add dword [esp + 0xc], esi
cmp dword [0x10191cb8], 0
je 0x10097c68
jmp 0x10097d74
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Firewall_authorized_applications_2_...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
add esp, 0xc
lea edx, [esp + 0x1940]
push str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyFirewallRules
push edx
call fcn.1010d6a8
lea eax, [esp + 0x1948]
push eax
lea ecx, [esp + 0x4374]
push str.HKLM_s
push ecx
call fcn.1010d6a8
add esp, 0x14
lea edx, [esp + 0x10]
push edx
push 9
push 0
lea eax, [esp + 0x194c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x10098126
mov dword [esp + 0xc], esi
cmp dword [0x10191cb8], esi
jne 0x10098126
mov eax, 0x1000
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea edx, [esp + 0x944]
push edx
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x18]
push 0
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x2954]
push edx
push eax
push ecx
mov byte [esp + 0x960], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1009811b
push 0x7ff
push eax
lea edx, [esp + 0x149]
push edx
mov byte [esp + 0x14c], al
call fcn.10116880
add esp, 0xc
push 0x7ff
lea eax, [esp + 0x63ad]
push 0
push eax
mov dword [esp + 0x2c], 0
mov byte [esp + 0x63b4], 0
call fcn.10116880
add esp, 0xc
mov ebx, 1
push ebx
lea ecx, [esp + 0x24]
push 0x7c
push ecx
lea edx, [esp + 0x63b4]
lea ecx, [esp + 0x94c]
call fcn.10045850
or esi, 0xffffffff
add esp, 0xc
cmp dword [esp + 0x20], esi
je 0x10097f11
lea ebx, [ebx]
mov eax, str.App
lea ecx, [esp + 0x63a8]
call fcn.10031940
test eax, eax
je 0x10097efb
push ebx
lea edx, [esp + 0x24]
push 0x7c
push edx
lea edx, [esp + 0x63b4]
lea ecx, [esp + 0x94c]
call fcn.10045850
add esp, 0xc
cmp dword [esp + 0x20], esi
jne 0x10097ec0
jmp 0x10097f11
lea eax, [esp + 0x63ac]
push eax
lea ecx, [esp + 0x144]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [esp + 0x140], 0
je 0x10098108
lea edx, [esp + 0x140]
push str.System
push edx
call fcn.1011c280
add esp, 8
test eax, eax
je 0x10098108
xor edi, edi
lea esi, [esp + 0x140]
call fcn.10014dd0
cmp eax, ebx
je 0x10098108
mov eax, esi
push eax
call sym.EncDec.dll_IsFileOnNetworkDrive
test eax, eax
jne 0x10098108
push str.Windows_Media_Player_
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10098108
push str.system32p2phost.exe
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10098108
push str.system32_raserver.exe
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10098108
push str.system32msra.exe
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10098108
push str.system32_netproj.exe
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10098108
push str.ehome_
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10098108
push str.utorrent_
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10098108
push str.Messenger_
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10098108
push str._sync_
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10098108
push str.Office
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10098108
push str.CrashPlan_
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10098108
push str.hp_
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10098108
push str.BlackBerry
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10098108
push str.system32CNAB5RPD.EXE
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10098108
push str.system32CNAB5RPD.EXE
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x10098108
cmp dword [0x10191874], edi
je 0x100980d5
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cc4], ebx
call fcn.100935b0
lea ecx, [esp + 0x140]
push ecx
push 2
push 0xd
lea ecx, [esp + 0x4374]
lea ebx, [esp + 0x294c]
call fcn.10093730
add esp, 0xc
inc dword [esp + 0xc]
jmp 0x1009810c
add dword [esp + 0xc], ebx
cmp dword [0x10191cb8], 0
je 0x10097dfc
jmp 0x10098126
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Checking_App_Path_Entries...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
add esp, 0xc
lea eax, [esp + 0x1940]
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
push eax
call fcn.1010d6a8
lea ecx, [esp + 0x1948]
push ecx
lea edx, [esp + 0x4374]
push str.HKLM_s
push edx
call fcn.1010d6a8
add esp, 0x14
lea eax, [esp + 0x1940]
push eax
lea ecx, [esp + 0x6fbc]
push str.HKLM_s
push ecx
call fcn.1010d6a8
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 9
push 0
lea eax, [esp + 0x194c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x1009832a
mov dword [esp + 0xc], esi
cmp dword [0x10191cb8], esi
jne 0x1009832a
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push 0x410
lea ecx, [esp + 0x944]
push ecx
push edx
push eax
mov byte [esp + 0x950], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1009831f
lea ecx, [esp + 0x28]
push ecx
push 9
push eax
mov ebx, 1
add dword [0x10191cbc], ebx
lea edx, [esp + 0x94c]
mov byte [esp + 0x5374], al
mov eax, dword [esp + 0x1c]
push edx
push eax
mov dword [esp + 0x44], 0x410
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x1009830c
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x536c]
push edx
push esi
push esi
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10098301
cmp byte [esp + 0x5369], 0x3a
jne 0x10098301
lea edi, [esp + 0x5368]
call fcn.10014390
test eax, eax
jne 0x10098301
mov ecx, edi
push ecx
lea edx, [esp + 0x3d54]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edi, edi
lea esi, [esp + 0x3d50]
call fcn.10014dd0
test eax, eax
jne 0x10098301
push ebx
mov ecx, esi
call fcn.10044890
add esp, 4
test eax, eax
jne 0x10098301
lea eax, [esp + 0x940]
push eax
lea ecx, [esp + 0x1944]
push ecx
lea edx, [esp + 0x4370]
push str.HKLM_s_s
push edx
call fcn.1010d6a8
add dword [0x10191cc4], ebx
call fcn.100935b0
mov eax, esi
push eax
push ebx
push 0xe
lea ecx, [esp + 0x6fd4]
lea ebx, [esp + 0x95c]
call fcn.10093730
add esp, 0x1c
lea ebx, [edi + 1]
mov ecx, dword [esp + 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add dword [esp + 0xc], ebx
cmp dword [0x10191cb8], 0
je 0x100981cb
jmp 0x1009832a
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Installer_RegKey...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
add esp, 0xc
lea eax, [esp + 0x1940]
push str.SoftwareMicrosoftWindowsCurrentVersionInstallerFolders
push eax
call fcn.1010d6a8
lea ecx, [esp + 0x1948]
push ecx
lea edx, [esp + 0x4374]
push str.HKLM_s
push edx
call fcn.1010d6a8
add esp, 0x14
lea eax, [esp + 0x10]
push eax
push 9
push 0
lea ecx, [esp + 0x194c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x100984e5
cmp dword [0x10191cb8], esi
jne 0x100984e5
push 0x40f
lea edx, [esp + 0x5f9d]
push 0
push edx
mov byte [esp + 0x5fa4], 0
call fcn.10116880
add esp, 0xc
mov eax, 0x1000
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x944]
push ecx
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x1c]
push 0
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2954]
push ecx
push esi
push edx
mov byte [esp + 0x960], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x100984da
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x2940]
push eax
lea ecx, [esp + 0x5f9c]
push ecx
call ebx
lea edi, [esp + 0x2940]
call fcn.10044b00
cmp eax, 1
je 0x100984ca
mov edx, edi
push edx
lea eax, [esp + 0x3f5c]
push eax
call ebx
lea ecx, [esp + 0x3f58]
push ecx
call fcn.10014290
add esp, 4
lea edi, [esp + 0x3f58]
call fcn.10044b00
cmp eax, 1
je 0x100984ca
cmp dword [0x10191874], 0
je 0x10098486
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
inc dword [0x10191cc4]
cmp dword [0x1018e0b4], 0xffffffff
jne 0x100984ae
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x100984ae
mov dword [0x1018e0b4], 0
push 0
push 2
push 9
lea ecx, [esp + 0x4374]
lea ebx, [esp + 0x294c]
call fcn.10093730
add esp, 0xc
inc esi
cmp dword [0x10191cb8], 0
je 0x100983ae
jmp 0x100984e5
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.FileExtension_RegKey...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
add esp, 0xc
lea eax, [esp + 0x1940]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push eax
call fcn.1010d6a8
add esp, 8
lea ecx, [esp + 0x10]
push ecx
push 9
push 0
lea edx, [esp + 0x194c]
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x10098753
push 0x40f
lea eax, [esp + 0x6bad]
push esi
push eax
mov byte [esp + 0x6bb4], 0
call fcn.10116880
add esp, 0xc
mov dword [esp + 0xc], esi
cmp dword [0x10191cb8], esi
jne 0x10098753
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push 0x410
lea ecx, [esp + 0x944]
push ecx
push edx
push eax
mov byte [esp + 0x950], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x10098748
cmp dword [0x10191874], eax
je 0x100985b1
push 0x10191c8c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
inc dword [0x10191cbc]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push ecx
push 9
xor ebx, ebx
push ebx
lea edx, [esp + 0x94c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x1009863c
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x3c]
push edx
push esi
push esi
push str.Application
push eax
mov byte [esp + 0x50], 0
mov dword [esp + 0x44], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10098631
cmp byte [esp + 0x38], al
je 0x10098631
xor edi, edi
lea esi, [esp + 0x38]
call fcn.10014dd0
test eax, eax
jne 0x1009862c
call fcn.100144f0
test eax, eax
je 0x10098631
mov ebx, 1
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x940], 0x2e
jne 0x10098735
test ebx, ebx
jne 0x10098735
lea edx, [esp + 0x940]
push edx
lea eax, [esp + 0x5984]
push str._sOpenWithProgids
push eax
call fcn.1010d6a8
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
push 9
push ebx
lea edx, [esp + 0x598c]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x1009872a
lea ecx, [esp + 0x940]
push ecx
call fcn.10014ee0
add esp, 4
cmp eax, 1
jne 0x10098735
lea edx, [esp + 0x1940]
push edx
lea eax, [esp + 0x436c]
push str.HKCU_s
push eax
call fcn.1010d6a8
add esp, 0xc
cmp dword [0x10191874], ebx
je 0x100986e4
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
inc dword [0x10191cc4]
cmp dword [0x1018e0b4], 0xffffffff
jne 0x1009870c
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x1009870c
mov dword [0x1018e0b4], 0
push 0
push 1
push 0xa
lea ecx, [esp + 0x4374]
lea ebx, [esp + 0x94c]
call fcn.10093730
add esp, 0xc
jmp 0x10098735
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [esp + 0xc]
cmp dword [0x10191cb8], 0
je 0x10098571
jmp 0x10098753
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.ARPCache_RegKey...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
add esp, 0xc
lea eax, [esp + 0x1940]
push str.SoftwareMicrosoftWindowsCurrentVersionApp_ManagementARPCache
push eax
call fcn.1010d6a8
add esp, 8
lea ecx, [esp + 0x10]
push ecx
push 9
push 0
lea edx, [esp + 0x194c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x10098908
mov dword [esp + 0xc], esi
cmp dword [0x10191cb8], esi
jne 0x10098908
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
push 0x410
lea eax, [esp + 0x944]
push eax
push ecx
push edx
mov byte [esp + 0x950], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x100988fd
cmp dword [0x10191874], eax
je 0x10098801
push 0x10191c8c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea eax, [esp + 0x940]
push eax
lea ecx, [esp + 0x5d94]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_s
mov edi, 1
add dword [0x10191cbc], edi
push ecx
call fcn.1010d6a8
add esp, 0xc
lea edx, [esp + 0x34]
push edx
push 9
push 0
lea eax, [esp + 0x5d9c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
je 0x100988cc
lea ecx, [esp + 0x1940]
push ecx
lea edx, [esp + 0x436c]
push str.HKLM_s
push edx
call fcn.1010d6a8
add esp, 0xc
cmp dword [0x10191874], 0
je 0x10098887
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cc4], edi
cmp dword [0x1018e0b4], 0xffffffff
jne 0x100988af
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x100988af
mov dword [0x1018e0b4], 0
push 0
push edi
push 0xb
lea ecx, [esp + 0x4374]
lea ebx, [esp + 0x94c]
call fcn.10093730
add esp, 0xc
jmp 0x100988d7
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add dword [esp + 0xc], edi
cmp dword [0x10191cb8], 0
je 0x100987c1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x9fb0]
xor ecx, esp
call fcn.1010d699
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x9fbc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1010d699
mov esp, ebp
pop ebp
ret