Function at 0x10004850
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x10ec
call fcn.1000d8d0
push ebx
mov ebx, dword [esp + 0x10f4]
push esi
xor esi, esi
cmp ebx, esi
je 0x10004ae9
cmp dword [esp + 0x10fc], esi
je 0x10004ae9
lea eax, [esp + 0x18]
mov dword [esp + 0x18], esi
push eax
push 8
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004a8b
push edi
mov ecx, 0x1ff
lea edi, [esp + 0xfa]
mov word [esp + 0xf8], si
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x28]
lea edx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x20]
push esi
push esi
stosw word es:[edi], ax
push esi
lea eax, [esp + 0x108]
push edx
push eax
push esi
push ecx
mov dword [esp + 0x40], 0x800
mov dword [esp + 0x44], 1
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10004a77
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, 0x1ff
xor eax, eax
lea edi, [esp + 0x8fe]
mov word [esp + 0x8fc], si
rep stosd dword es:[edi], eax
lea edx, [esp + 0xfc]
mov dword [esp + 0x24], 0x800
stosw word es:[edi], ax
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea eax, [esp + 0x904]
push str._s_s
push eax
mov dword [esp + 0x2c], esi
call ebp
add esp, 0x10
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x8fc]
push ecx
push 1
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10004a3b
mov ecx, 0x31
lea edi, [esp + 0x36]
mov word [esp + 0x34], si
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x18]
lea ecx, [esp + 0x34]
push eax
mov eax, dword [esp + 0x20]
push ecx
push edx
push esi
push str.DisplayName
push eax
mov dword [esp + 0x30], 0xc8
call ebx
test eax, eax
jne 0x10004a3b
cmp dword [esp + 0x14], 1
jne 0x10004a3b
mov ecx, dword [esp + 0x1100]
lea edx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10004a3b
mov edi, dword [esp + 0x1104]
mov eax, dword [esp + 0x1108]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
push edx
push esi
push str.alu7501e157_4b4a_4850_b6ea_3bea55826ba9
push eax
call ebx
test eax, eax
jne 0x10004a0a
mov ecx, dword [esp + 0x14]
mov eax, 1
cmp ecx, eax
jne 0x10004a0a
mov dword [esp + 0x10], eax
jmp 0x10004a3b
cmp dword [esp + 0x10], esi
jne 0x10004a3b
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edi
push edx
push esi
push str.DisplayVersion
push eax
call ebx
test eax, eax
jne 0x10004a3b
cmp dword [esp + 0x14], 1
jne 0x10004a3b
mov dword [esp + 0x10], 1
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x24]
mov eax, ecx
inc ecx
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x2c]
push ecx
push esi
push esi
push esi
lea ecx, [esp + 0x10c]
push edx
mov edx, dword [esp + 0x34]
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10004901
mov ebx, dword [esp + 0x1100]
pop ebp
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop edi
cmp eax, esi
jne 0x10004adc
push str.Eee_Manager
push ebx
call fcn.1000dac4
add esp, 8
test eax, eax
jne 0x10004ac1
push str.Eee_Screen_Setting
push ebx
call fcn.1000dac4
add esp, 8
test eax, eax
jne 0x10004ac1
push str.Easy_Mode
push ebx
call fcn.1000dac4
add esp, 8
test eax, eax
je 0x10004adc
mov ecx, dword [esp + 0x10fc]
push 0x1003407c
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [esp + 8], 1
mov eax, dword [esp + 8]
pop esi
pop ebx
add esp, 0x10ec
ret
pop esi
xor eax, eax
pop ebx
add esp, 0x10ec
ret