Function at 0x45e6ee
Capabilities:
Enumerate processes
Get installed programs

Disassembly:
push 0x330
mov eax, 0x5e4613
call fcn.0046d2ba
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x338]
xor esi, esi
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x32c], esi
mov dword [ebp - 0x338], esi
mov dword [ebp - 0x334], esi
call fcn.0045f6ca
cld
invalid
invalid
sldt word [eax]
mov dword [ebp - 0x338], eax
mov dword [ebp - 4], esi
call fcn.00473925
test al, al
je 0x45e750
add byte [eax + 0x5c], 3
fidiv word [edi + 0x147f55dd]
loopne 0x45e712
insd dword es:[edi], dx
inc esp
adc al, 0xf9
sti
pop ecx
inc ebp
js 0x45e75a
jecxz 0x45e759
and eax, ebx
call fcn.004736fd
test al, al
je 0x45e772
loope 0x45e765
or al, al
xchg edx, eax
adc eax, 0xf49c002a
rcl byte [edx - 0x63ffd5eb], 0xf4
jb 0x45e6fd
mov ch, 0x70
js 0x45e7e5
jo 0x45e7df
jge 0x45e70b
mov byte [0x8d4b5f9d], al
js 0x45e722
popfd
pop edi
dec ebx
lea edi, [eax - 0x4d]
push 0xffffffffffffffd6
cmp dword [edi + 0x22c], edi
mov edi, 0x22c
lea eax, [ebp - 0x314]
push edi
xor ebx, ebx
push ebx
push eax
call fcn.004830b0
add esp, 0xc
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x45ef38
lea eax, [ebp - 0x314]
mov dword [ebp - 0x314], edi
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x45e850
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
cmp word [ebp - 0x2f0], ax
jne 0x45e7d2
mov eax, ebx
jmp 0x45e7df
lea eax, [ebp - 0x2f0]
push eax
call fcn.00491757
pop ecx
push eax
lea eax, [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x40]
call fcn.00402650
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00458263
pop ecx
pop ecx
call dword [eax - 0x73]
dec ebp
shr al, 0x61
cli
dec dword [ebp + 0x45c6c045]
cld
add dword [eax - 0x73], edx
inc ebp
fcom dword [eax - 0x18]
arpl word [edx + 0x5959ffff], bx
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.0041f8c0
lea eax, [ebp - 0x28]
push eax
call fcn.00457fde
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x338]
push eax
call fcn.0045f65c
add esp, 0xc
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x28]
push ebx
push 1
call fcn.0040ca30
lea eax, [ebp - 0x314]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x45e7b5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov dword [ebp - 0x14], 7
mov esi, 0x5e8b28
mov dword [ebp - 0x18], ebx
push esi
mov word [ebp - 0x28], ax
call fcn.00491757
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00402650
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0xd0]
push eax
call fcn.00458263
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 6
call fcn.0041f8c0
mov eax, dword [ebp - 0x338]
mov ebx, dword [eax]
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 0x318], ebx
cmp ebx, eax
je 0x45eaa6
call fcn.00473337
test al, al
je 0x45e8ec
xor al, 0x70
invalid
call fcn.00473673
test al, al
je 0x45e90e
mov eax, dword [0x3714cd70]
invalid
call fcn.00473490
test al, al
je 0x45e92f
sar eax, 0xc8
and eax, 0x59beea67
out dx, al
xor ebx, dword [edi]
or byte [ebx + esi + 0x1f790170], bh
sub al, 0x9f
test eax, edi
push 0xe4858b97
cld
invalid
mov eax, dword [ebp - 0x31c]
add eax, 0x10
cmp dword [eax + 0x14], 0x10
jb 0x45e940
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x58]
call fcn.00406390
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x40]
call fcn.00453a87
mov ebx, 0x5e9880
mov byte [ebp - 4], 8
push ebx
call fcn.004917d0
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.00405e00
push 0xffffffffffffffff
xor edi, edi
lea eax, [ebp - 0xd0]
push edi
push eax
lea ecx, [ebp - 0x40]
call fcn.00405d00
sub esp, 0x18
lea eax, [ebp - 0x40]
mov ecx, esp
push eax
call fcn.00453a87
lea eax, [ebp - 0x70]
push eax
call fcn.00456baa
add esp, 0x1c
mov ebx, dword [ebp + 0xc]
mov byte [ebp - 4], 9
mov esi, dword [ebx]
jmp 0x45e9f4
cmp dword [esi + 0x14], 0x10
jb 0x45e9b6
mov eax, dword [esi]
jmp 0x45e9b8
mov eax, esi
push eax
lea ecx, [ebp - 0x88]
call fcn.00406390
lea eax, [ebp - 0x88]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x70]
call fcn.0045f8d4
neg eax
sbb al, al
add al, 1
jne 0x45ea43
push edi
push 1
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 9
call fcn.0040ca30
add esi, 0x18
cmp esi, dword [ebx + 4]
jne 0x45e9ac
push edi
push 1
lea ecx, [ebp - 0x70]
call fcn.0040ca30
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.0040ca30
push edi
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 6
call fcn.0040ca30
lea ecx, [ebp - 0x318]
call fcn.0046167d
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x31c], eax
cmp eax, dword [ebp - 0x338]
jne 0x45e8c6
jmp 0x45eaa6
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xa0]
push eax
call fcn.00457dcb
pop ecx
pop ecx
mov ecx, dword [ebp - 0x33c]
push eax
call fcn.00403d40
xor ebx, ebx
lea ecx, [ebp - 0xa0]
push edi
inc ebx
fisttp dword [ebp - 0x9f73]
call dword [edi + 0x43]
push ebx
call fcn.0041f8c0
push edi
push ebx
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x32c], ebx
call fcn.0040ca30
push edi
push ebx
lea ecx, [ebp - 0x70]
call fcn.0040ca30
push edi
push ebx
lea ecx, [ebp - 0x40]
call fcn.0040ca30
push edi
push ebx
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 6
call fcn.0040ca30
call fcn.00473925
test al, al
je 0x45eac8
jge 0x45ea62
sahf
xchg ebx, eax
sbb dh, byte [edi]
jae 0x45ead4
mov al, byte [0x2aef49d9]
pop edx
adc eax, 0xba17ba65
mov ebp, ebx
adc ebx, ebp
stosd dword es:[edi], eax
call fcn.004736fd
test al, al
je 0x45eaea
mov cl, 0x9b
push ds
inc esi
dec ebx
adc ah, bh
nop
sbb al, 0xaa
xor esp, dword [edx + 0x50]
mov ch, 0x46
dec eax
jecxz 0x45eb18
cmp dword [ebp - 0x7b4b3171], ebp
mov ebx, dword [ebp - 0x32c]
test ebx, ebx
jne 0x45ef28
lea ecx, [ebp - 0x328]
mov dword [ebp - 0x328], ebx
mov dword [ebp - 0x324], ebx
call fcn.0045f6ca
mov dword [ebp - 0x328], eax
push ebx
xor eax, eax
mov byte [ebp - 4], 0xb
mov esi, 0x5e87f0
mov dword [ebp - 0x74], 7
push esi
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x78], ebx
mov word [ebp - 0x88], ax
call fcn.00402650
push ebx
xor eax, eax
mov byte [ebp - 4], 0xc
push esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x5c], 7
mov dword [ebp - 0x60], ebx
mov word [ebp - 0x70], ax
call fcn.00402650
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x318]
push eax
push 0x109
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x318], ebx
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x45ebab
lea eax, [ebp - 0x328]
push eax
push dword [ebp - 0x318]
call fcn.00464e2e
pop ecx
pop ecx
push dword [ebp - 0x318]
call esi
lea eax, [ebp - 0x318]
push eax
push 9
push ebx
push 0x5eb0d8
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x45ebe1
lea eax, [ebp - 0x328]
push eax
push dword [ebp - 0x318]
call fcn.00464e2e
pop ecx
pop ecx
push dword [ebp - 0x318]
call esi
lea eax, [ebp - 0x318]
push eax
push 9
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_accept
call edi
test eax, eax
jne 0x45ec17
lea eax, [ebp - 0x328]
push eax
push dword [ebp - 0x318]
call fcn.00464e2e
pop ecx
pop ecx
push dword [ebp - 0x318]
call esi
lea eax, [ebp - 0x318]
push eax
push 0x109
push ebx
push str.SoftwareMicrosoft_
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
jne 0x45ec50
lea eax, [ebp - 0x328]
push eax
push dword [ebp - 0x318]
call fcn.00464e2e
pop ecx
pop ecx
push dword [ebp - 0x318]
call esi
mov eax, dword [ebp - 0x328]
mov ebx, dword [eax]
mov dword [ebp - 0x31c], ebx
mov dword [ebp - 0x330], ebx
cmp ebx, eax
je 0x45eefa
call fcn.004732ad
test al, al
je 0x45ec85
in eax, dx
in eax, 0x57
adc byte [ecx - 0x496c7d0], cl
xchg ebx, eax
push ds
xor edx, dword [edx - 0x36]
dec eax
mov byte [0x1495fe8], al
add byte [eax + eax*8 + 0xbfc1074], al
pop esp
lahf
fsub dword [eax - 8]
call fcn.004735e9
test al, al
je 0x45ec9e
cld
or ebx, dword [edi + ebx*4 - 0x28]
pushal
clc
pop eax
lds ebx, [esp]
imul ecx, edx, 0x4c
arpl word [eax], sp
call fcn.004732ad
test al, al
je 0x45ecbf
mov eax, 0xefc5a53e
push edi
or ecx, dword [esi - 0x11]
add al, 0x28
out dx, al
pop es
movsb byte es:[edi], byte [esi]
mov ebx, 0x153f1b93
adc esi, 0x8bd64610
test esp, esp
cld
invalid
mov eax, dword [ebp - 0x31c]
add eax, 0x10
cmp dword [eax + 0x14], 0x10
jb 0x45ecd0
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x40]
call fcn.00406390
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0xe
push eax
lea ecx, [ebp - 0x58]
call fcn.00453a87
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 0xf
push eax
call fcn.00457fde
pop ecx
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.00453a87
mov ebx, 0x5e9880
mov byte [ebp - 4], 0x10
push ebx
call fcn.004917d0
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.00405e00
push 0xffffffffffffffff
xor esi, esi
lea eax, [ebp - 0xd0]
push esi
push eax
lea ecx, [ebp - 0x28]
call fcn.00405d00
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00453a87
lea eax, [ebp - 0xa0]
push eax
call fcn.00456baa
add esp, 0x1c
mov ecx, dword [ebp + 0x10]
mov byte [ebp - 4], 0x11
mov eax, dword [ecx]
mov dword [ebp - 0x31c], eax
cmp eax, dword [ecx + 4]
je 0x45ee38
call fcn.0047362e
test al, al
je 0x45ed8f
push ss
xchg esi, eax
adc byte [edi + 0x74], bh
sbb dword [edx - 0x45f9528c], 0x331e86c
and esp, edx
invalid
call fcn.0047351a
test al, al
je 0x45edaf
jl 0x45ee14
invalid
call fcn.004733c1
test al, al
je 0x45edcf
dec esp
aas
sub dword [edi], edx
dec ebx
dec eax
cmp eax, 0x2db1fdb9
iretd
mov ebx, dword [ebp - 0x31c]
cmp dword [ebx + 0x14], 0x10
jb 0x45eddf
mov eax, dword [ebx]
jmp 0x45ede1
mov eax, ebx
push eax
lea ecx, [ebp - 0xb8]
call fcn.00406390
lea eax, [ebp - 0xa0]
mov byte [ebp - 4], 0x12
push eax
lea ecx, [ebp - 0xb8]
call fcn.0045f8d4
neg eax
sbb al, al
add al, 1
jne 0x45ee8f
xor esi, esi
mov byte [ebp - 4], 0x11
push esi
push 1
lea ecx, [ebp - 0xb8]
call fcn.0040ca30
mov eax, dword [ebp + 0x10]
add ebx, 0x18
mov dword [ebp - 0x31c], ebx
cmp ebx, dword [eax + 4]
jne 0x45ed66
adc dword [esi + 0x6a], edx
add dword [ebp - 0xb773], ecx
invalid
xor ebx, ebx
lea ecx, [ebp - 0xa0]
push esi
inc ebx
push ebx
call fcn.0040ca30
push esi
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040ca30
push esi
push ebx
lea ecx, [ebp - 0x58]
call fcn.0040ca30
push esi
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xd
call fcn.0040ca30
lea ecx, [ebp - 0x330]
call fcn.0046167d
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x31c], eax
cmp eax, dword [ebp - 0x328]
jne 0x45ec6c
jmp 0x45eefc
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.00457dcb
pop ecx
pop ecx
mov ecx, dword [ebp - 0x33c]
push eax
call fcn.00403d40
xor esi, esi
lea ecx, [ebp - 0xe8]
push esi
push 1
call fcn.0041f8c0
xor ebx, ebx
lea ecx, [ebp - 0xb8]
push esi
inc ebx
push ebx
call fcn.0040ca30
push esi
push ebx
lea ecx, [ebp - 0xa0]
call fcn.0040ca30
push esi
push ebx
lea ecx, [ebp - 0x28]
call fcn.0040ca30
push esi
push ebx
lea ecx, [ebp - 0x58]
call fcn.0040ca30
push esi
push ebx
lea ecx, [ebp - 0x40]
call fcn.0040ca30
jmp 0x45ef02
xor esi, esi
mov ebx, dword [ebp - 0x32c]
push esi
push 1
lea ecx, [ebp - 0x70]
call fcn.0041f8c0
push esi
push 1
lea ecx, [ebp - 0x88]
call fcn.0041f8c0
lea ecx, [ebp - 0x328]
call fcn.0045b55c
jmp 0x45ef2a
xor esi, esi
push esi
push 1
lea ecx, [ebp - 0xd0]
call fcn.0040ca30
lea ecx, [ebp - 0x338]
call fcn.0045b55c
mov eax, ebx
call fcn.0046d264
ret