Function at 0x10083ca0
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018788f
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x101dd594]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x45c], ebx
mov dword [ebp - 0x468], ebx
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
lea eax, [ebx + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x464], eax
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov byte [ebp - 4], 1
call fcn.1001b540
mov ecx, eax
test ecx, ecx
je 0x100844a8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x44c], eax
call fcn.1001b540
mov ecx, eax
test ecx, ecx
je 0x100844b2
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x448], eax
call fcn.1001b540
mov ecx, eax
test ecx, ecx
je 0x100844bc
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x444], eax
call fcn.1001b540
mov ecx, eax
test ecx, ecx
je 0x100844c6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x440], eax
call fcn.1001b540
mov ecx, eax
test ecx, ecx
je 0x100844d0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x43c], eax
mov byte [ebp - 4], 2
call fcn.1001b540
mov ecx, eax
test ecx, ecx
je 0x100844da
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x450], esi
push 0x1fe
lea eax, [ebp - 0x410]
mov byte [ebp - 4], 3
push 0
push eax
call fcn.10150460
push 0x1fe
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.10150460
add esp, 0x18
mov dword [ebp - 0x41c], 0
lea eax, [ebp - 0x468]
mov dword [ebp - 0x428], 0xff
xorps xmm0, xmm0
mov dword [ebp - 0x414], 0xff
movq qword [ebp - 0x424], xmm0
lea ecx, [ebp - 0x424]
push dword [ebp - 0x468]
mov dword [ebp - 0x418], 7
push eax
lea eax, [ebp - 0x480]
mov dword [ebp - 0x480], SysReAllocString
push eax
mov byte [ebp - 0x47c], 0
mov dword [ebp - 0x478], reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 0x474], 0
mov dword [ebp - 0x470], reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 0x46c], 1
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x41c], 0
call fcn.10083a70
mov edx, dword [ebp - 0x424]
mov eax, dword [ebp - 0x420]
mov byte [ebp - 4], 4
mov dword [ebp - 0x454], edx
mov dword [ebp - 0x45c], eax
cmp edx, eax
je 0x1008435e
xor eax, eax
mov ecx, 0x100
cmp byte [edx + 4], al
cmovne eax, ecx
lea ecx, [ebp - 0x430]
push ecx
or eax, 0x20019
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push dword [edx]
mov dword [ebp - 0x460], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1008433d
xor edi, edi
lea eax, [ebp - 0x428]
push edi
push edi
push edi
push edi
push eax
lea eax, [ebp - 0x410]
push eax
push edi
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10084331
lea eax, [ebp - 0x410]
inc edi
push eax
lea eax, [ebp - 0x450]
mov dword [ebp - 0x434], edi
push 0x1019ac28
push eax
call fcn.1001e580
mov esi, dword [ebp - 0x450]
add esp, 0xc
cmp dword [esi - 0xc], 0
je 0x10084306
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 0x460]
push 0
push esi
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100842e6
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x42c]
call ebx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x44c]
call fcn.10018690
push 0xff
lea eax, [ebp - 0x210]
mov dword [ebp - 0x414], 0xff
push 0
push eax
call fcn.10150460
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push str.DisplayVersion
push dword [ebp - 0x42c]
call ebx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x448]
call fcn.10018690
push 0xff
lea eax, [ebp - 0x210]
mov dword [ebp - 0x414], 0xff
push 0
push eax
call fcn.10150460
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push str.InstallLocation
push dword [ebp - 0x42c]
call ebx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x444]
call fcn.10018690
mov ebx, dword [ebp - 0x444]
xor edi, edi
mov ecx, ebx
movzx eax, word [ebx]
test ax, ax
je 0x100840da
mov edx, eax
cmp dx, 0x22
jne 0x10084087
test edi, edi
mov eax, ecx
cmovne eax, edi
mov edi, eax
jmp 0x10084089
xor edi, edi
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x10084076
test edi, edi
je 0x100840da
sub edi, ebx
sar edi, 1
js 0x100844e9
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, edi
or eax, ecx
jge 0x100840c8
push edi
lea ecx, [ebp - 0x444]
call fcn.10018550
mov ebx, dword [ebp - 0x444]
cmp edi, dword [ebx - 8]
jg 0x100844e9
xor eax, eax
mov dword [ebx - 0xc], edi
mov word [ebx + edi*2], ax
mov eax, 0x22
mov edi, ebx
cmp ax, word [ebx]
jne 0x100841c1
nop word [eax + eax]
add edi, 2
cmp ax, word [edi]
je 0x100840f0
cmp edi, ebx
je 0x100841c1
mov edx, dword [ebx - 0xc]
sub edi, ebx
sar edi, 1
test edx, edx
js 0x100844e9
mov eax, dword [ebx - 8]
mov ecx, 1
sub ecx, dword [ebx - 4]
sub eax, edx
or eax, ecx
jge 0x10084132
push edx
lea ecx, [ebp - 0x444]
call fcn.10018550
mov ebx, dword [ebp - 0x444]
mov eax, dword [ebx - 0xc]
lea edx, [ebx + edi*2]
sub eax, edi
mov dword [ebp - 0x458], eax
lea ecx, [eax*2 + 2]
test ecx, ecx
je 0x10084196
test edx, edx
jne 0x10084166
call fcn.10153a2d
mov dword [eax], 0x16
call fcn.10153953
mov eax, 0x16
jmp 0x10084198
mov eax, dword [ebx - 0xc]
lea eax, [eax*2 + 2]
cmp eax, ecx
jae 0x1008418b
call fcn.10153a2d
mov dword [eax], 0x22
call fcn.10153953
mov eax, 0x22
jmp 0x10084198
push ecx
push edx
push ebx
call fcn.1014fee0
add esp, 0xc
xor eax, eax
push eax
call fcn.10032c20
mov eax, dword [ebp - 0x458]
add esp, 4
test eax, eax
js 0x100844e9
cmp eax, dword [ebx - 8]
jg 0x100844e9
xor ecx, ecx
mov dword [ebx - 0xc], eax
mov word [ebx + eax*2], cx
push 0xff
lea eax, [ebp - 0x210]
mov dword [ebp - 0x414], 0xff
push 0
push eax
call fcn.10150460
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x414]
add esp, 0xc
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push str.Publisher
push dword [ebp - 0x42c]
call edi
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x440]
call fcn.10018690
push 0xff
lea eax, [ebp - 0x210]
mov dword [ebp - 0x414], 0xff
push 0
push eax
call fcn.10150460
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
push 0
push str.UninstallString
push dword [ebp - 0x42c]
call edi
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x43c]
call fcn.10018690
push 0xff
lea eax, [ebp - 0x210]
mov dword [ebp - 0x414], 0xff
push 0
push eax
call fcn.10150460
mov eax, dword [ebp - 0x44c]
add esp, 0xc
cmp dword [eax - 0xc], 0
je 0x100842da
mov ecx, dword [esi - 0xc]
test ecx, ecx
js 0x100844e9
cmp word [esi], 0x4b
jne 0x100843a3
cmp ecx, 1
jl 0x100844e9
cmp word [esi + 2], 0x42
jne 0x100843a3
mov ecx, dword [ebp - 0x464]
lea eax, [ebp - 0x44c]
push eax
call fcn.10084ae0
mov ebx, dword [ebp - 0x438]
mov edi, dword [ebp - 0x434]
push 0xff
lea eax, [ebp - 0x410]
mov dword [ebp - 0x428], 0xff
push 0
push eax
call fcn.10150460
add esp, 0xc
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x410]
push eax
push edi
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10083f24
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x454]
add edx, 8
mov dword [ebp - 0x454], edx
cmp edx, dword [ebp - 0x45c]
jne 0x10083ec4
mov edx, dword [ebp - 0x424]
mov byte [ebp - 4], 3
test edx, edx
je 0x10084463
mov eax, dword [ebp - 0x41c]
sub eax, edx
sar eax, 3
lea ecx, [eax*8]
mov eax, edx
cmp ecx, 0x1000
jb 0x1008443b
mov edx, dword [edx - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100844e4
jmp 0x1008443b
mov eax, dword [ebp - 0x444]
cmp dword [eax - 0xc], 0
je 0x100842da
mov ebx, dword [ebp - 0x438]
lea eax, [ebp - 0x44c]
push eax
mov edi, dword [ebx + 4]
cmp dword [ebx + 8], edi
je 0x1008442e
mov ecx, edi
mov dword [ebp - 0x458], edi
call fcn.10021820
lea eax, [ebp - 0x448]
mov byte [ebp - 4], 5
push eax
lea ecx, [edi + 4]
call fcn.10021820
lea eax, [ebp - 0x444]
mov byte [ebp - 4], 6
push eax
lea ecx, [edi + 8]
call fcn.10021820
lea eax, [ebp - 0x440]
mov byte [ebp - 4], 7
push eax
lea ecx, [edi + 0xc]
call fcn.10021820
lea eax, [ebp - 0x43c]
mov byte [ebp - 4], 8
push eax
lea ecx, [edi + 0x10]
call fcn.10021820
add dword [ebx + 4], 0x14
mov byte [ebp - 4], 4
jmp 0x100842e0
push edi
mov ecx, ebx
call fcn.10083870
jmp 0x100842e0
push ecx
push edx
call fcn.10127e1e
add esp, 8
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x41c], 0
mov byte [ebp - 4], 2
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1008447f
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x44c]
call fcn.100845a0
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10128191
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10017a40
push 0x80004005
call fcn.10017a40
push 0x80004005
call fcn.10017a40
push 0x80004005
call fcn.10017a40
push 0x80004005
call fcn.10017a40
push 0x80004005
call fcn.10017a40
call fcn.10153963
push 0x80070057
call fcn.10017a40
int3