Function at 0x1100f460
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b0
mov eax, dword [0x11064c1c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push str.MSIIsHotfixInstalled_called_n
call fcn.1100bc80
add esp, 4
push esi
lea ecx, [ebp - 0x44c]
call fcn.11022180
lea ecx, [ebp - 0x44c]
mov dword [ebp - fcn.1100e530], vtable.CMSIDllEx.0
call fcn.110221d0
test eax, eax
jne 0x1100f4d7
push str.MSIIsHotfixInstalled:_Error_loading_MSI_dll_n
call fcn.1100bbe0
add esp, 4
lea ecx, [ebp - 0x44c]
call fcn.110221b0
mov eax, 0x643
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110278cd
mov esp, ebp
pop ebp
ret 4
push ebx
push 0x206
xor ebx, ebx
lea ecx, [ebp - 0x20a]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x20c], ax
call fcn.110278e0
add esp, 0xc
lea edx, [ebp - 0x420]
push edx
lea eax, [ebp - 0x20c]
push eax
push str.HOTFIX
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x420], 0x104
call fcn.11022280
cmp eax, ebx
je 0x1100f559
push eax
push str.HOTFIX
push str.GetProp__s__ERROR__d_n
call fcn.1100bc80
add esp, 0xc
lea ecx, [ebp - 0x44c]
call fcn.110221b0
pop ebx
mov eax, 0x643
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110278cd
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x20c]
push ecx
push str.HOTFIX
push str.GetProp__s____s_n
call fcn.1100bc80
add esp, 0xc
push edi
lea edx, [ebp - 0x20c]
push edx
push str.MSIIsHotfixInstalled___Check_for_hotfix__s_n
call fcn.1100bc80
add esp, 8
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 0x410], ebx
mov dword [ebp - 0x418], ebx
mov edi, 0x20019
call fcn.11003750
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
mov eax, dword [ebp - 0x47c]
cmp eax, ebx
mov ebx, dword [ebp - 0x4b0]
jne 0x1100f5cb
push str.IsWow64Process
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1100f634
lea ecx, [ebp - 0x418]
push ecx
push esi
call eax
test eax, eax
je 0x1100f5e7
cmp dword [ebp - 0x418], 0
je 0x1100f5e7
mov edi, 0x20119
lea edx, [ebp - 0x410]
push edx
push edi
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionComponent_Based_ServicingPackages
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1100f63e
cmp ebx, esi
je 0x1100f611
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x44c]
call fcn.110221b0
pop edi
pop ebx
mov eax, 0x643
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110278cd
mov esp, ebp
pop ebp
ret 4
push 0x78
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1100f5e7
mov ecx, dword [ebp - 0x410]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x414]
push eax
push esi
push esi
push esi
push ecx
mov dword [ebp - 0x414], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
je 0x1100f6af
push eax
push str.MSIIsHotfixInstalled:_Error_opening__d_opening_reg_key_n
call fcn.1100bc80
mov edx, dword [ebp - 0x410]
add esp, 8
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
je 0x1100f68c
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x44c]
call fcn.110221b0
pop edi
pop ebx
mov eax, 0x643
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.110278cd
mov esp, ebp
pop ebp
ret 4
push 0x11054704
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x44c]
mov dword [ebp - 0x41c], esi
call fcn.110222b0
push 0x11054704
lea ecx, [ebp - 0x20c]
push ecx
push str.SetProp__s___s__n
call fcn.1100bc80
mov edx, dword [ebp - 0x414]
push edx
push str.MSIIsHotfixInstalled_scan__d_subkeys_n
call fcn.1100bc80
add esp, 0x14
cmp dword [ebp - 0x414], esi
jbe 0x1100f7c7
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, 0x1fe
lea ecx, [ecx]
mov edx, dword [ebp - 0x410]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x40c]
push ecx
push esi
push edx
mov dword [ebp - 0x424], ebx
call edi
test eax, eax
jne 0x1100f777
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x40c]
push ecx
push str.MSIIsHotfixInstalled:_Search__s_for__s_n
call fcn.1100bc80
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x40c]
push eax
call fcn.110298a6
add esp, 0x14
test eax, eax
jne 0x1100f791
inc esi
cmp esi, dword [ebp - 0x414]
jb 0x1100f710
jmp 0x1100f7c1
push eax
push str.MSIIsHotfixInstalled:_Error_opening__d_opening_reg_key_n
call fcn.1100bc80
add esp, 8
mov dword [ebp - 0x41c], 0x643
jmp 0x1100f7c1
push 0x110544cc
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x44c]
call fcn.110222b0
push 0x110544cc
lea edx, [ebp - 0x20c]
push edx
push str.SetProp__s___s__n
call fcn.1100bc80
add esp, 0xc
mov ebx, dword [ebp - 0x4b0]
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1100f7df
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [ebp - 0x44c]
call fcn.110221b0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x41c]
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.110278cd
mov esp, ebp
pop ebp
ret 4