Function at 0x436a34
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x580014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
or dword [ebp - 0x218], 0xffffffff
or dword [ebp - 0x214], 0xffffffff
or dword [ebp - 0x21c], 0xffffffff
push ebx
xor ebx, ebx
mov dword [ebp - 0x23c], ecx
mov ecx, ebx
mov dword [ebp - 0x250], edx
and dword [ebp - 0x234], ecx
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], 4
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x22c], ebx
test eax, eax
je 0x436aa8
mov dword [eax], 1
test edx, edx
je 0x436edd
push esi
push edi
inc ecx
mov dword [ebp - 0x230], ecx
cmp ecx, 1
jne 0x436aca
mov edi, 0x533098
mov esi, str._T_d__s:_Retrieving_list_of_MultiMsi_Package_codes_under_HKCU_ARP_Uninstall_regkey_for_Product__s
jmp 0x436ad9
cmp ecx, 2
jne 0x436b47
mov edi, 0x531ff8
mov esi, str._T_d__s:_Retrieving_list_of_MultiMsi_Package_codes_under_HKLM_ARP_Uninstall_regkey_for_Product__s
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push dword [ebp - 0x23c]
push str.GetMultiMsiPackageCodes
push eax
push esi
call fcn.00434510
add esp, 0x10
cmp dword [ebp - 0x218], 0xffffffff
je 0x436b10
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 0x218], 0xffffffff
lea eax, [ebp - 0x218]
push eax
push 1
push edi
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_10937]
test eax, eax
je 0x436b52
push eax
push str.GetMultiMsiPackageCodes
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._T_d__s:_Failed_to_open_ARP_Uninstall_regkey__dwError_d
call fcn.00434510
add esp, 0x10
mov ecx, dword [ebp - 0x230]
cmp ecx, 2
jbe 0x436ab2
jmp 0x436e91
push 0x105
lea eax, [ebp - 0x210]
mov dword [ebp - 0x248], 1
push eax
push 0
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x436b3e
cmp dword [ebp - 0x214], 0xffffffff
je 0x436b96
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 0x214], 0xffffffff
and dword [ebp - 0x220], 0
lea eax, [ebp - 0x214]
mov esi, dword [ebp - 0x218]
push eax
push 0x20019
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_11315]
push eax
push 0
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x436e64
lea eax, [ebp - 0x220]
push eax
push 0
lea eax, [ebp - 0x224]
push eax
push 0
push str.ProductCodes
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x436e64
test ebx, ebx
jne 0x436c14
push ebx
push dword [ebp - 0x220]
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_30827]
mov ebx, eax
mov dword [ebp - 0x228], eax
jmp 0x436c3e
push dword [ebp - 0x220]
lea eax, [ebp - 0x238]
mov dword [ebp - 0x238], ebx
push eax
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_33064]
xor ebx, ebx
test al, al
cmovne ebx, dword [ebp - 0x238]
mov dword [ebp - 0x228], ebx
lea eax, [ebp - 0x220]
push eax
push ebx
lea eax, [ebp - 0x224]
push eax
push 0
push str.ProductCodes
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x436e64
cmp dword [ebp - 0x224], 7
jne 0x436e64
mov edi, ebx
xor bl, bl
cmp dword [ebp - 0x228], eax
je 0x436e5e
movzx esi, word [edi]
xor eax, eax
cmp ax, si
je 0x436e07
mov ecx, edi
call fcn.00407279
cmp eax, 0x26
jne 0x436de4
cmp esi, 0x7b
jne 0x436de4
cmp word [edi + 0x4a], 0x7d
jne 0x436de4
push edi
push dword [ebp - 0x23c]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x436dcf
cmp dword [ebp - 0x22c], 1
jbe 0x436cfc
push edi
push str.GetMultiMsiPackageCodes
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._T_d__s:_Found_more_than_one_MultiMsi_Product_with_same_Global_ProductCode:__s
call fcn.00434510
add esp, 0x10
push 0x3ca691
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_30245]
cmp dword [ebp - 0x21c], 0xffffffff
je 0x436d18
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 0x21c], 0xffffffff
mov ebx, dword [ebp - 0x24c]
test ebx, ebx
je 0x436dc7
mov esi, dword [ebp - 0x214]
lea eax, [ebp - 0x21c]
push eax
push 0x20019
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_11315]
push eax
push 0
push str.Managed
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x436dc7
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push str.FeaturesAligned
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x436d99
cmp dword [ebp - 0x224], 4
jne 0x436d99
cmp dword [ebp - 0x240], 4
jne 0x436d99
mov esi, dword [ebp - 0x244]
mov dword [ebx], esi
jmp 0x436d9e
and dword [ebx], 0
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edx, str.not
test esi, esi
mov ecx, 0x52c134
cmovne ecx, edx
push ecx
push str.GetMultiMsiPackageCodes
push eax
push str._T_d__s:_Product_is_managed_via_DeployCA__Feature_Option_Alignment_has__sbeen_performed.
call fcn.00434510
add esp, 0x10
inc dword [ebp - 0x22c]
mov bl, 1
mov ecx, edi
call fcn.00407279
lea edi, [edi + eax*2]
add edi, 2
jne 0x436c85
jmp 0x436e07
lea eax, [ebp - 0x210]
push eax
push edi
push str.GetMultiMsiPackageCodes
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._T_d__s:_Found_at_least_one_invalid_packagecode__s__skipping_ARP_entry_for_:_s
call fcn.00434510
add esp, 0x14
xor bl, bl
test bl, bl
mov ebx, dword [ebp - 0x228]
je 0x436e64
mov esi, ebx
xor eax, eax
cmp ax, word [esi]
je 0x436e64
mov ecx, esi
call fcn.00407279
push 0
push eax
push esi
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_26719]
mov dword [ebp - 0x234], eax
test eax, eax
je 0x436e91
lea eax, [ebp - 0x234]
push eax
push dword [ebp - 0x250]
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_15222]
cmp eax, 0xffffffff
je 0x436e85
mov ecx, esi
call fcn.00407279
lea esi, [esi + eax*2]
add esi, 2
jne 0x436e13
jmp 0x436e64
mov ebx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x248]
lea ecx, [ebp - 0x210]
push 0x105
mov eax, esi
inc esi
push ecx
mov dword [ebp - 0x248], esi
push eax
jmp 0x436b6a
push dword [ebp - 0x234]
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_5751]
cmp dword [ebp - 0x214], 0xffffffff
pop edi
pop esi
je 0x436ea8
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x21c], 0xffffffff
je 0x436ebd
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x218], 0xffffffff
je 0x436ed2
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x436edd
push ebx
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_5751]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0051a430
leave
ret 4