Function at 0x4667ff
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20bc
call fcn.004d6030
push ebx
push esi
push edi
xor ebx, ebx
push 0x88a
lea eax, [ebp - 0x18b6]
push ebx
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov word [ebp - 0x18b8], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
mov esi, 0x7fe
push esi
lea eax, [ebp - 0x826]
push ebx
push eax
mov word [ebp - 0x828], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x20b6]
push ebx
push eax
mov word [ebp - 0x20b8], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x1026]
push ebx
push eax
mov word [ebp - 0x1028], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x20019
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push dword [ebp + 0xc]
lea eax, [ebp - 8]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], 0x400
call fcn.004017a0
test eax, eax
je 0x4668b8
cmp dword [ebp - 8], ebx
je 0x4668b1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x466aae
lea esi, [ebp - 0x1c]
call fcn.0043fd42
mov eax, esi
push eax
call fcn.004662e0
lea eax, [ebp - 0x24]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x828]
push eax
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x466a6f
cmp dword [ebp - 0xc], 0x400
ja 0x466a4b
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov esi, 0x446
lea eax, [ebp - 0x18b8]
push esi
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov edi, dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
push 0x4da9e4
lea eax, [ebp - 0x18b8]
push esi
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x18b8]
push esi
push eax
call edi
add esp, 0xc
push 0x20019
lea eax, [ebp - 0x18b8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
call fcn.004017a0
test eax, eax
jne 0x466a4b
lea eax, [ebp - 0x828]
push 0x51be18
push eax
call dword [sym.imp.MSVCR80.dll_wcsstr]
cmp eax, ebx
pop ecx
pop ecx
je 0x46698d
movzx eax, word [eax + 4]
cmp ax, 0x30
jb 0x46698d
cmp ax, 0x39
jbe 0x466a4b
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x1c]
call fcn.0046633c
test eax, eax
jne 0x466a4b
push str.ParentDisplayName
lea eax, [ebp - 4]
push eax
lea esi, [ebp - 0xc]
lea edi, [ebp - 0x20b8]
mov dword [ebp - 0xc], 0x400
call fcn.00401739
test eax, eax
je 0x466a4b
push str.DisplayName
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], 0x400
call fcn.00401739
test eax, eax
jne 0x466a4b
cmp dword [ebp - 0xc], 0x104
ja 0x466a4b
cmp dword [ebp - 0xc], ebx
je 0x466a4b
push ebx
push str.DisplayIcon
lea eax, [ebp - 4]
push eax
lea ebx, [ebp - 0x1028]
call fcn.00466da8
test eax, eax
jne 0x466a31
push 1
push str.InstallLocation
lea eax, [ebp - 4]
push eax
call fcn.00466da8
test eax, eax
jne 0x466a31
push eax
push str.UninstallString
lea eax, [ebp - 4]
push eax
call fcn.00466da8
test eax, eax
je 0x466a49
push 1
lea eax, [ebp - 0x1028]
push eax
lea eax, [ebp - 0x828]
push eax
push dword [ebp + 8]
call fcn.00466b23
xor ebx, ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 4], ebx
mov dword [ebp - 0xc], 0x400
je 0x4668c8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
jmp 0x4668c8
cmp dword [ebp - 4], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x466a82
push dword [ebp - 4]
call edi
mov dword [ebp - 4], ebx
cmp dword [ebp - 8], ebx
je 0x466a8f
push dword [ebp - 8]
call edi
mov dword [ebp - 8], ebx
lea esi, [ebp - 0x1c]
call fcn.00467003
cmp dword [ebp - 4], ebx
je 0x466aa1
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], ebx
je 0x466aab
push dword [ebp - 8]
call edi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8