Function at 0x429b90
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c85be
mov eax, dword fs:[0]
push eax
sub esp, 0xadc
mov eax, dword [0x51fee0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0xaac], ebx
mov edi, dword [ebp + 8]
mov dword [ebp - 0xad8], edi
call fcn.0042a890
test al, al
jne 0x429bf6
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, dword [0x521340]
mov ecx, 0x17
lea eax, [esi + 1]
imul eax, esi
cdq
idiv ecx
lea eax, [ecx - 0x16]
mov dword [ebp - 0xabc], 0
mov dword [ebp - 0xab4], 0
mov dword [ebp - 0xab0], 0
mov dword [ebp - 0xac8], 0
mov dword [ebp - 0xad4], 0
cmp edx, eax
jne 0x429c4e
test esi, esi
cmove esi, eax
mov dword [0x521340], esi
lea eax, [esi + 2]
lea ecx, [esi + 1]
imul eax, ecx
imul eax, esi
cdq
mov esi, 0x11
idiv esi
mov dword [ebp - 0xac4], 0x208
cmp edx, 2
jne 0x429c77
inc dword [0x521854]
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.004a8550
mov eax, dword [0x51fab0]
add esp, 0xc
mov ecx, 0x51fab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xad0], eax
mov edx, dword [0x521340]
mov dword [ebp - 4], 0
lea eax, [edx + 2]
lea ecx, [edx + 1]
imul eax, ecx
imul eax, edx
cdq
idiv esi
cmp edx, 5
jne 0x429cde
push 4
call fcn.004a6c5d
mov ecx, dword [0x521340]
add esp, 4
mov dword [eax], ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0xabc]
push ecx
or eax, 0x20019
push eax
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push edi
mov dword [ebp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or edi, 0xffffffff
test eax, eax
je 0x429d22
push eax
lea eax, [ebp - 0xad0]
push str.RegOpenKeyEx_main__x
push eax
call fcn.004060e0
add esp, 0xc
xor bl, bl
jmp 0x42a70e
push 0
push 0
push 0
xor al, al
push 0
mov byte [ebp - 0xaa1], al
lea eax, [ebp - 0xac4]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push dword [ebp - 0xabc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 0x103
je 0x42a6da
mov edi, 4
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
test eax, eax
jne 0x42a555
mov eax, dword [ebx + 0x10]
cmp eax, dword [ebx + 0x14]
je 0x429d95
lea ecx, [ebp - 0x420]
push ecx
push dword [ebx + 0x14]
push eax
call fcn.00429320
add esp, 0xc
cmp eax, dword [ebx + 0x14]
jne 0x42a655
mov edi, dword [ebp - 0xaac]
xor ebx, ebx
mov eax, dword [edi + 0x2c]
sub eax, dword [edi + 0x28]
sar eax, 2
test eax, eax
je 0x429e75
lea eax, [ebp - 0x420]
shr eax, 0x10
mov dword [ebp - 0xab8], eax
lea ecx, [ecx]
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xaa8], esi
cmp dword [ebp - 0xab8], 0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x420]
jne 0x429eb8
movzx edi, ax
push 0
push edi
call fcn.00403bc0
add esp, 8
test eax, eax
je 0x429e12
push edi
push eax
lea ecx, [ebp - 0xaa8]
call fcn.004075c0
mov esi, dword [ebp - 0xaa8]
mov edi, dword [ebp - 0xaac]
mov eax, dword [edi + 0x28]
mov byte [ebp - 4], 0
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x429e44
cmp dword [esi - 0xc], 0
jl 0x429e44
push eax
push esi
call fcn.004a87ef
add esp, 8
test eax, eax
je 0x429e44
sub eax, esi
sar eax, 1
jns 0x42a65e
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x429e5e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 0x2c]
sub eax, dword [edi + 0x28]
inc ebx
sar eax, 2
cmp ebx, eax
jb 0x429dc0
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xac0], eax
mov byte [ebp - 4], 2
test esi, 0xffff0000
jne 0x429eed
movzx esi, si
push 0
push esi
call fcn.00403bc0
add esp, 8
test eax, eax
je 0x429eff
push esi
push eax
lea ecx, [ebp - 0xac0]
call fcn.004075c0
jmp 0x429eff
lea edx, [eax + 2]
jmp 0x429ec0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x429ec0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0xaa8]
call fcn.004097a0
mov esi, dword [ebp - 0xaa8]
jmp 0x429e18
push 0x33
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0xac0]
call fcn.004097a0
mov ecx, dword [0x521340]
mov eax, ecx
imul eax, ecx
imul eax, ecx
cdq
mov ecx, 0x13
idiv ecx
mov byte [ebp - 4], 3
cmp edx, 0xd
jne 0x429f40
mov esi, 1
mov eax, esi
mov edx, 0xa0
lea ebx, [ebx]
dec edx
lea ecx, [eax + esi]
lea esi, [eax]
mov eax, ecx
jns 0x429f30
mov dword [0x521340], ecx
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xaa8], eax
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 4
test eax, 0xffff0000
jne 0x429f88
movzx esi, ax
push 0
push esi
call fcn.00403bc0
add esp, 8
test eax, eax
je 0x429fb3
push esi
push eax
lea ecx, [ebp - 0xaa8]
call fcn.004075c0
jmp 0x429fb3
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x429f91
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0xaa8]
call fcn.004097a0
lea eax, [ebp - 0xaa8]
push eax
lea eax, [ebp - 0xadc]
push 0x4da458
push eax
mov byte [ebp - 4], 5
call fcn.0040b870
add esp, 0xc
mov eax, dword [eax]
lea ecx, [ebp - 0xac0]
push dword [eax - 0xc]
mov byte [ebp - 4], 6
push eax
call fcn.0040b9f0
mov edx, dword [ebp - 0xadc]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42a00d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xaa8]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42a030
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0042a860
test al, al
jne 0x42a0ca
xor eax, eax
mov dword [ebp - 0xaa8], eax
lea esi, [ebp - 0xaa0]
jmp 0x42a050
xor ecx, ecx
mov dword [ebp - 0xacc], ecx
mov dword [ebp - 0xab8], esi
mov edi, edi
mov esi, dword [0x521340]
lea ebx, [ecx + 1]
lea ecx, [eax + 1]
mov eax, esi
cdq
idiv ecx
mov eax, esi
mov ecx, esi
sub ecx, dword [ebp - 0xaa8]
mov esi, dword [ebp - 0xab8]
mov edi, edx
cdq
imul edi, ecx
idiv ebx
add edi, eax
sub edi, dword [ebp - 0xacc]
push edi
push 0x4da4e0
call fcn.004a90ce
mov eax, dword [ebp - 0xaa8]
mov ecx, ebx
add esi, 4
add esp, 8
mov dword [ebp - 0xacc], ecx
mov dword [ebp - 0xab8], esi
cmp ecx, 0x1a
jl 0x42a060
inc eax
mov dword [ebp - 0xaa8], eax
cmp eax, 0x10
jl 0x42a050
or ebx, 0xffffffff
mov edi, dword [ebp - 0xac0]
lea eax, [ebp - 0xab4]
push eax
push dword [ebp + 0xc]
push 0
push edi
push dword [ebp - 0xad8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42a128
push eax
lea eax, [ebp - 0xad0]
push str.RegOpenKeyEx_sub__x
push eax
call fcn.004060e0
add edi, 0xfffffff0
add esp, 0xc
mov byte [ebp - 4], 0
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42a617
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x42a617
mov ebx, dword [ebp - 0xaac]
mov eax, dword [ebx + 0x1c]
cmp eax, dword [ebx + 0x20]
je 0x42a24a
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
mov dword [ebp - 0xab0], 0x208
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xaa8], esi
mov byte [ebp - 4], 7
call fcn.0042a760
test al, al
jne 0x42a18b
push 4
call fcn.004a6c5d
mov ebx, eax
call fcn.004a8009
mov dword [ebx], eax
push ebx
mov dword [0x521340], eax
call fcn.004a6c2e
mov ebx, dword [ebp - 0xaac]
add esp, 8
mov edx, dword [ebp - 0xab0]
shr edx, 1
js 0x42a683
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x42a1bc
push edx
lea ecx, [ebp - 0xaa8]
call fcn.00408680
mov esi, dword [ebp - 0xaa8]
lea eax, [ebp - 0xab0]
push eax
push esi
lea eax, [ebp - 0xac8]
push eax
push 0
push str.DisplayName
push dword [ebp - 0xab4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42a208
push dword [esi - 8]
push esi
call fcn.004a872a
add esp, 8
test eax, eax
js 0x42a683
cmp eax, dword [esi - 8]
jg 0x42a683
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], 0
je 0x42a22c
lea eax, [ebp - 0xaa8]
push eax
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call fcn.00429390
add esp, 0xc
cmp eax, dword [ebx + 0x20]
jne 0x42a68d
add esi, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42a24a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 0x34]
cmp eax, dword [ebx + 0x38]
je 0x42a3b1
mov esi, dword [0x521340]
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
mov ecx, 0xd
idiv ecx
cmp edx, 4
jne 0x42a299
mov eax, 0xe3
mov esi, 0x6c
nop
test esi, esi
je 0x42a291
cdq
idiv esi
mov ecx, esi
mov eax, ecx
mov esi, edx
test ecx, ecx
jne 0x42a280
add esi, eax
mov dword [0x521340], esi
mov eax, esi
imul eax, esi
imul eax, esi
mov dword [ebp - 0xab0], 0x208
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x42a2b7
dec eax
or eax, 0xfffffff8
inc eax
cmp eax, 4
jne 0x42a2d8
mov esi, 1
mov eax, esi
mov edx, 0x17
dec edx
lea ecx, [eax + esi]
lea esi, [eax]
mov eax, ecx
jns 0x42a2c8
mov dword [0x521340], ecx
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xaa8], esi
mov edx, dword [ebp - 0xab0]
shr edx, 1
mov byte [ebp - 4], 8
js 0x42a683
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x42a323
push edx
lea ecx, [ebp - 0xaa8]
call fcn.00408680
mov esi, dword [ebp - 0xaa8]
lea eax, [ebp - 0xab0]
push eax
push esi
lea eax, [ebp - 0xac8]
push eax
push 0
push str.Publisher
push dword [ebp - 0xab4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42a36f
push dword [esi - 8]
push esi
call fcn.004a872a
add esp, 8
test eax, eax
js 0x42a683
cmp eax, dword [esi - 8]
jg 0x42a683
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], 0
je 0x42a393
lea eax, [ebp - 0xaa8]
push eax
push dword [ebx + 0x38]
push dword [ebx + 0x34]
call fcn.00429390
add esp, 0xc
cmp eax, dword [ebx + 0x38]
jne 0x42a68d
add esi, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42a3b1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 0x40]
cmp eax, dword [ebx + 0x44]
je 0x42a4de
mov eax, dword [0x51fab0]
mov ecx, 0x51fab0
mov dword [ebp - 0xab0], 0x208
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0xab8], esi
mov edx, dword [ebp - 0xab0]
shr edx, 1
mov byte [ebp - 4], 9
js 0x42a683
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x42a412
push edx
lea ecx, [ebp - 0xab8]
call fcn.00408680
mov esi, dword [ebp - 0xab8]
lea eax, [ebp - 0xab0]
push eax
push esi
lea eax, [ebp - 0xac8]
push eax
push 0
push str.InstallLocation
push dword [ebp - 0xab4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x42a45e
push dword [esi - 8]
push esi
call fcn.004a872a
add esp, 8
test eax, eax
js 0x42a683
cmp eax, dword [esi - 8]
jg 0x42a683
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], 0
je 0x42a4bc
mov ecx, dword [ebp - 0xaac]
xor ebx, ebx
mov eax, dword [ecx + 0x44]
sub eax, dword [ecx + 0x40]
sar eax, 2
test eax, eax
je 0x42a4bc
lea esp, [esp]
mov eax, dword [ecx + 0x40]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x42a4ae
cmp dword [esi - 0xc], 0
jl 0x42a4ae
push eax
push esi
call fcn.004a87ef
add esp, 8
test eax, eax
je 0x42a4a8
sub eax, esi
sar eax, 1
jns 0x42a68d
mov ecx, dword [ebp - 0xaac]
mov eax, dword [ecx + 0x44]
sub eax, dword [ecx + 0x40]
inc ebx
sar eax, 2
cmp ebx, eax
jb 0x42a480
add esi, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 3
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42a4e1
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x42a4e1
or ebx, 0xffffffff
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0x42a4fc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xab4], 0
mov eax, dword [0x521340]
imul eax, eax
and eax, reloc.OLEAUT32.dll_VariantInit
jns 0x42a510
dec eax
or eax, 0xfffffff8
inc eax
cmp eax, 7
jne 0x42a533
push 4
call fcn.004a6c5d
mov esi, eax
call fcn.004a8009
mov dword [esi], eax
push esi
mov dword [0x521340], eax
call fcn.004a6c2e
add esp, 8
add edi, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42a550
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, 4
inc dword [ebp - 0xad4]
call fcn.0042a7e0
test al, al
jne 0x42a5ab
mov al, byte [0x4dcdac]
movq xmm0, qword [str.N4Q0PTVj]
mov byte [ebp - 0xae0], al
lea eax, [ebp - 0xae8]
movq qword [ebp - 0xae8], xmm0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a588
xor ecx, ecx
sub eax, edx
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004a63b0
push eax
call fcn.004a8200
add esp, 8
mov dword [ebp - 0xac4], 0x208
call fcn.0042a830
test al, al
jne 0x42a5c4
inc dword [0x521340]
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004a8550
add esp, 0xc
call fcn.0042a810
test al, al
jne 0x42a617
push 0x28
call fcn.004a63b0
add esp, 4
mov edi, eax
xor esi, esi
call fcn.004a8009
add eax, dword [0x521340]
inc esi
mov dword [edi + esi*4 - 4], eax
cmp esi, 0xa
jl 0x42a5f1
mov eax, dword [edi + 0x24]
push edi
mov dword [0x521340], eax
call fcn.004a8200
add esp, 4
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xac4]
push eax
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0xad4]
push dword [ebp - 0xabc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x42a6d1
mov ebx, dword [ebp - 0xaac]
jmp 0x429d5f
mov byte [ebp - 0xaa1], 1
jmp 0x42a6d1
add esi, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 0xaa1], 1
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42a6d4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x42a6d4
push 0x80070057
call fcn.004044c0
add esi, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 0xaa1], 1
mov byte [ebp - 4], 3
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42a6b4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42a6d1
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
or edi, 0xffffffff
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xab4]
test eax, eax
je 0x42a6f1
push eax
call esi
mov dword [ebp - 0xab4], 0
mov eax, dword [ebp - 0xabc]
test eax, eax
je 0x42a708
push eax
call esi
mov dword [ebp - 0xabc], 0
mov bl, byte [ebp - 0xaa1]
mov esi, dword [ebp - 0xad0]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x42a732
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a7434
mov esp, ebp
pop ebp
ret 8