Function at 0x47d800
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a1d7d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x4264
call fcn.0048e930
mov eax, dword [0x4e3ec8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
lea ecx, [ebp - 0x4220]
mov dword [ebp - 4], edi
mov byte [ebp - 0x4219], 0
call dword [sym.imp.mfc100.dll_Ordinal_316]
lea ecx, [ebp - 0x4224]
call dword [sym.imp.mfc100.dll_Ordinal_316]
mov bl, 3
lea ecx, [ebp + 8]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc100.dll_Ordinal_13125]
lea ecx, [ebp - 0x4224]
cmp dword [ebp + 0xc], edi
jne 0x47d87a
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
jmp 0x47d87f
push str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall
call dword [sym.imp.mfc100.dll_Ordinal_1316]
cmp byte [ebp + 0x14], 0
je 0x47d91d
lea eax, [ebp - 0x4228]
push eax
push 0x20119
push edi
lea ecx, [ebp - 0x4224]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x47d9a7
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x423c], esp
push 0x4af974
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
mov ecx, esp
mov dword [ebp - 0x422c], esp
push str.Utils_checkIfApplicationInstalled_for_current_user_enable_to_open_Registry_file
mov byte [ebp - 4], 4
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
lea ecx, [ebp - 0x4224]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x4220]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_901]
xor al, al
jmp 0x47dd1d
lea ecx, [ebp - 0x4228]
push ecx
push 0x20119
push edi
lea ecx, [ebp - 0x4224]
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x47d9a7
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x423c], esp
push 0x4af974
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
mov ecx, esp
mov dword [ebp - 0x422c], esp
push str.Utils_checkIfApplicationInstalled_enable_to_open_Registry_file
mov byte [ebp - 4], 5
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], bl
call fcn.0047c140
add esp, 0xc
lea ecx, [ebp - 0x4224]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x4220]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_901]
xor al, al
jmp 0x47dd1d
push 0x103
lea edx, [ebp - 0x117]
push edi
push edx
mov byte [ebp - 0x118], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
push str.DisplayName
lea ecx, [ebp - 0x4240]
mov dword [ebp - 0x4244], 0x104
mov dword [ebp - 0x4238], edi
call dword [sym.imp.mfc100.dll_Ordinal_310]
push str.Publisher
lea ecx, [ebp - 0x4248]
mov byte [ebp - 4], 6
call dword [sym.imp.mfc100.dll_Ordinal_310]
lea eax, [ebp - 0x425c]
push eax
lea ecx, [ebp - 0x4260]
push ecx
lea edx, [ebp - 0x4250]
push edx
lea eax, [ebp - 0x4270]
push eax
lea ecx, [ebp - 0x4264]
push ecx
lea edx, [ebp - 0x426c]
push edx
lea eax, [ebp - 0x4274]
push eax
lea ecx, [ebp - 0x4238]
push ecx
mov ecx, dword [ebp - 0x4228]
push edi
lea edx, [ebp - 0x4244]
push edx
lea eax, [ebp - 0x118]
push eax
push ecx
mov byte [ebp - 4], 7
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, edi
jne 0x47dc97
cmp dword [ebp - 0x4238], edi
je 0x47db8a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x47da70
cmp edi, dword [ebp - 0x4238]
jae 0x47db8a
lea edx, [ebp - 0x425c]
push edx
mov edx, dword [ebp - 0x4228]
push 0
push 0
push 0
lea eax, [ebp - 0x424c]
push eax
lea ecx, [ebp - 0x218]
push ecx
push edi
push edx
mov dword [ebp - 0x424c], 0xff
call ebx
test eax, eax
jne 0x47dc58
mov edx, dword [ebp - 0x4228]
lea eax, [ebp - 0x422c]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x218]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47dc91
lea eax, [ebp - 0x423c]
push eax
lea ecx, [ebp - 0x4218]
push ecx
lea edx, [ebp - 0x4268]
push edx
push 0
lea ecx, [ebp - 0x4240]
mov dword [ebp - 0x423c], 0x3fff
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
mov eax, dword [ebp - 0x422c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x4218]
push ecx
lea ecx, [ebp - 0x4220]
mov esi, eax
call dword [sym.imp.mfc100.dll_Ordinal_1316]
test esi, esi
jne 0x47dc0c
lea ecx, [ebp - 0x4220]
call dword [sym.imp.mfc100.dll_Ordinal_13125]
cmp byte [ebp + 0x10], 0
je 0x47db9c
mov ecx, eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_2611]
test eax, eax
je 0x47db83
push esi
push str.Adobe_Reader
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x47dbae
push esi
push str.11.0.10
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x47dbae
mov byte [ebp - 0x4219], 1
mov ecx, dword [ebp - 0x4228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47dcde
push 0
lea ecx, [ebp + 8]
mov esi, eax
call dword [sym.imp.mfc100.dll_Ordinal_1448]
push eax
mov ecx, esi
jmp 0x47db79
lea ecx, [ebp - 0x4220]
call dword [sym.imp.mfc100.dll_Ordinal_13125]
push eax
lea edx, [ebp + 8]
push edx
call fcn.0040d1c0
add esp, 8
test al, al
jne 0x47db83
push 0
push str.Adobe_Reader
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x47dc45
push 0
push str.11.0.10
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_4144]
test eax, eax
js 0x47dc45
mov ecx, dword [ebp - 0x4228]
push ecx
mov byte [ebp - 0x4219], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47dcde
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x4234], esp
push 0x4ae26b
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
mov ecx, esp
mov dword [ebp - 0x4230], esp
push str.Error_in_Display_key
mov byte [ebp - 4], 8
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 7
call fcn.0047c140
add esp, 0xc
mov eax, dword [ebp - 0x422c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
jmp 0x47da70
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x4230], esp
push 0x4ae26b
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
mov ecx, esp
mov dword [ebp - 0x4234], esp
push str.Error_in_Enumeration_the_subkeys_retCode
mov byte [ebp - 4], 9
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 7
call fcn.0047c140
add esp, 0xc
inc edi
jmp 0x47da70
mov edx, dword [ebp - 0x4228]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xffffffffffffffff
push ecx
mov ecx, esp
mov dword [ebp - 0x4230], esp
push 0x4af974
call dword [sym.imp.mfc100.dll_Ordinal_310]
push ecx
mov ecx, esp
mov dword [ebp - 0x4234], esp
push str.utils_checkIfApplicationInstalled_enable_to_open_Registry_file
mov byte [ebp - 4], 0xa
call dword [sym.imp.mfc100.dll_Ordinal_310]
mov byte [ebp - 4], 7
call fcn.0047c140
add esp, 0xc
lea ecx, [ebp - 0x4248]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x4240]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x4224]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp - 0x4220]
call dword [sym.imp.mfc100.dll_Ordinal_901]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc100.dll_Ordinal_901]
mov al, byte [ebp - 0x4219]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0048e770
mov esp, ebp
pop ebp
ret