Function at 0x42342c
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x384
mov eax, 0x457c8c
call fcn.00446f9b
mov esi, ecx
mov eax, dword [esi + 0x1c]
xor ebx, ebx
mov dword [ebp - 0x248], esi
cmp eax, ebx
je 0x423453
mov edi, esi
call fcn.00423c6c
lea eax, [ebp - 0x390]
push eax
call fcn.0041c1a5
add esi, 0x20
lea edi, [ebp - 0x378]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x21c], esi
call fcn.0040a515
lea eax, [ebp - 0x234]
call fcn.0041f95a
mov dword [ebp - 0x228], ebx
mov eax, dword [ebp - 0x228]
cmp eax, 2
jge 0x423956
sub eax, ebx
je 0x4234a7
dec eax
jne 0x4234b4
push 2
jmp 0x4234a9
push 1
lea esi, [ebp - 0x234]
call fcn.0041f96e
mov eax, dword [ebp - 0x234]
mov dword [edi + 0x44], eax
mov eax, dword [ebp - 0x230]
push 1
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov ecx, edi
mov dword [edi + 0x48], eax
call fcn.0041ffba
mov esi, dword [ebp - 0x21c]
push eax
call fcn.0040a79c
mov eax, esi
call fcn.0040a7ac
test al, al
jne 0x42394b
xor eax, eax
push 0x1fe
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
call fcn.00444550
mov eax, dword [edi + 4]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x224]
push ecx
lea ecx, [ebp - 0x218]
push ecx
push ebx
push eax
mov dword [ebp - 0x224], pe_nt_image_headers32
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x24c], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
call fcn.0040a783
mov eax, dword [ebp - 0x21c]
call fcn.0040a7ac
test al, al
jne 0x42394b
mov edi, 0x47aa78
push edi
lea ecx, [ebp - 0x220]
call fcn.00402325
lea eax, [ebp - 0x218]
push eax
push str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea eax, [ebp - 0x220]
push 0x467424
push eax
mov byte [ebp - 4], 1
call fcn.00402b47
add esp, 0x10
lea eax, [ebp - 0x318]
push eax
call fcn.0041fc2e
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x234]
push 1
push dword [ebp - 0x220]
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x318]
mov dword [ebp - 0x2d0], eax
call fcn.0041ffba
mov esi, dword [ebp - 0x21c]
push eax
call fcn.0040a79c
mov eax, esi
call fcn.0040a7ac
test al, al
jne 0x4238c7
push str.DisplayName
lea eax, [ebp - 0x318]
call fcn.00420078
mov ebx, eax
call fcn.0041fae6
push eax
lea ecx, [ebp - 0x260]
call fcn.00415bf3
push 8
pop eax
mov byte [ebp - 4], 3
cmp ax, word [ebp - 0x260]
jne 0x4238b2
cmp dword [ebp - 0x258], 0
je 0x4238b2
push str.Publisher
lea eax, [ebp - 0x318]
call fcn.00420078
mov ebx, eax
call fcn.0041fae6
push eax
lea ecx, [ebp - 0x280]
call fcn.00415bf3
push str.DisplayVersion
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 4
call fcn.00420078
mov ebx, eax
call fcn.0041fae6
push eax
lea ecx, [ebp - 0x270]
call fcn.00415bf3
push str.InstallDate
lea eax, [ebp - 0x318]
mov byte [ebp - 4], 5
call fcn.00420078
mov ebx, eax
call fcn.0041fae6
push eax
lea ecx, [ebp - 0x2a8]
call fcn.00415bf3
push edi
lea ecx, [ebp - 0x244]
mov byte [ebp - 4], 6
call fcn.00402325
push edi
lea ecx, [ebp - 0x240]
call fcn.00402325
push edi
lea ecx, [ebp - 0x23c]
call fcn.00402325
and dword [ebp - 0x238], 0
push 8
pop eax
mov byte [ebp - 4], 7
cmp ax, word [ebp - 0x260]
jne 0x4236e8
push dword [ebp - 0x258]
lea ecx, [ebp - 0x244]
call fcn.0040257f
mov eax, dword [ebp - 0x244]
cmp dword [eax - 0xc], 0
je 0x4237fd
push 8
pop eax
cmp ax, word [ebp - 0x280]
jne 0x423715
push dword [ebp - 0x278]
lea ecx, [ebp - 0x240]
call fcn.0040257f
push 8
pop eax
cmp ax, word [ebp - 0x270]
jne 0x423732
push dword [ebp - 0x268]
lea ecx, [ebp - 0x23c]
call fcn.0040257f
lea eax, [ebp - 0x244]
push eax
lea esi, [ebp - 0x2a8]
call fcn.00423276
sub esp, 0x10
mov byte [ebp - 4], 8
mov eax, esp
mov dword [ebp - 0x2b0], esp
push eax
lea edi, [ebp - 0x244]
call fcn.00423975
push ecx
mov byte [ebp - 4], 9
mov ecx, esp
mov dword [ebp - 0x2ac], esp
push dword [ebp - 0x244]
call fcn.00401db9
lea eax, [ebp - 0x2c4]
push eax
mov byte [ebp - 4], 8
call fcn.004243a3
add esp, 0x18
mov esi, eax
push esi
lea ecx, [ebp - 0x294]
mov byte [ebp - 4], 0xa
call fcn.0040234a
lea eax, [ebp - 0x290]
lea edi, [esi + 4]
push eax
mov byte [ebp - 4], 0xb
call fcn.00423975
mov ebx, dword [ebp - 0x248]
lea eax, [ebp - 0x294]
push eax
lea edi, [ebp - 0x324]
mov byte [ebp - 4], 0xc
call fcn.00423bb1
lea esi, [ebp - 0x290]
call fcn.00423256
mov ecx, dword [ebp - 0x294]
add ecx, 0xfffffff0
call fcn.004034fb
lea esi, [ebp - 0x2c0]
call fcn.00423256
mov ecx, dword [ebp - 0x2c4]
add ecx, 0xfffffff0
call fcn.004034fb
lea esi, [ebp - 0x244]
mov dword [ebp - 4], 7
call fcn.00423256
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x2a8]
push eax
call esi
lea eax, [ebp - 0x270]
push eax
call esi
lea eax, [ebp - 0x280]
push eax
call esi
jmp 0x4238b8
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x390]
push eax
call fcn.0041c1d0
mov eax, edi
call fcn.00446ff7
ret
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x260]
push eax
mov byte [ebp - 4], 2
call esi
xor ebx, ebx
mov eax, dword [ebp - 0x224]
add eax, eax
push eax
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00444550
add esp, 0xc
inc dword [ebp - 0x22c]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x22c]
mov dword [ebp - 0x224], pe_nt_image_headers32
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, dword [ebp - 0x21c]
call fcn.0040a783
lea eax, [ebp - 0x318]
push eax
mov byte [ebp - 4], 1
call fcn.0041fc8d
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.004034fb
mov edi, dword [ebp - 0x250]
jmp 0x423545
inc dword [ebp - 0x228]
jmp 0x42348d
mov edi, dword [ebp - 0x248]
cmp dword [edi + 0x2c], 0x103
jne 0x42396d
lea esi, [edi + 0x20]
call fcn.0040a515
mov edi, dword [edi + 0x30]
jmp 0x42389a