Function at 0x4361b0
Capabilities:
Get installed programs

Disassembly:
push 0xffffffffffffffff
push 0x4d597e
mov eax, dword fs:[0]
push eax
sub esp, 0x63c
mov eax, dword [0x54d158]
xor eax, esp
mov dword [esp + 0x638], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x54d158]
xor eax, esp
push eax
lea eax, [esp + 0x650]
mov dword fs:[0], eax
mov eax, dword [esp + 0x660]
xor ebx, ebx
mov esi, ecx
mov dword [esp + 0x44], eax
mov edi, edx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x1c], vtable.Cy_Registry.0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x658], ebx
mov eax, dword [edi]
sub eax, 0x10
push eax
call fcn.0040ff10
lea ebp, [eax + 0x10]
add esp, 4
mov dword [esp + 0x30], ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [esp + 0x2c]
mov byte [esp + 0x65c], 1
call fcn.00410140
mov byte [esp + 0x658], 2
mov eax, dword [ebp - 0xc]
push eax
push ebp
lea ecx, [esp + 0x30]
call fcn.0040ee60
add esi, 0xa8
push esi
lea ecx, [esp + 0x38]
push ecx
call fcn.0042ba80
mov byte [esp + 0x658], 3
mov eax, dword [esp + 0x34]
mov ecx, 0x5202d4
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x43629c
cmp dx, bx
je 0x436298
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x43629c
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x436276
xor eax, eax
jmp 0x4362a1
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x436465
mov eax, dword [esp + 0x24]
cmp eax, ebx
mov esi, dword [esp + 0x28]
mov edi, dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4362e0
push eax
call edi
mov edx, dword [esp + 0x24]
push edx
call ebp
xor ecx, ecx
cmp eax, ebx
sete cl
mov dword [esp + 0x24], ebx
mov eax, ecx
cmp eax, ebx
jne 0x4362e0
xor esi, esi
jmp 0x436300
lea edx, [esp + 0x24]
push edx
push 0x20019
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
cmp eax, ebx
sete cl
mov esi, ecx
call fcn.004a08e6
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x43631a
push 0x80004005
call fcn.004103e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
cmp esi, 1
mov byte [esp + 0x658], 4
jne 0x436391
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x60]
push edx
push str.DisplayVersion
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x3c], 0x104
call fcn.0042acc0
cmp eax, esi
jne 0x436372
cmp dword [esp + 0x2c], ebx
jbe 0x436372
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x18]
call fcn.00410090
jmp 0x43637b
lea ecx, [esp + 0x14]
call fcn.00410250
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x436391
push eax
call edi
mov edx, dword [esp + 0x24]
push edx
call ebp
mov dword [esp + 0x24], ebx
mov esi, dword [esp + 0x14]
add esi, 0xfffffff0
push esi
call fcn.0040ff10
mov ecx, dword [esp + 0x48]
add eax, 0x10
mov dword [ecx], eax
add esp, 4
mov byte [esp + 0x658], 3
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4363cb
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov byte [esp + 0x658], 2
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4363f3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x658], 1
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43641b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x658], bl
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436442
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
cmp eax, ebx
mov dword [esp + 0x1c], vtable.Cy_Registry.0
je 0x43645c
push eax
call edi
mov ecx, dword [esp + 0x24]
push ecx
call ebp
mov eax, dword [esp + 0x44]
jmp 0x436a05
mov edx, dword [edi]
mov eax, dword [edx - 0xc]
xor esi, esi
cmp eax, ebx
jle 0x4364c3
mov eax, dword [esp + 0x24]
cmp eax, ebx
mov esi, dword [esp + 0x28]
je 0x4364a3
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp eax, ebx
sete cl
mov dword [esp + 0x24], ebx
mov eax, ecx
cmp eax, ebx
jne 0x4364a3
xor esi, esi
jmp 0x4364c3
lea edx, [esp + 0x24]
push edx
push 0x20019
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
cmp eax, ebx
sete cl
mov esi, ecx
call fcn.004a08e6
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4364dd
push 0x80004005
call fcn.004103e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
cmp esi, 1
mov byte [esp + 0x658], 5
jne 0x436570
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x60]
push edx
push str.DisplayVersion
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x24], 0x104
call fcn.0042acc0
cmp eax, esi
jne 0x436549
cmp dword [esp + 0x14], ebx
jbe 0x436549
lea ecx, [esp + 0x5c]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00410090
push 0x51c598
push 0x51ed18
lea edx, [esp + 0x20]
push edx
call fcn.004312b0
jmp 0x436552
lea ecx, [esp + 0x18]
call fcn.00410250
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x436570
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], 1
jge 0x436934
push str.0239FCE5_88CF_48e9_912D_90DAFC25E38B
lea ecx, [esp + 0x34]
call fcn.00410090
push edi
lea eax, [esp + 0x34]
call fcn.0040ddc0
mov esi, dword [esp + 0x34]
add esp, 4
test al, al
je 0x436662
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [esp + 0x2c]
call fcn.00410090
mov eax, dword [esi - 0xc]
push eax
push esi
lea ecx, [esp + 0x30]
call fcn.0040ee60
mov eax, dword [esp + 0x24]
cmp eax, ebx
mov esi, dword [esp + 0x28]
je 0x4365f0
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp + 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp eax, ebx
sete cl
mov dword [esp + 0x24], ebx
mov eax, ecx
cmp eax, ebx
je 0x436662
lea edx, [esp + 0x24]
push edx
push 0x20019
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x436662
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x60]
push ecx
push str.DisplayVersion
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x24], 0x104
call fcn.0042acc0
cmp eax, 1
jne 0x436659
cmp dword [esp + 0x14], ebx
jbe 0x436659
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x1c]
call fcn.00410090
push 0x51c598
push 0x51ed18
lea ecx, [esp + 0x20]
push ecx
call fcn.004312b0
lea esi, [esp + 0x1c]
call fcn.0042ac90
call fcn.004a08e6
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x43667c
push 0x80004005
call fcn.004103e0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
mov dword [esp + 0x38], vtable.Cy_Registry.0
mov dword [esp + 0x40], ebx
lea ecx, [esp + 0x40]
push ecx
push 0x20019
push ebx
push str.SoftwareTOBESOFTXPlatform
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x66c], 7
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4368e6
lea edx, [esp + 0x38]
push edx
call fcn.0042b200
xor ebp, ebp
cmp eax, ebx
mov dword [esp + 0x54], eax
jle 0x4368c4
jmp 0x4366e0
push 0x51cd44
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push ebp
lea edi, [esp + 0x268]
lea esi, [esp + 0x3c]
call fcn.0042b240
mov eax, edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x436710
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x268]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0040fe70
call fcn.004a08e6
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
je 0x436310
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x2c], eax
push 0x1b
push str.SoftwareTOBESOFTXPlatform
lea ecx, [esp + 0x34]
mov byte [esp + 0x660], 8
call fcn.0040fe70
push 0x52075c
lea esi, [esp + 0x30]
call fcn.0040da40
lea eax, [esp + 0x264]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x436785
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x268]
push ecx
lea ecx, [esp + 0x34]
call fcn.0040ee60
mov edi, vtable.Cy_Registry.0
mov dword [esp + 0x48], edi
mov dword [esp + 0x50], ebx
lea edx, [esp + 0x50]
push edx
push 0x20019
mov byte [esp + 0x660], 9
mov esi, dword [esp + 0x34]
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x436843
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x60]
push ecx
push str.Version
lea edx, [esp + 0x54]
push edx
mov dword [esp + 0x68], 0x104
call fcn.0042acc0
test eax, eax
je 0x436821
lea eax, [esp + 0x5c]
push eax
lea ecx, [esp + 0x18]
call fcn.00410090
push 0x51c598
push 0x51ed18
lea ecx, [esp + 0x1c]
push ecx
call fcn.004312b0
mov eax, dword [esp + 0x50]
cmp eax, ebx
je 0x436847
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp + 0x50]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x50], eax
jmp 0x436847
mov eax, dword [esp + 0x50]
cmp eax, ebx
mov dword [esp + 0x48], edi
je 0x436865
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [esp + 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x50], ebx
lea eax, [esi - 0x10]
mov byte [esp + 0x658], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436889
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x14]
cmp dword [edi - 0xc], ebx
jle 0x4368b7
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], ebx
jle 0x4368a9
push 0x521680
lea esi, [esp + 0x1c]
call fcn.0040da40
mov eax, dword [edi - 0xc]
push eax
push edi
lea ecx, [esp + 0x20]
call fcn.0040ee60
add ebp, 1
cmp ebp, dword [esp + 0x54]
jl 0x4366e0
mov eax, dword [esp + 0x40]
cmp eax, ebx
je 0x4368ea
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp + 0x40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x40], eax
jmp 0x4368ea
mov eax, dword [esp + 0x40]
cmp eax, ebx
mov dword [esp + 0x38], vtable.Cy_Registry.0
je 0x43690c
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x40], ebx
lea eax, [edi - 0x10]
mov byte [esp + 0x658], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436930
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebp, dword [esp + 0x30]
mov esi, dword [esp + 0x18]
add esi, 0xfffffff0
push esi
call fcn.0040ff10
mov edi, dword [esp + 0x48]
add eax, 0x10
add esp, 4
mov dword [edi], eax
mov byte [esp + 0x658], 3
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43696e
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov byte [esp + 0x658], 2
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x436996
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x658], 1
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4369be
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov byte [esp + 0x658], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4369e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x24]
cmp eax, ebx
mov dword [esp + 0x1c], vtable.Cy_Registry.0
je 0x436a03
push eax
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [esp + 0x650]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x638]
xor ecx, esp
call fcn.004ac89d
add esp, 0x648
ret 4