Function at 0x428f40
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c740e
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x51eee0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x42c], ebx
mov eax, dword [0x520340]
imul eax, eax
cdq
mov ecx, 0x17
idiv ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x458], esi
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x450], 0
mov dword [ebp - 0x44c], 0x208
cmp edx, 0x14
jne 0x428fd6
inc dword [0x5208cc]
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
call fcn.004a7560
mov eax, dword [0x51eab0]
add esp, 0xc
mov ecx, 0x51eab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x448], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x440]
push ecx
or eax, 0x20019
push eax
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push esi
mov dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
or edi, 0xffffffff
test esi, esi
je 0x429082
call fcn.00429a10
test al, al
jne 0x429066
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x520340]
mov edx, 7
test eax, eax
cmove ecx, edx
mov dword [0x520340], ecx
push esi
lea eax, [ebp - 0x448]
push str.RegOpenKeyEx_main__x
push eax
call fcn.00406160
add esp, 0xc
xor bl, bl
jmp 0x4299c0
push 0
push 0
push 0
xor al, al
push 0
mov byte [ebp - 0x421], al
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 0x103
je 0x42998c
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
test eax, eax
jne 0x42989b
mov eax, dword [ebx + 0x10]
cmp eax, dword [ebx + 0x14]
je 0x4290f0
lea ecx, [ebp - 0x420]
push ecx
push dword [ebx + 0x14]
push eax
call fcn.00428700
add esp, 0xc
cmp eax, dword [ebx + 0x14]
jne 0x429901
mov ecx, dword [ebp - 0x42c]
xor ebx, ebx
mov eax, dword [ecx + 0x2c]
sub eax, dword [ecx + 0x28]
sar eax, 2
test eax, eax
je 0x4291dc
lea edi, [ebp - 0x420]
shr edi, 0x10
mov dword [ebp - 0x428], edi
jmp 0x429120
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x430], esi
mov byte [ebp - 4], 1
test edi, edi
jne 0x42921f
lea eax, [ebp - 0x420]
movzx edi, ax
push 0
push edi
call fcn.00403b80
add esp, 8
test eax, eax
je 0x42916d
push edi
push eax
lea ecx, [ebp - 0x430]
call fcn.00407650
mov esi, dword [ebp - 0x430]
mov edi, dword [ebp - 0x428]
mov eax, dword [ebp - 0x42c]
mov byte [ebp - 4], 0
mov eax, dword [eax + 0x28]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x4291a5
cmp dword [esi - 0xc], 0
jl 0x4291a5
push eax
push esi
call fcn.004a77ff
add esp, 8
test eax, eax
je 0x4291a5
sub eax, esi
sar eax, 1
jns 0x429910
add esi, 0xfffffff0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4291bf
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x42c]
inc ebx
mov eax, dword [ecx + 0x2c]
sub eax, dword [ecx + 0x28]
sar eax, 2
cmp ebx, eax
jb 0x429120
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x430], eax
mov byte [ebp - 4], 2
test edi, 0xffff0000
jne 0x42925d
movzx esi, di
push 0
push esi
call fcn.00403b80
add esp, 8
test eax, eax
je 0x42926f
push esi
push eax
lea ecx, [ebp - 0x430]
call fcn.00407650
jmp 0x42926f
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
jmp 0x429230
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x429230
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x430]
call fcn.00409950
mov esi, dword [ebp - 0x430]
jmp 0x429173
push 0x33
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
lea ecx, [ebp - 0x430]
call fcn.00409950
mov byte [ebp - 4], 3
call fcn.00429b30
test al, al
jne 0x42928e
push 4
call fcn.004a5bed
mov ecx, dword [0x520340]
add esp, 4
mov dword [eax], ecx
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 4
test eax, 0xffff0000
jne 0x4292d6
movzx esi, ax
push 0
push esi
call fcn.00403b80
add esp, 8
test eax, eax
je 0x429302
push esi
push eax
lea ecx, [ebp - 0x438]
call fcn.00407650
jmp 0x429302
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4292e0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x438]
call fcn.00409950
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x454]
push 0x4d95f8
push eax
mov byte [ebp - 4], 5
call fcn.0040b800
add esp, 0xc
mov eax, dword [eax]
lea ecx, [ebp - 0x430]
push dword [eax - 0xc]
mov byte [ebp - 4], 6
push eax
call fcn.0040b980
mov edx, dword [ebp - 0x454]
add edx, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 5
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42935c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x438]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42937f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x520340]
imul eax, eax
cdq
mov ecx, 0x16
idiv ecx
cmp edx, 6
jne 0x4293a6
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov edi, dword [ebp - 0x430]
lea eax, [ebp - 0x43c]
push eax
push dword [ebp + 0xc]
push 0
push edi
push dword [ebp - 0x458]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x429404
push eax
lea eax, [ebp - 0x448]
push str.RegOpenKeyEx_sub__x
push eax
call fcn.00406160
add edi, 0xfffffff0
add esp, 0xc
mov byte [ebp - 4], 0
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4298c1
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4298c1
mov ebx, dword [ebp - 0x42c]
mov eax, dword [ebx + 0x1c]
cmp eax, dword [ebx + 0x20]
je 0x4295bb
call fcn.00429a60
test al, al
jne 0x429482
mov esi, dword [0x520340]
mov eax, 0x4d4873ed
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x6a
mov eax, esi
sub eax, ecx
xor ebx, ebx
cmp eax, 0xe7
je 0x429476
mov eax, esi
or eax, 0xffffffd5
add esi, eax
mov eax, esi
imul eax, esi
inc ebx
cmp ebx, eax
jg 0x429476
mov eax, 0x4d4873ed
imul esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
imul ecx, ecx, 0x6a
mov eax, esi
sub eax, ecx
cmp eax, 0xe7
jne 0x429446
mov dword [0x520340], ebx
mov ebx, dword [ebp - 0x42c]
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
mov dword [ebp - 0x434], 0x208
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x428], esi
mov edx, dword [ebp - 0x434]
shr edx, 1
mov byte [ebp - 4], 7
js 0x429935
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4294d7
push edx
lea ecx, [ebp - 0x428]
call fcn.004088a0
mov esi, dword [ebp - 0x428]
lea eax, [ebp - 0x434]
push eax
push esi
lea eax, [ebp - 0x444]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x429523
push dword [esi - 8]
push esi
call fcn.004a773a
add esp, 8
test eax, eax
js 0x429935
cmp eax, dword [esi - 8]
jg 0x429935
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], 0
je 0x42959d
mov ebx, dword [0x520340]
lea ecx, [ebx + 1]
lea eax, [ebx + 2]
imul eax, ecx
imul eax, ebx
cdq
mov ecx, 0x17
idiv ecx
cmp edx, 0xb
jne 0x429579
xor eax, eax
test ebx, ebx
je 0x429574
mov edi, eax
mov eax, ebx
mov ecx, ebx
cdq
sub eax, edx
and ecx, 1
mov ebx, eax
add edi, ecx
sar ebx, 1
jne 0x429550
mov dword [ebp - 0x438], edi
mov edi, dword [ebp - 0x430]
mov eax, dword [ebp - 0x438]
mov dword [0x520340], eax
mov ebx, dword [ebp - 0x42c]
lea eax, [ebp - 0x428]
push eax
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
call fcn.00428770
add esp, 0xc
cmp eax, dword [ebx + 0x20]
jne 0x42993f
add esi, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4295bb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 0x34]
cmp eax, dword [ebx + 0x38]
je 0x4296c3
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
mov dword [ebp - 0x434], 0x208
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x428], esi
mov edx, dword [ebp - 0x434]
shr edx, 1
mov byte [ebp - 4], 8
js 0x429935
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x42961c
push edx
lea ecx, [ebp - 0x428]
call fcn.004088a0
mov esi, dword [ebp - 0x428]
lea eax, [ebp - 0x434]
push eax
push esi
lea eax, [ebp - 0x444]
push eax
push 0
push str.Publisher
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x429668
push dword [esi - 8]
push esi
call fcn.004a773a
add esp, 8
test eax, eax
js 0x429935
cmp eax, dword [esi - 8]
jg 0x429935
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], 0
je 0x4296a5
call fcn.00429a80
test al, al
jne 0x429687
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetMailslotInfo]
lea eax, [ebp - 0x428]
push eax
push dword [ebx + 0x38]
push dword [ebx + 0x34]
call fcn.00428770
add esp, 0xc
cmp eax, dword [ebx + 0x38]
jne 0x42993f
add esi, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [esi + 0xc]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4296c3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 0x40]
cmp eax, dword [ebx + 0x44]
je 0x42985e
call fcn.00429a30
test al, al
jne 0x42973f
mov ecx, dword [0x520340]
test ecx, ecx
je 0x42973f
mov eax, ecx
and eax, 0x80000001
jns 0x4296f0
dec eax
or eax, 0xfffffffe
inc eax
jne 0x4296fd
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
jmp 0x429704
lea ecx, [ecx*2 + 1]
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, ecx
lea eax, [eax + eax*2]
sub edx, eax
mov dword [0x520340], ecx
sub edx, 0
je 0x42972e
sub edx, 2
je 0x429731
dec edx
je 0x429732
jmp 0x42973b
add ecx, 2
inc ecx
add ecx, 2
mov dword [0x520340], ecx
test ecx, ecx
jne 0x4296e2
mov eax, dword [0x51eab0]
mov ecx, 0x51eab0
mov dword [ebp - 0x434], 0x208
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x428], esi
mov edx, dword [ebp - 0x434]
shr edx, 1
mov byte [ebp - 4], 9
js 0x429935
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x429794
push edx
lea ecx, [ebp - 0x428]
call fcn.004088a0
mov esi, dword [ebp - 0x428]
lea eax, [ebp - 0x434]
push eax
push esi
lea eax, [ebp - 0x444]
push eax
push 0
push str.InstallLocation
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4297e0
push dword [esi - 8]
push esi
call fcn.004a773a
add esp, 8
test eax, eax
js 0x429935
cmp eax, dword [esi - 8]
jg 0x429935
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], 0
je 0x42983c
mov ecx, dword [ebp - 0x42c]
xor ebx, ebx
mov eax, dword [ecx + 0x44]
sub eax, dword [ecx + 0x40]
sar eax, 2
test eax, eax
je 0x42983c
jmp 0x429800
mov eax, dword [ecx + 0x40]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x42982e
cmp dword [esi - 0xc], 0
jl 0x42982e
push eax
push esi
call fcn.004a77ff
add esp, 8
test eax, eax
je 0x429828
sub eax, esi
sar eax, 1
jns 0x42993f
mov ecx, dword [ebp - 0x42c]
mov eax, dword [ecx + 0x44]
sub eax, dword [ecx + 0x40]
inc ebx
sar eax, 2
cmp ebx, eax
jb 0x429800
add esi, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 4], 3
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x429861
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x429861
or ebx, 0xffffffff
mov eax, dword [ebp - 0x43c]
test eax, eax
je 0x42987e
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov dword [ebp - 0x43c], 0
add edi, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x42989b
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
inc dword [ebp - 0x450]
push 0x410
lea eax, [ebp - 0x420]
push 0
push eax
mov dword [ebp - 0x44c], 0x208
call fcn.004a7560
add esp, 0xc
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x450]
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 0x103
je 0x429908
mov ebx, dword [ebp - 0x42c]
jmp 0x4290bf
mov byte [ebp - 0x421], 1
or edi, 0xffffffff
jmp 0x42998c
add esi, 0xfffffff0
or edi, 0xffffffff
mov byte [ebp - 0x421], 1
lea eax, [esi + 0xc]
mov ecx, edi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x429986
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x429986
push 0x80070057
call fcn.00404480
add esi, 0xfffffff0
or ebx, 0xffffffff
mov byte [ebp - 0x421], 1
mov byte [ebp - 4], 3
lea eax, [esi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x429966
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edi + 0xc]
mov ecx, ebx
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x429983
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
or edi, 0xffffffff
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x43c]
test eax, eax
je 0x4299a3
push eax
call esi
mov dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x440]
test eax, eax
je 0x4299ba
push eax
call esi
mov dword [ebp - 0x440], 0
mov bl, byte [ebp - 0x421]
mov esi, dword [ebp - 0x448]
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x4299e4
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004a63c4
mov esp, ebp
pop ebp
ret 8