Function at 0x40de10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [ecx + 4]
push ebx
push esi
push edi
cmp dword [eax + 8], 0
mov dword [ebp - 8], ecx
je 0x40de34
mov dword [ecx + 0x20], 1
jmp 0x40e063
and word [ebp - 0x214], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 4]
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4288c4
mov edi, reloc.OLEAUT32.dll_SysReAllocString
mov ebx, 0x104
push str.SOFTWAREMicrosoftInternet_Explorer
push edi
mov dword [ebp - 0xc], 1
mov dword [ebp - 4], ebx
call esi
and word [ebp - 0x41a], 0
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.MSVCRT.dll__wtoi]
cmp eax, 7
pop ecx
jge 0x40e059
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
mov ebx, str.UninstallString
push eax
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMaxthon2
push edi
call esi
cmp word [ebp - 0x214], 0
jne 0x40e059
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallCBE331E3_CB6B_46a3_A669_2C6DABBA2601
push edi
call esi
cmp word [ebp - 0x214], 0
jne 0x40e059
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push edi
call esi
cmp word [ebp - 0x214], 0
jne 0x40e059
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallTencent_Traveler
push edi
call esi
cmp word [ebp - 0x214], 0
jne 0x40e059
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallSogouExplorer
push edi
call esi
cmp word [ebp - 0x214], 0
jne 0x40e059
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMozilla_Firefox_2.0.0.20_
push edi
call esi
cmp word [ebp - 0x214], 0
jne 0x40e059
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMozilla_Firefox_3.5.1_
push edi
call esi
cmp word [ebp - 0x214], 0
jne 0x40e059
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallFoxPlus
push edi
call esi
cmp word [ebp - 0x214], 0
jne 0x40e059
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push edi
call esi
cmp word [ebp - 0x214], 0
jne 0x40e059
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x104
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.S_1_5_21_1409082233_1563985344_1417001333_500SoftwareMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push SysReAllocStringLen
call esi
cmp word [ebp - 0x214], 0
je 0x40e063
mov eax, dword [ebp - 8]
mov dword [eax + 0x20], 1
pop edi
pop esi
pop ebx
leave
ret