Function at 0x100192c9
Capabilities:
Get installed programs
Query or enumerate registry value
Query service configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008ce64
mov eax, dword fs:[0]
push eax
mov eax, 0x1f38
call fcn.10035de0
mov eax, dword [0x100ba410]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
and dword [edi + 0x78], 0
xor esi, esi
mov ebx, dword [ebp + 0xc]
inc esi
cmp dword [ebp + 8], esi
jg 0x10019313
xor eax, eax
jmp 0x10019e3f
push 2
pop eax
mov dword [ebp - 0x1f30], eax
push 0x100ad4fc
push dword [ebx + esi*4]
call fcn.1001f912
pop ecx
pop ecx
test eax, eax
je 0x10019e02
push 0x100ad544
push dword [ebx + esi*4]
call fcn.1001f912
pop ecx
pop ecx
test eax, eax
je 0x10019d91
push 0x100ad594
push dword [ebx + esi*4]
call fcn.1001f912
pop ecx
pop ecx
test eax, eax
je 0x10019d2e
push 2
push 0x100ad5e0
push dword [ebx + esi*4]
call fcn.100224b7
add esp, 0xc
test eax, eax
jne 0x1001940b
mov ecx, dword [ebx + esi*4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10019381
sub ecx, edx
mov edx, dword [ebp - 0x1f30]
cmp ecx, 2
ja 0x100193a3
cmp edx, dword [ebp + 8]
jge 0x100193fc
mov eax, dword [ebx + esi*4 + 4]
cmp byte [eax], 0x2d
je 0x100193fc
mov ecx, dword [ebx + esi*4]
lea eax, [ecx + 1]
mov dword [ebp - 0x1f38], eax
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100193af
sub ecx, dword [ebp - 0x1f38]
cmp ecx, 2
jbe 0x100193c9
mov eax, dword [ebx + esi*4]
add eax, 2
jmp 0x100193d5
mov eax, dword [ebx + esi*4 + 4]
inc esi
inc edx
mov dword [ebp - 0x1f30], edx
push eax
call fcn.10022031
pop ecx
test eax, eax
push 9
pop ecx
cmovg ecx, eax
inc esi
inc dword [ebp - 0x1f30]
mov dword [edi + 0x78], ecx
cmp esi, dword [ebp + 8]
jl 0x1001931c
jmp 0x1001930c
push str.ERROR:_The_debug_option___d__requires_and_argument_n
call fcn.10020e18
jmp 0x10019e3b
push 0x100ad618
push dword [ebx + esi*4]
call fcn.1001f912
pop ecx
pop ecx
test eax, eax
jne 0x1001944c
xor ebx, ebx
inc ebx
push ebx
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1f40], esp
push str.C:Windows
call fcn.10015553
mov dword [ebp - 4], ebx
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.1001abfc
mov eax, ebx
jmp 0x10019e3f
push 0x100ad628
push dword [ebx + esi*4]
call fcn.1001f912
pop ecx
pop ecx
test eax, eax
jne 0x1001948c
push eax
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1f40], esp
push str.C:Windows
call fcn.10015553
mov dword [ebp - 4], 2
or dword [ebp - 4], 0xffffffff
mov ecx, edi
call fcn.1001abfc
jmp 0x10019e3c
push 2
push 0x100ad62c
push dword [ebx + esi*4]
call fcn.1001fbe0
add esp, 0xc
test eax, eax
jne 0x10019d21
push 0x1ff
push eax
mov byte [ebp - 0x1010], al
lea eax, [ebp - 0x100f]
push eax
call fcn.10023400
add esp, 0xc
call fcn.100205e2
mov edx, dword [ebx + esi*4]
add eax, 0x20
mov ecx, edx
mov dword [ebp - 0x1f34], eax
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100194d7
sub ecx, edi
cmp ecx, 2
ja 0x100194f6
lea eax, [esi + 1]
cmp eax, dword [ebp + 8]
jge 0x10019563
mov eax, dword [ebx + esi*4 + 4]
cmp byte [eax], 0x2d
je 0x10019563
mov ecx, edx
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100194fb
sub ecx, edi
cmp ecx, 2
jbe 0x1001950e
add edx, 2
jmp 0x10019512
mov edx, dword [ebx + esi*4 + 4]
push edx
push 0x1009e65c
push 0xffffffffffffffff
lea eax, [ebp - 0x1010]
push 0x200
push eax
call fcn.1001f145
push 0x100ad630
lea eax, [ebp - 0x1010]
push eax
lea eax, [ebp - 0x1f34]
push eax
call fcn.1001f41f
add esp, 0x20
test eax, eax
je 0x10019563
call fcn.100205e2
add eax, 0x20
push str.ERROR:_Failed_to_open_output_file__results_will_be_printed_to_screen_instead._n
mov dword [ebp - 0x1f34], eax
call fcn.10020e18
pop ecx
push str._n_nWelcome_to_the_Snare_for_Windows_Silent_Install_support
call fcn.10020e18
push 0x31
pop eax
mov esi, 0xfe
mov word [ebp - 0x110], ax
push esi
xor ebx, ebx
lea eax, [ebp - 0x10e]
push ebx
push eax
call fcn.10023400
push 0x32
pop eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push ebx
push eax
call fcn.10023400
mov esi, 0x3ff
mov dword [ebp - 0x1f30], ebx
push esi
lea eax, [ebp - 0x1f13]
mov dword [ebp - 0x1f38], ebx
push ebx
push eax
mov byte [ebp - 0x1f14], bl
call fcn.10023400
push str.Snare_is1
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push 0xffffffffffffffff
lea edi, [esi + 1]
mov dword [ebp - 0x1f3c], ebx
lea eax, [ebp - 0x1f14]
push edi
push eax
call fcn.1001f145
push esi
lea eax, [ebp - 0x160f]
mov byte [ebp - 0x1610], bl
push ebx
push eax
call fcn.10023400
add esp, 0x48
mov dword [ebp - 0x1f44], edi
lea eax, [ebp - 0x1f3c]
push eax
lea eax, [ebp - 0x1f14]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [ebp - 0x1f3c], ebx
je 0x10019658
lea eax, [ebp - 0x1f44]
push eax
lea eax, [ebp - 0x1610]
push eax
push ebx
push ebx
push str.InstallLocation
push dword [ebp - 0x1f3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x1f3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10019679
push str.ERROR:_Unable_to_query_the_Install_Location__defaulting_to__C:Program_FilesSnare__n
call fcn.10020e18
push 0xffffffffffffffff
push str.C:Program_FilesSnare_
lea eax, [ebp - 0x1610]
push edi
push eax
call fcn.10021c86
add esp, 0x14
mov esi, str.LocalSystem
lea edi, [ebp - 0x810]
push 0x1f4
lea eax, [ebp - 0x804]
push ebx
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.10023400
mov eax, dword [str.Snare]
mov dword [ebp - 0xa10], eax
mov ax, word [0x100ad40c]
push 0x1fa
mov word [ebp - 0xa0c], ax
lea eax, [ebp - 0xa0a]
push ebx
push eax
call fcn.10023400
add esp, 0x18
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
je 0x10019768
push 1
lea ecx, [ebp - 0xa10]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x10019754
mov dword [ebp - 0x1f40], ebx
mov ebx, 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
lea eax, [ebp - 0x1f40]
push eax
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
je 0x10019736
push 0xffffffffffffffff
push dword [esi + 0x1c]
lea eax, [ebp - 0x810]
push 0x200
push eax
call fcn.10021c86
add esp, 0x10
jmp 0x10019749
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR:_Unable_to_query_the_service_parameter:_0x_x_n
call fcn.10020e18
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor ebx, ebx
jmp 0x10019773
lea eax, [ebp - 0xa10]
push eax
push str.ERROR:_Unable_to_connect_to_Service:__s_n
call fcn.10020e18
pop ecx
jmp 0x10019772
push str.ERROR:_Unable_to_connect_to_Service_Manager_n
call fcn.10020e18
pop ecx
push 0x31
pop eax
mov esi, 0x1fe
mov word [ebp - 0x410], ax
push esi
lea eax, [ebp - 0x40e]
push ebx
push eax
call fcn.10023400
push 0x32
pop eax
push esi
mov word [ebp - 0x610], ax
lea eax, [ebp - 0x60e]
push ebx
push eax
call fcn.10023400
push 0x3ff
lea eax, [ebp - 0x1b13]
mov byte [ebp - 0x1b14], bl
push ebx
push eax
call fcn.10023400
push 0xc
lea eax, [ebp - 0x810]
push str.LocalSystem
push eax
call fcn.1004078a
add esp, 0x30
mov ebx, 0x100
test eax, eax
je 0x10019b31
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
lea eax, [ebp - 0x1f38]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov ecx, dword [ebp - 0x1f38]
xor ecx, 4
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor esi, esi
lea ecx, [ebp - 0x210]
lea eax, [ebp - 0x110]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10019945
test dl, dl
je 0x10019941
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10019945
add eax, 2
add ecx, 2
test dl, dl
jne 0x1001981a
jmp 0x10019941
test esi, esi
je 0x10019856
push str._n_n_ERROR:_Passwords_did_not_match__please_try_again.__n
call fcn.10020e18
pop ecx
push str._n_nPlease_enter_the_Encryption_Password_for_sensitive_information:
call fcn.10020e18
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleA]
lea eax, [ebp - 0x1f30]
pop ecx
push 0
push eax
push 0xff
lea eax, [ebp - 0x110]
push eax
push edi
call esi
mov ecx, dword [ebp - 0x1f30]
cmp ecx, ebx
jae 0x100199a7
lea edx, [ebp - 0x110]
add edx, ecx
mov byte [edx], 0
mov al, byte [edx]
cmp al, 0xa
je 0x100198a6
cmp al, 0xd
je 0x100198a6
test al, al
jne 0x100198b3
mov eax, ecx
dec ecx
test eax, eax
je 0x100198b3
mov byte [edx], 0
dec edx
jmp 0x10019898
push str._n_nPlease_re_enter_the_password:
mov dword [ebp - 0x1f30], ecx
call fcn.10020e18
pop ecx
push 0
lea eax, [ebp - 0x1f30]
push eax
push 0xff
lea eax, [ebp - 0x210]
push eax
push edi
call esi
mov ecx, dword [ebp - 0x1f30]
cmp ecx, ebx
jae 0x100199a7
lea edx, [ebp - 0x210]
add edx, ecx
mov byte [edx], 0
mov al, byte [edx]
cmp al, 0xa
je 0x10019903
cmp al, 0xd
je 0x10019903
test al, al
jne 0x10019910
mov eax, ecx
dec ecx
test eax, eax
je 0x10019910
mov byte [edx], 0
dec edx
jmp 0x100198f5
xor esi, esi
mov dword [ebp - 0x1f30], ecx
inc esi
lea ecx, [ebp - 0x210]
lea eax, [ebp - 0x110]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10019945
test dl, dl
je 0x10019941
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10019945
add eax, 2
add ecx, 2
test dl, dl
jne 0x10019925
xor eax, eax
jmp 0x1001994a
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10019847
mov ecx, ebx
lea eax, [ebp - 0x210]
mov byte [eax], 0
inc eax
dec ecx
jne 0x1001995a
push 0x100ad8d0
call fcn.10020e18
pop ecx
xor esi, esi
lea ecx, [ebp - 0x610]
lea eax, [ebp - 0x410]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10019ab6
test dl, dl
je 0x10019ab2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10019ab6
add eax, 2
add ecx, 2
test dl, dl
jne 0x1001997a
jmp 0x10019ab2
call fcn.1002219a
test esi, esi
je 0x100199bb
push str._n_n_ERROR:_Passwords_did_not_match__please_try_again.__n
call fcn.10020e18
pop ecx
lea eax, [ebp - 0x810]
push eax
push str._n_nPlease_enter_the_Service_Account_password_for__s:
call fcn.10020e18
mov esi, dword [sym.imp.KERNEL32.dll_ReadConsoleA]
lea eax, [ebp - 0x1f30]
pop ecx
pop ecx
push 0
push eax
push 0x1ff
lea eax, [ebp - 0x410]
push eax
push edi
call esi
mov ecx, dword [ebp - 0x1f30]
cmp ecx, 0x200
jae 0x100199a7
lea edx, [ebp - 0x410]
add edx, ecx
mov byte [edx], 0
mov al, byte [edx]
cmp al, 0xa
je 0x10019a13
cmp al, 0xd
je 0x10019a13
test al, al
jne 0x10019a20
mov eax, ecx
dec ecx
test eax, eax
je 0x10019a20
mov byte [edx], 0
dec edx
jmp 0x10019a05
push str._n_nPlease_re_enter_the_password:
mov dword [ebp - 0x1f30], ecx
call fcn.10020e18
pop ecx
push 0
lea eax, [ebp - 0x1f30]
push eax
push 0x1ff
lea eax, [ebp - 0x610]
push eax
push edi
call esi
mov ecx, dword [ebp - 0x1f30]
cmp ecx, 0x200
jae 0x100199a7
lea edx, [ebp - 0x610]
add edx, ecx
mov byte [edx], 0
mov al, byte [edx]
cmp al, 0xa
je 0x10019a74
cmp al, 0xd
je 0x10019a74
test al, al
jne 0x10019a81
mov eax, ecx
dec ecx
test eax, eax
je 0x10019a81
mov byte [edx], 0
dec edx
jmp 0x10019a66
xor esi, esi
mov dword [ebp - 0x1f30], ecx
inc esi
lea ecx, [ebp - 0x610]
lea eax, [ebp - 0x410]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10019ab6
test dl, dl
je 0x10019ab2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10019ab6
add eax, 2
add ecx, 2
test dl, dl
jne 0x10019a96
xor eax, eax
jmp 0x10019abb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100199ac
push dword [ebp - 0x1f38]
push edi
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
push 0x1009eb84
call fcn.10020e18
pop ecx
lea ecx, [ebp - 0x110]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10019ae4
sub ecx, edx
lea eax, [ebp - 0x1b14]
push ecx
push 0x400
push eax
lea eax, [ebp - 0x410]
push eax
push ecx
lea eax, [ebp - 0x110]
push eax
call fcn.1001a058
mov edx, 0x200
lea eax, [ebp - 0x410]
mov ecx, edx
mov byte [eax], 0
inc eax
dec ecx
jne 0x10019b1b
mov ecx, edx
lea eax, [ebp - 0x610]
mov byte [eax], 0
inc eax
dec ecx
jne 0x10019b2a
push 0x100ad8d0
call fcn.10020e18
mov dword [esp], str._Setup__n
push dword [ebp - 0x1f34]
call fcn.1002263a
push str.Langdefault_n
push dword [ebp - 0x1f34]
call fcn.1002263a
push str.GroupInterSect_Alliance_n
push dword [ebp - 0x1f34]
call fcn.1002263a
push str.NoIcons0_n
push dword [ebp - 0x1f34]
call fcn.1002263a
lea eax, [ebp - 0x1610]
push eax
push str.Dir_s_n
push dword [ebp - 0x1f34]
call fcn.1002263a
push 0x1009eb84
push dword [ebp - 0x1f34]
call fcn.1002263a
push str._Service__n
push dword [ebp - 0x1f34]
call fcn.1002263a
lea eax, [ebp - 0x810]
push eax
push str.Account_s_n
push dword [ebp - 0x1f34]
call fcn.1002263a
add esp, 0x48
lea eax, [ebp - 0x1b14]
push eax
push str.Password_s_n
push dword [ebp - 0x1f34]
call fcn.1002263a
mov esi, str.Config
lea edi, [ebp - 0xe10]
push 0xf9
lea eax, [ebp - 0xe09]
push 0
movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.10023400
mov eax, dword [str.Network]
mov dword [ebp - 0xd10], eax
mov eax, dword [0x1009f5dc]
push pe_nt_image_headers32
mov dword [ebp - 0xd0c], eax
lea eax, [ebp - 0xd08]
push 0
push eax
call fcn.10023400
mov esi, str.Objective
lea edi, [ebp - 0xc10]
push 0xf6
lea eax, [ebp - 0xc06]
push 0
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.10023400
mov esi, str.Remote
lea edi, [ebp - 0xb10]
push 0xf9
lea eax, [ebp - 0xb09]
push 0
movsd dword es:[edi], dword [esi]
push eax
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
call fcn.10023400
add esp, 0x3c
lea esi, [ebp - 0xe10]
push 4
pop edi
push 0x1009eb84
push dword [ebp - 0x1f34]
call fcn.1002263a
pop ecx
pop ecx
push dword [ebp - 0x1f34]
push esi
call fcn.10019e5d
add esi, ebx
dec edi
jne 0x10019c80
push 0xc
lea eax, [ebp - 0x810]
push str.LocalSystem
push eax
call fcn.1004078a
add esp, 0xc
test eax, eax
je 0x10019d0a
push 0x1ff
lea eax, [ebp - 0x120f]
mov byte [ebp - 0x1210], 0
push edi
push eax
call fcn.10023400
pop ecx
pop ecx
push 0x200
lea eax, [ebp - 0x1210]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x16
push 0x1009d558
call fcn.1001a058
lea eax, [ebp - 0x1210]
push eax
push str._n_nYour_Installation_Password_is:__s_n
call fcn.10020e18
pop ecx
pop ecx
lea eax, [ebp - 0x110]
mov byte [eax], 0
inc eax
dec ebx
jne 0x10019d10
push str._n_nExport_complete._n
jmp 0x10019401
push dword [ebx + esi*4]
push str.ERROR:_Unrecognised_option__s_n
jmp 0x10019e35
mov ecx, edi
call fcn.1001a42e
test eax, eax
jne 0x10019d47
lea eax, [edi + 4]
push eax
push str._s_is_not_installed_n
jmp 0x10019e35
mov ecx, edi
call fcn.1001aa93
test eax, eax
je 0x10019d74
push 0x104
lea eax, [ebp - 0x1714]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [edi + 4]
push eax
push str._s_removed._n
jmp 0x10019e35
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [edi + 4]
push eax
push str.Could_not_remove__s._Error__d_n
call fcn.10020e18
add esp, 0xc
jmp 0x10019e3c
mov ecx, edi
call fcn.1001a42e
test eax, eax
je 0x10019daa
lea eax, [edi + 4]
push eax
push str._s_is_already_installed_n
jmp 0x10019e35
push 0x1009c74c
lea ecx, [ebp - 0x1f2c]
call fcn.10015553
and dword [ebp - 4], 0
lea eax, [ebp - 0x1f2c]
push eax
mov ecx, edi
call fcn.1001a46c
mov esi, eax
or dword [ebp - 4], 0xffffffff
push 0
push 1
lea ecx, [ebp - 0x1f2c]
call fcn.10002c1a
test esi, esi
je 0x10019df0
lea eax, [edi + 4]
push eax
push str._s_installed_n
jmp 0x10019e35
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [edi + 4]
push eax
push str._s_failed_to_install._Error__d_n
jmp 0x10019d84
push dword [edi + 0x48]
lea eax, [edi + 4]
push dword [edi + 0x44]
push eax
push str._s_Version__d._d_n
call fcn.10020e18
add esp, 0x10
mov ecx, edi
call fcn.1001a42e
test eax, eax
mov ecx, str.currently
mov edx, 0x100ad520
cmove ecx, edx
push ecx
push str.The_service_is__s_installed_n
call fcn.10020e18
pop ecx
pop ecx
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001e010
mov esp, ebp
pop ebp
ret 8