Function at 0x45213c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x4be8a0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x48
mov eax, 0x48b103
call fcn.004677c7
xor eax, eax
push 0x206
mov word [ebp], ax
xor ebx, ebx
lea eax, [ebp + 2]
push ebx
push eax
mov esi, ecx
call fcn.004670a0
mov edi, 0x104
add esp, 0xc
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], edi
call fcn.0040aa77
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallSogouExplorer
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.004029f9
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0040aab6
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.004023e9
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallliebao
lea ecx, [ebp - 0x10]
call fcn.004029f9
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.0040aab6
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.004023e9
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallQQBrowser
lea ecx, [ebp - 0x10]
call fcn.004029f9
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.0040aab6
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.004023e9
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallBaiduBrowser
lea ecx, [ebp - 0x10]
call fcn.004029f9
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.0040aab6
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.004023e9
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMaxthon
lea ecx, [ebp - 0x10]
call fcn.004029f9
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.0040aab6
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], bl
add ecx, 0xfffffff0
call fcn.004023e9
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMaxthon2
lea ecx, [ebp - 0x10]
call fcn.004029f9
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 6
call fcn.0040aab6
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.004023e9
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMaxthon3
lea ecx, [ebp - 0x10]
call fcn.004029f9
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 7
call fcn.0040aab6
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.004023e9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
push str.DisplayName
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallGoogle_Chrome
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x452318
lea eax, [esi + 0x78]
push 0x4984a0
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040d822
add esp, 0xc
push eax
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 8
call fcn.00401d13
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.004023e9
push edi
lea eax, [ebp]
push ebx
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], edi
call fcn.004670a0
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x24]
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x10], 2
call fcn.0040b30c
jmp 0x4524a5
lea ecx, [ebp - 0x38]
call fcn.0040ad5e
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push str.DisplayName
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x45248a
mov eax, dword [ebp - 0x10]
dec eax
dec eax
je 0x45245a
dec eax
je 0x452433
dec eax
je 0x45240c
dec eax
je 0x4523e5
dec eax
jne 0x45248a
lea ecx, [esi + 0x78]
mov eax, dword [ecx]
mov eax, dword [eax - 0xc]
cmp eax, ebx
jle 0x4523bb
add eax, 0xfffffffe
push eax
call fcn.0040d886
movzx eax, ax
cmp ax, 0x36
je 0x45249d
push 0x498394
lea eax, [esi + 0x78]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.0040d822
add esp, 0xc
push eax
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 0xd
call fcn.00401d13
mov ecx, dword [ebp - 0x4c]
jmp 0x45247f
lea eax, [esi + 0x78]
push 0x49839c
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0040d822
add esp, 0xc
push eax
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 0xc
call fcn.00401d13
mov ecx, dword [ebp - 0x50]
jmp 0x45247f
lea eax, [esi + 0x78]
push 0x498418
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0040d822
add esp, 0xc
push eax
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 0xb
call fcn.00401d13
mov ecx, dword [ebp - 0x3c]
jmp 0x45247f
lea eax, [esi + 0x78]
push 0x498420
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0040d822
add esp, 0xc
push eax
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 0xa
call fcn.00401d13
mov ecx, dword [ebp - 0x54]
jmp 0x45247f
lea eax, [esi + 0x78]
push 0x498498
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.0040d822
add esp, 0xc
push eax
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 9
call fcn.00401d13
mov ecx, dword [ebp - 0x48]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.004023e9
cmp dword [ebp - 0x10], 6
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x18], edi
jge 0x45249d
inc dword [ebp - 0x10]
lea ecx, [ebp - 0x38]
call fcn.0040ad8a
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x20]
lea ecx, [ebp - 0x44]
call fcn.0040b30c
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040adb9
test al, al
je 0x45234b
push 0x7c
lea ecx, [esi + 0x78]
call fcn.00422c49
lea ecx, [ebp - 0x30]
call fcn.0040ad10
push dword [ebp - 0x30]
call fcn.00463780
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0046711a
add ebp, 0x20c
leave
ret