Function at 0x100362a0
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1011f00e
mov eax, dword fs:[0]
push eax
sub esp, 0xb10
mov eax, dword [0x1015d2f0]
xor eax, esp
mov dword [esp + 0xb08], eax
push ebx
push esi
push edi
mov eax, dword [0x1015d2f0]
xor eax, esp
push eax
lea eax, [esp + 0xb20]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push 0x1ff
lea ecx, [esp + 0x719]
push ebx
push ecx
mov dword [esp + 0x50], eax
mov dword [esp + 0x44], 0x200
mov byte [esp + 0x720], bl
call fcn.100f8db0
add esp, 0xc
lea edx, [esp + 0x30]
push edx
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10036b62
mov ecx, dword [esp + 0x30]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x54]
push eax
push ebx
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x10036b62
cmp dword [esp + 0x38], ebx
mov dword [esp + 0x20], eax
jle 0x10036b62
jmp 0x10036376
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x44]
lea ecx, [esp + 0x728]
push ecx
push eax
mov edi, 0x200
push edx
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edx, dword [esp + 0x30]
lea eax, [esp + 0x18]
push eax
push 0x20019
push ebx
lea ecx, [esp + 0x720]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10036b4f
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x3c]
push edx
push ebx
push str.SystemComponent
push eax
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x40], edi
call esi
cmp dword [esp + 0x2c], 1
je 0x10036b4f
mov eax, 0xf
mov dword [esp + 0xd8], eax
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
mov dword [esp + 0xb28], ebx
mov dword [esp + 0x84], eax
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
mov dword [esp + 0xa0], eax
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf0], ebx
mov byte [esp + 0xe0], bl
push 0x1ff
lea ecx, [esp + 0x119]
push ebx
mov byte [esp + 0xb30], 3
push ecx
mov byte [esp + 0x120], bl
call fcn.100f8db0
add esp, 0xc
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push str.DisplayName
push edx
mov dword [esp + 0x2c], edi
call esi
push 0x1015f040
lea eax, [esp + 0xa8]
push str.Software_
push eax
call fcn.1000d3e0
add esp, 0xc
mov byte [esp + 0xb28], 4
mov edi, 0x1013e2a2
lea eax, [esp + 0x114]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x100364e8
cmp cl, bl
je 0x100364e4
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x100364e8
add eax, 2
add edi, 2
cmp cl, bl
jne 0x100364c8
xor eax, eax
jmp 0x100364ed
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x10036584
cmp dword [esp + 0xbc], 0x10
mov edi, dword [esp + 0xa8]
jae 0x1003650d
lea edi, [esp + 0xa8]
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x10036532
cmp cl, bl
je 0x1003652e
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x10036532
add eax, 2
add edi, 2
cmp cl, bl
jne 0x10036512
xor eax, eax
jmp 0x10036537
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x10036584
lea ecx, [esp + 0xa4]
call fcn.1002b8e0
lea ecx, [esp + 0xdc]
call fcn.1002b8e0
lea ecx, [esp + 0x88]
call fcn.1002b8e0
lea ecx, [esp + 0x6c]
call fcn.1002b8e0
lea ecx, [esp + 0xc0]
mov dword [esp + 0xb28], 0xffffffff
call fcn.1002b8e0
jmp 0x10036b4f
lea eax, [esp + 0x114]
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10036590
sub eax, edx
push eax
lea ecx, [esp + 0x118]
push ecx
lea ecx, [esp + 0xc8]
call fcn.10004290
push 0x1013e2a2
lea edx, [esp + 0x118]
push 0x200
push edx
mov dword [esp + 0x20], 0x200
call fcn.100f6d20
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x24]
push edx
push ebx
push str.Publisher
push eax
call esi
lea eax, [esp + 0x114]
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10036600
sub eax, edi
push eax
lea ecx, [esp + 0x118]
push ecx
lea ecx, [esp + 0x74]
call fcn.10004290
push 9
push ebx
push 0x10142138
lea ecx, [esp + 0x78]
call fcn.10008220
cmp eax, 0xffffffff
je 0x10036716
mov esi, 0x10
cmp dword [esp + 0xbc], esi
jb 0x10036653
mov edx, dword [esp + 0xa8]
push edx
call fcn.100f4085
add esp, 4
mov edi, 0xf
mov dword [esp + 0xbc], edi
mov dword [esp + 0xb8], ebx
mov byte [esp + 0xa8], bl
cmp dword [esp + 0xf4], esi
jb 0x10036686
mov eax, dword [esp + 0xe0]
push eax
call fcn.100f4085
add esp, 4
mov dword [esp + 0xf4], edi
mov dword [esp + 0xf0], ebx
mov byte [esp + 0xe0], bl
cmp dword [esp + 0xa0], esi
jb 0x100366b4
mov ecx, dword [esp + 0x8c]
push ecx
call fcn.100f4085
add esp, 4
mov dword [esp + 0xa0], edi
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
cmp dword [esp + 0x84], esi
jb 0x100366df
mov edx, dword [esp + 0x70]
push edx
call fcn.100f4085
add esp, 4
mov dword [esp + 0xb28], 0xffffffff
mov dword [esp + 0x84], edi
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
cmp dword [esp + 0xd8], esi
jb 0x10036b4f
mov eax, dword [esp + 0xc4]
push eax
jmp 0x10036b47
push 0x1013e2a2
lea ecx, [esp + 0x118]
push 0x200
push ecx
mov dword [esp + 0x20], 0x200
call fcn.100f6d20
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0xc
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push 0x10142144
push edx
mov dword [esp + 0x3c], ebx
call edi
mov esi, dword [esp + 0x24]
push 0x1013e2a2
lea eax, [esp + 0x118]
push 0x200
push eax
mov dword [esp + 0x20], 0x200
call fcn.100f6d20
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0x24]
push eax
push ebx
push str.DisplayVersion
push ecx
call edi
mov edi, 0x1013e2a2
lea eax, [esp + 0x114]
nop
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x100367d0
cmp cl, bl
je 0x100367cc
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x100367d0
add eax, 2
add edi, 2
cmp cl, bl
jne 0x100367b0
xor eax, eax
jmp 0x100367d5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x10036822
push 0x1013e2a2
lea edx, [esp + 0x118]
push 0x200
push edx
mov dword [esp + 0x20], 0x200
call fcn.100f6d20
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x24]
push edx
push ebx
push str.Version
push eax
call edi
jmp 0x10036828
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10036832
sub eax, edx
push eax
lea ecx, [esp + 0x118]
push ecx
lea ecx, [esp + 0x90]
call fcn.10004290
push 0x1013e2a2
lea edx, [esp + 0x118]
push 0x200
push edx
mov dword [esp + 0x20], 0x200
call fcn.100f6d20
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x24]
push edx
push ebx
push str.InstallDate
push eax
call edi
test eax, eax
jne 0x100368a2
lea ecx, [esp + 0x114]
push ecx
jmp 0x10036928
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x3c]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0x40]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x60]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push 0x1ff
lea edx, [esp + 0x319]
push ebx
push edx
mov byte [esp + 0x320], bl
call fcn.100f8db0
movzx eax, word [esp + 0x5e]
movzx ecx, word [esp + 0x5a]
movzx edx, word [esp + 0x58]
add esp, 0xc
push eax
push ecx
push edx
push str._d_02d_02d
lea edx, [esp + 0x324]
call fcn.10037780
add esp, 0x10
lea eax, [esp + 0x314]
push eax
lea ecx, [esp + 0xe0]
call fcn.10004370
push 0x1013e2a2
lea ecx, [esp + 0x118]
push 0x200
push ecx
mov dword [esp + 0x20], 0x200
call fcn.100f6d20
add esp, 0xc
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push str.ParentKeyName
push edx
call edi
push 0x1ff
lea eax, [esp + 0x519]
push ebx
push eax
mov byte [esp + 0x520], bl
call fcn.100f8db0
add esp, 0xc
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x518]
push 0x200
push edx
call fcn.100f6d20
add esp, 0xc
cmp esi, ebx
jne 0x100369f9
cmp dword [esp + 0xd4], ebx
jbe 0x10036a6f
mov edi, str.OperatingSystem
lea eax, [esp + 0x514]
lea esp, [esp]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x100369f0
cmp cl, bl
je 0x100369ec
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x100369f0
add eax, 2
add edi, 2
cmp cl, bl
jne 0x100369d0
xor eax, eax
jmp 0x100369f5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x10036a6f
push 0x74
call fcn.100f4579
add esp, 4
cmp eax, ebx
je 0x10036a10
call fcn.10036270
mov edi, eax
jmp 0x10036a12
xor edi, edi
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0xc8]
push eax
mov ecx, edi
mov dword [esp + 0x34], edi
mov dword [edi + 0x70], esi
call fcn.100057a0
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x90]
lea ecx, [edi + 0x38]
push edx
call fcn.100057a0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x74]
lea ecx, [edi + 0x1c]
push eax
call fcn.100057a0
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xe4]
lea ecx, [edi + 0x54]
push edx
call fcn.100057a0
mov edi, dword [esp + 0x44]
lea eax, [esp + 0x28]
push eax
call fcn.10037470
mov esi, 0x10
cmp dword [esp + 0xbc], esi
jb 0x10036a8d
mov ecx, dword [esp + 0xa8]
push ecx
call fcn.100f4085
add esp, 4
mov edi, 0xf
mov dword [esp + 0xbc], edi
mov dword [esp + 0xb8], ebx
mov byte [esp + 0xa8], bl
cmp dword [esp + 0xf4], esi
jb 0x10036ac0
mov edx, dword [esp + 0xe0]
push edx
call fcn.100f4085
add esp, 4
mov dword [esp + 0xf4], edi
mov dword [esp + 0xf0], ebx
mov byte [esp + 0xe0], bl
cmp dword [esp + 0xa0], esi
jb 0x10036aee
mov eax, dword [esp + 0x8c]
push eax
call fcn.100f4085
add esp, 4
mov dword [esp + 0xa0], edi
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
cmp dword [esp + 0x84], esi
jb 0x10036b19
mov ecx, dword [esp + 0x70]
push ecx
call fcn.100f4085
add esp, 4
mov dword [esp + 0xb28], 0xffffffff
mov dword [esp + 0x84], edi
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
cmp dword [esp + 0xd8], esi
jb 0x10036b4f
mov edx, dword [esp + 0xc4]
push edx
call fcn.100f4085
add esp, 4
mov eax, dword [esp + 0x20]
inc eax
cmp eax, dword [esp + 0x38]
mov dword [esp + 0x20], eax
jl 0x10036370
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
mov dword [esp + 0x20], ebx
cmp edi, ebx
je 0x10037441
lea ecx, [esp + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x10037441
cmp dword [esp + 0x20], ebx
je 0x10037441
push 0x1ff
lea edx, [esp + 0x519]
push ebx
push edx
mov dword [esp + 0x38], 0x200
mov byte [esp + 0x520], bl
call fcn.100f8db0
add esp, 0xc
lea eax, [esp + 0x24]
push eax
push 0x20119
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10037436
mov edx, dword [esp + 0x24]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x48]
push ecx
push ebx
push ebx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x10037436
cmp dword [esp + 0x2c], ebx
mov dword [esp + 0x28], eax
jle 0x10037436
lea ebx, [ebx]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x528]
push edx
push eax
mov eax, dword [esp + 0x40]
mov edi, 0x200
push eax
mov dword [esp + 0x34], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push ecx
push 0x20119
push ebx
lea edx, [esp + 0x520]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10037423
lea ecx, [esp + 0x48]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x44]
push eax
push ebx
push str.SystemComponent
push ecx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x60], edi
call esi
cmp dword [esp + 0x20], 1
je 0x10037423
mov eax, 0xf
mov dword [esp + 0x110], eax
mov dword [esp + 0x10c], ebx
mov byte [esp + 0xfc], bl
mov dword [esp + 0xb28], 5
mov dword [esp + 0xa0], eax
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
mov dword [esp + 0xbc], eax
mov dword [esp + 0xb8], ebx
mov byte [esp + 0xa8], bl
mov dword [esp + 0x84], eax
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
push 0x1ff
lea edx, [esp + 0x119]
push ebx
mov byte [esp + 0xb30], 8
push edx
mov byte [esp + 0x120], bl
call fcn.100f8db0
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x24]
push edx
push ebx
push str.DisplayName
push eax
mov dword [esp + 0x2c], edi
call esi
push 0x1015f040
lea ecx, [esp + 0xc4]
push str.Software_
push ecx
call fcn.1000d3e0
add esp, 0xc
mov byte [esp + 0xb28], 9
mov edi, 0x1013e2a2
lea eax, [esp + 0x114]
lea esp, [esp]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x10036db0
cmp cl, bl
je 0x10036dac
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x10036db0
add eax, 2
add edi, 2
cmp cl, bl
jne 0x10036d90
xor eax, eax
jmp 0x10036db5
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x10036e52
cmp dword [esp + 0xd8], 0x10
mov edi, dword [esp + 0xc4]
jae 0x10036dd5
lea edi, [esp + 0xc4]
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea ebx, [ebx]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x10036e00
cmp cl, bl
je 0x10036dfc
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x10036e00
add eax, 2
add edi, 2
cmp cl, bl
jne 0x10036de0
xor eax, eax
jmp 0x10036e05
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x10036e52
lea ecx, [esp + 0xc0]
call fcn.1002b8e0
lea ecx, [esp + 0x6c]
call fcn.1002b8e0
lea ecx, [esp + 0xa4]
call fcn.1002b8e0
lea ecx, [esp + 0x88]
call fcn.1002b8e0
lea ecx, [esp + 0xf8]
mov dword [esp + 0xb28], 0xffffffff
call fcn.1002b8e0
jmp 0x10037423
lea eax, [esp + 0x114]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10036e60
sub eax, edx
push eax
lea edx, [esp + 0x118]
push edx
lea ecx, [esp + 0x100]
call fcn.10004290
push 0x1013e2a2
lea eax, [esp + 0x118]
push 0x200
push eax
mov dword [esp + 0x20], 0x200
call fcn.100f6d20
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0x24]
push eax
push ebx
push str.Publisher
push ecx
call esi
lea eax, [esp + 0x114]
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10036ed0
sub eax, edi
push eax
lea edx, [esp + 0x118]
push edx
lea ecx, [esp + 0x90]
call fcn.10004290
push 9
push ebx
push 0x10142138
lea ecx, [esp + 0x94]
call fcn.10008220
cmp eax, 0xffffffff
je 0x10036fec
mov esi, 0x10
cmp dword [esp + 0xd8], esi
jb 0x10036f29
mov eax, dword [esp + 0xc4]
push eax
call fcn.100f4085
add esp, 4
mov edi, 0xf
mov dword [esp + 0xd8], edi
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
cmp dword [esp + 0x84], esi
jb 0x10036f59
mov ecx, dword [esp + 0x70]
push ecx
call fcn.100f4085
add esp, 4
mov dword [esp + 0x84], edi
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
cmp dword [esp + 0xbc], esi
jb 0x10036f84
mov edx, dword [esp + 0xa8]
push edx
call fcn.100f4085
add esp, 4
mov dword [esp + 0xbc], edi
mov dword [esp + 0xb8], ebx
mov byte [esp + 0xa8], bl
cmp dword [esp + 0xa0], esi
jb 0x10036fb2
mov eax, dword [esp + 0x8c]
push eax
call fcn.100f4085
add esp, 4
mov dword [esp + 0xb28], 0xffffffff
mov dword [esp + 0xa0], edi
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
cmp dword [esp + 0x110], esi
jb 0x10037423
mov ecx, dword [esp + 0xfc]
push ecx
jmp 0x1003741b
push 0x1013e2a2
lea edx, [esp + 0x118]
push 0x200
push edx
mov dword [esp + 0x20], 0x200
call fcn.100f6d20
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x24]
push edx
push ebx
push 0x10142144
push eax
mov dword [esp + 0x4c], ebx
call edi
mov esi, dword [esp + 0x34]
push 0x1013e2a2
lea ecx, [esp + 0x118]
push 0x200
push ecx
mov dword [esp + 0x20], 0x200
call fcn.100f6d20
add esp, 0xc
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x24]
push ecx
push ebx
push str.DisplayVersion
push edx
call edi
mov edi, 0x1013e2a2
lea eax, [esp + 0x114]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x100370a5
cmp cl, bl
je 0x100370a1
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x100370a5
add eax, 2
add edi, 2
cmp cl, bl
jne 0x10037085
xor eax, eax
jmp 0x100370aa
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x100370f7
push 0x1013e2a2
lea eax, [esp + 0x118]
push 0x200
push eax
mov dword [esp + 0x20], 0x200
call fcn.100f6d20
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0x24]
push eax
push ebx
push str.Version
push ecx
call edi
jmp 0x100370fd
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x114]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10037107
sub eax, edx
push eax
lea edx, [esp + 0x118]
push edx
lea ecx, [esp + 0xac]
call fcn.10004290
push 0x1013e2a2
lea eax, [esp + 0x118]
push 0x200
push eax
mov dword [esp + 0x20], 0x200
call fcn.100f6d20
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x118]
push edx
lea eax, [esp + 0x24]
push eax
push ebx
push str.InstallDate
push ecx
call edi
test eax, eax
jne 0x10037177
lea edx, [esp + 0x114]
push edx
jmp 0x10037203
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x4c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
lea edx, [esp + 0xdc]
push edx
lea eax, [esp + 0x50]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x5c]
push ecx
lea edx, [esp + 0xe0]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
push 0x1ff
lea eax, [esp + 0x319]
push ebx
push eax
mov byte [esp + 0x320], bl
call fcn.100f8db0
movzx ecx, word [esp + 0x6e]
movzx edx, word [esp + 0x6a]
movzx eax, word [esp + 0x68]
add esp, 0xc
push ecx
push edx
push eax
push str._d_02d_02d
lea edx, [esp + 0x324]
call fcn.10037780
add esp, 0x10
lea ecx, [esp + 0x314]
push ecx
lea ecx, [esp + 0x70]
call fcn.10004370
push 0x1013e2a2
lea edx, [esp + 0x118]
push 0x200
push edx
mov dword [esp + 0x20], 0x200
call fcn.100f6d20
add esp, 0xc
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x118]
push ecx
lea edx, [esp + 0x24]
push edx
push ebx
push str.ParentKeyName
push eax
call edi
push 0x1ff
lea ecx, [esp + 0x919]
push ebx
push ecx
mov byte [esp + 0x920], bl
call fcn.100f8db0
add esp, 0xc
lea edx, [esp + 0x114]
push edx
lea eax, [esp + 0x918]
push 0x200
push eax
call fcn.100f6d20
add esp, 0xc
cmp esi, ebx
jne 0x100372cd
cmp dword [esp + 0x10c], ebx
jbe 0x10037343
mov edi, str.OperatingSystem
lea eax, [esp + 0x914]
mov cl, byte [eax]
cmp cl, byte [edi]
jne 0x100372c4
cmp cl, bl
je 0x100372c0
mov cl, byte [eax + 1]
cmp cl, byte [edi + 1]
jne 0x100372c4
add eax, 2
add edi, 2
cmp cl, bl
jne 0x100372a4
xor eax, eax
jmp 0x100372c9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x10037343
push 0x74
call fcn.100f4579
add esp, 4
cmp eax, ebx
je 0x100372e4
call fcn.10036270
mov edi, eax
jmp 0x100372e6
xor edi, edi
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x100]
push ecx
mov ecx, edi
mov dword [esp + 0x48], edi
mov dword [edi + 0x70], esi
call fcn.100057a0
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0xac]
lea ecx, [edi + 0x38]
push edx
call fcn.100057a0
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x90]
lea ecx, [edi + 0x1c]
push eax
call fcn.100057a0
push 0xffffffffffffffff
push ebx
lea edx, [esp + 0x74]
lea ecx, [edi + 0x54]
push edx
call fcn.100057a0
mov edi, dword [esp + 0x44]
lea eax, [esp + 0x3c]
push eax
call fcn.10037470
mov esi, 0x10
cmp dword [esp + 0xd8], esi
jb 0x10037361
mov ecx, dword [esp + 0xc4]
push ecx
call fcn.100f4085
add esp, 4
mov edi, 0xf
mov dword [esp + 0xd8], edi
mov dword [esp + 0xd4], ebx
mov byte [esp + 0xc4], bl
cmp dword [esp + 0x84], esi
jb 0x10037391
mov edx, dword [esp + 0x70]
push edx
call fcn.100f4085
add esp, 4
mov dword [esp + 0x84], edi
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
cmp dword [esp + 0xbc], esi
jb 0x100373bc
mov eax, dword [esp + 0xa8]
push eax
call fcn.100f4085
add esp, 4
mov dword [esp + 0xbc], edi
mov dword [esp + 0xb8], ebx
mov byte [esp + 0xa8], bl
cmp dword [esp + 0xa0], esi
jb 0x100373ea
mov ecx, dword [esp + 0x8c]
push ecx
call fcn.100f4085
add esp, 4
mov dword [esp + 0xb28], 0xffffffff
mov dword [esp + 0xa0], edi
mov dword [esp + 0x9c], ebx
mov byte [esp + 0x8c], bl
cmp dword [esp + 0x110], esi
jb 0x10037423
mov edx, dword [esp + 0xfc]
push edx
call fcn.100f4085
add esp, 4
mov eax, dword [esp + 0x28]
inc eax
cmp eax, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
jl 0x10036c30
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xb20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xb08]
xor ecx, esp
call fcn.100f30a6
mov esp, ebp
pop ebp
ret