Function at 0x423870
Capabilities:
Delete registry key
Get installed programs
Query or enumerate registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58b48b
mov eax, dword fs:[0]
push eax
sub esp, 0x43c
mov eax, dword [0x5f0a00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
xor esi, esi
lea ecx, [ebp - 0x428]
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x418], esi
push 0x59a304
movups xmmword [ebp - 0x428], xmm0
mov dword [ebp - 0x414], esi
call fcn.0040b6c0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jne 0x423c59
mov ecx, edi
call fcn.004214a0
test eax, eax
je 0x4238ea
push 0xffffffffffffffff
mov ecx, edi
call fcn.00423870
push 0x34
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [ebp - 0x428]
call fcn.00418d10
cmp dword [edi + 0x94], 7
lea esi, [edi + 0x80]
mov eax, esi
jbe 0x42390f
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x428]
push eax
call fcn.00410b40
cmp dword [ebp - 0x414], 7
lea ecx, [ebp - 0x444]
lea eax, [ebp - 0x428]
cmova eax, dword [ebp - 0x428]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x423950
xor esi, esi
jmp 0x423d99
xorps xmm0, xmm0
mov dword [ebp - 0x430], 0
mov ecx, 7
xor eax, eax
movups xmmword [ebp - 0x440], xmm0
mov dword [ebp - 0x42c], ecx
mov word [ebp - 0x440], ax
lea eax, [edi + 0x68]
mov byte [ebp - 4], 1
lea edx, [ebp - 0x440]
cmp edx, eax
je 0x4239a7
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x423994
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x440]
call fcn.00418d10
mov ecx, dword [ebp - 0x42c]
cmp ecx, 7
lea eax, [ebp - 0x440]
cmova eax, dword [ebp - 0x440]
push eax
lea eax, [ebp - 0x210]
push 0x59ae64
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x210]
add esp, 0xc
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4239d6
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push str.InstallLocation
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [edi + 0xdc], 7
lea ecx, [edi + 0xc8]
jbe 0x423a16
mov ecx, dword [ecx]
cmp dword [ebp - 0x42c], 7
lea eax, [ebp - 0x440]
push ecx
cmova eax, dword [ebp - 0x440]
push eax
lea eax, [ebp - 0x210]
push 0x59b300
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x210]
add esp, 0x10
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x423a50
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push str.DisplayIcon
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [esi + 0x14], 7
jbe 0x423a87
mov esi, dword [esi]
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x210]
push 0x59ae64
push eax
call esi
lea ecx, [ebp - 0x210]
add esp, 0xc
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x423ab0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push str.DisplayName
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [edi + 0x184], 7
lea eax, [edi + 0x170]
jbe 0x423af0
mov eax, dword [eax]
push str.___uninstall
push eax
lea eax, [ebp - 0x210]
push 0x59b470
push eax
call esi
lea ecx, [ebp - 0x210]
add esp, 0x10
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x423b10
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push str.UninstallString
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [edi + 0x14c], 7
lea eax, [edi + 0x138]
jbe 0x423b50
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x210]
push 0x59ae64
push eax
call esi
lea ecx, [ebp - 0x210]
add esp, 0xc
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x423b70
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push str.DisplayVersion
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add edi, 0x98
cmp dword [edi + 0x14], 7
jbe 0x423bad
mov edi, dword [edi]
push edi
lea eax, [ebp - 0x210]
push 0x59ae64
push eax
call esi
lea ecx, [ebp - 0x210]
add esp, 0xc
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x423bd0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x210]
push eax
push 1
push 0
push str.Publisher
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x42c]
mov esi, 1
cmp ecx, 7
jbe 0x423d99
mov edx, dword [ebp - 0x440]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x423c4a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x423df4
push ecx
push edx
call fcn.0055241f
add esp, 8
jmp 0x423d99
cmp eax, 0xffffffff
jne 0x423d99
mov ecx, edi
call fcn.004214a0
test eax, eax
je 0x423d94
push 0x34
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [ebp - 0x428]
call fcn.00418d10
cmp dword [edi + 0x94], 7
lea eax, [edi + 0x80]
mov ecx, dword [eax + 0x10]
jbe 0x423c97
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x428]
call fcn.00410b40
cmp dword [ebp - 0x414], 7
lea ecx, [ebp - 0x444]
push ecx
push 0xf003f
lea eax, [ebp - 0x428]
cmova eax, dword [ebp - 0x428]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x423d71
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x448]
push eax
push 0
push 0
push 0
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x423d65
push 0x200
xor esi, esi
lea eax, [ebp - 0x410]
push esi
push eax
call fcn.00557d70
add esp, 0xc
cmp dword [ebp - 0x448], esi
jbe 0x423d65
nop word [eax + eax]
push 0x100
lea eax, [ebp - 0x410]
push eax
push esi
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x423d5c
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x444]
call edi
inc esi
cmp esi, dword [ebp - 0x448]
jb 0x423d30
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x414], 7
lea eax, [ebp - 0x428]
cmova eax, dword [ebp - 0x428]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call edi
neg eax
sbb esi, esi
inc esi
jmp 0x423d99
mov esi, 1
mov ecx, dword [ebp - 0x414]
cmp ecx, 7
jbe 0x423dd5
mov edx, dword [ebp - 0x428]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x423dcb
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x423df9
push ecx
push edx
call fcn.0055241f
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00551e44
mov esp, ebp
pop ebp
ret 4
call fcn.0055bf8b
call fcn.0055bf8b
int3