Function at 0x10006aa0
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x788
mov eax, dword [0x1001a280]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xff
lea eax, [ebp - 0x633]
push 0
push eax
mov dword [ebp - 0x770], 1
mov byte [ebp - 0x634], 0
call fcn.10008b90
push 0xff
lea eax, [ebp - 0x233]
push 0
push eax
mov byte [ebp - 0x234], 0
call fcn.10008b90
push 0xff
lea eax, [ebp - 0x533]
push 0
push eax
mov byte [ebp - 0x534], 0
call fcn.10008b90
push 0xff
lea eax, [ebp - 0x433]
push 0
push eax
mov byte [ebp - 0x434], 0
call fcn.10008b90
push 0xff
lea eax, [ebp - 0x133]
push 0
push eax
mov byte [ebp - 0x134], 0
call fcn.10008b90
push 0xff
lea eax, [ebp - 0x333]
push 0
push eax
mov byte [ebp - 0x334], 0
call fcn.10008b90
add esp, 0x48
push 0x400
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x768], eax
test eax, eax
jne 0x10006b83
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008710
mov esp, ebp
pop ebp
ret
mov byte [eax], 0x12
push 0xff
lea eax, [ebp - 0x733]
push 0
push eax
mov dword [ebp - 0x780], 0x100
mov byte [ebp - 0x734], 0
call fcn.10008b90
add esp, 0xc
lea eax, [ebp - 0x774]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10006b73
push ebx
push esi
push edi
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x780]
push eax
push 0
push 0
push 0
push dword [ebp - 0x774]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
test eax, eax
jne 0x10007079
xor eax, eax
mov dword [ebp - 0x778], eax
cmp dword [ebp - 0x780], eax
jle 0x10007079
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x76c]
push ecx
lea ecx, [ebp - 0x734]
push ecx
push eax
push dword [ebp - 0x774]
mov dword [ebp - 0x76c], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [ebp - 0x77c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x734]
push eax
push dword [ebp - 0x774]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10007060
push 0x100
push eax
lea eax, [ebp - 0x234]
push eax
mov dword [ebp - 0x76c], 0x100
call fcn.10008b90
add esp, 0xc
lea eax, [ebp - 0x76c]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x784]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x77c]
call ebx
push 0x100
lea eax, [ebp - 0x634]
push 0
push eax
mov dword [ebp - 0x76c], 0x100
call fcn.10008b90
add esp, 0xc
lea eax, [ebp - 0x76c]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x784]
push eax
push 0
push str.ParentKeyName
push dword [ebp - 0x77c]
call ebx
lea eax, [ebp - 0x234]
push eax
call edi
test eax, eax
je 0x10007060
push str.OperatingSystem
lea eax, [ebp - 0x634]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x10007060
push 0x100
lea eax, [ebp - 0x534]
push 0
push eax
mov dword [ebp - 0x76c], 0x100
call fcn.10008b90
add esp, 0xc
lea eax, [ebp - 0x76c]
push eax
lea eax, [ebp - 0x534]
push eax
lea eax, [ebp - 0x784]
push eax
push 0
push str.Publisher
push dword [ebp - 0x77c]
call ebx
push 0x100
lea eax, [ebp - 0x434]
push 0
push eax
mov dword [ebp - 0x76c], 0x100
call fcn.10008b90
add esp, 0xc
lea eax, [ebp - 0x76c]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x784]
push eax
push 0
push str.DisplayVersion
push dword [ebp - 0x77c]
call ebx
push 0x100
lea eax, [ebp - 0x134]
push 0
push eax
mov dword [ebp - 0x76c], 0x100
call fcn.10008b90
add esp, 0xc
lea eax, [ebp - 0x76c]
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x784]
push eax
push 0
push str.InstallDate
push dword [ebp - 0x77c]
call ebx
test eax, eax
jne 0x10006e38
push 5
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0xc]
push eax
call esi
push 3
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x14]
push eax
call esi
push 3
lea eax, [ebp - 0x12e]
push eax
lea eax, [ebp - 0x1c]
push eax
call esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push str._s__s__s
jmp 0x10006ea0
lea eax, [ebp - 0x24]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x77c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
lea eax, [ebp - 0x754]
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0x744]
push eax
lea eax, [ebp - 0x754]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
movzx eax, word [ebp - 0x73e]
push eax
movzx eax, word [ebp - 0x742]
push eax
movzx eax, word [ebp - 0x744]
push eax
push str._d__02d__02d
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x334]
push 0x100
push 0
push eax
mov dword [ebp - 0x76c], 0x100
call fcn.10008b90
add esp, 0xc
lea eax, [ebp - 0x76c]
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x784]
push eax
push 0
push str.UninstallString
push dword [ebp - 0x77c]
call ebx
lea eax, [ebp - 0x334]
push eax
call edi
mov esi, eax
lea eax, [ebp - 0x134]
push eax
call edi
add esi, eax
lea eax, [ebp - 0x434]
push eax
call edi
add esi, eax
lea eax, [ebp - 0x534]
push eax
call edi
add esi, eax
lea eax, [ebp - 0x234]
push eax
call edi
add esi, 6
add eax, esi
add eax, dword [ebp - 0x770]
mov esi, dword [ebp - 0x768]
push esi
mov dword [ebp - 0x788], eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0x788]
cmp eax, ecx
jae 0x10006f63
push 0x42
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov esi, eax
mov dword [ebp - 0x768], esi
lea eax, [ebp - 0x234]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 0x770]
add eax, esi
push eax
call fcn.10007f70
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
call edi
mov esi, dword [ebp - 0x770]
inc esi
add esi, eax
lea eax, [ebp - 0x534]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x534]
push eax
mov eax, dword [ebp - 0x768]
add eax, esi
push eax
call fcn.10007f70
add esp, 0xc
lea eax, [ebp - 0x534]
push eax
call edi
inc eax
add esi, eax
lea eax, [ebp - 0x434]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x434]
push eax
mov eax, dword [ebp - 0x768]
add eax, esi
push eax
call fcn.10007f70
add esp, 0xc
lea eax, [ebp - 0x434]
push eax
call edi
inc eax
add esi, eax
lea eax, [ebp - 0x134]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x768]
add eax, esi
push eax
call fcn.10007f70
add esp, 0xc
lea eax, [ebp - 0x134]
push eax
call edi
inc eax
add esi, eax
lea eax, [ebp - 0x334]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x334]
push eax
mov eax, dword [ebp - 0x768]
add eax, esi
push eax
call fcn.10007f70
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
call edi
inc esi
add eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [ebp - 0x770], eax
mov eax, dword [ebp - 0x778]
inc eax
mov dword [ebp - 0x778], eax
cmp eax, dword [ebp - 0x780]
jl 0x10006c20
push dword [ebp - 0x774]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.10005010
test eax, eax
je 0x10007515
lea eax, [ebp - 0x774]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000753a
push eax
push eax
push eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x780]
push eax
push 0
push 0
push 0
push dword [ebp - 0x774]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x10007509
mov dword [ebp - 0x788], eax
cmp dword [ebp - 0x780], eax
jle 0x10007509
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x734]
push ecx
push eax
push dword [ebp - 0x774]
mov dword [ebp - 0xc], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x734]
push eax
push dword [ebp - 0x774]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100074ea
push 0x100
push eax
lea eax, [ebp - 0x234]
push eax
mov dword [ebp - 0xc], 0x100
call fcn.10008b90
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x778]
push eax
push 0
push str.DisplayName
push dword [ebp - 0x14]
call ebx
push 0x100
lea eax, [ebp - 0x634]
push 0
push eax
mov dword [ebp - 0xc], 0x100
call fcn.10008b90
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x778]
push eax
push 0
push str.ParentKeyName
push dword [ebp - 0x14]
call ebx
lea eax, [ebp - 0x234]
push eax
call edi
test eax, eax
je 0x100074ea
push str.OperatingSystem
lea eax, [ebp - 0x634]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x100074ea
push 0x100
lea eax, [ebp - 0x534]
push 0
push eax
mov dword [ebp - 0xc], 0x100
call fcn.10008b90
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x534]
push eax
lea eax, [ebp - 0x778]
push eax
push 0
push str.Publisher
push dword [ebp - 0x14]
call ebx
push 0x100
lea eax, [ebp - 0x434]
push 0
push eax
mov dword [ebp - 0xc], 0x100
call fcn.10008b90
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x778]
push eax
push 0
push str.DisplayVersion
push dword [ebp - 0x14]
call ebx
push 0x100
lea eax, [ebp - 0x134]
push 0
push eax
mov dword [ebp - 0xc], 0x100
call fcn.10008b90
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x778]
push eax
push 0
push str.InstallDate
push dword [ebp - 0x14]
call ebx
test eax, eax
jne 0x100072d4
push 5
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x24]
push eax
call esi
push 3
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x34]
push eax
call esi
push 3
lea eax, [ebp - 0x12e]
push eax
lea eax, [ebp - 0x2c]
push eax
call esi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
push str._s__s__s
jmp 0x1000733f
lea eax, [ebp - 0x73c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
lea eax, [ebp - 0x764]
push eax
lea eax, [ebp - 0x73c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0x754]
push eax
lea eax, [ebp - 0x764]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
movzx eax, word [ebp - 0x74e]
push eax
movzx eax, word [ebp - 0x752]
push eax
movzx eax, word [ebp - 0x754]
push eax
push str._d__02d__02d
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x334]
push 0x100
push 0
push eax
mov dword [ebp - 0xc], 0x100
call fcn.10008b90
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x778]
push eax
push 0
push str.UninstallString
push dword [ebp - 0x14]
call ebx
lea eax, [ebp - 0x334]
push eax
call edi
mov esi, eax
lea eax, [ebp - 0x134]
push eax
call edi
add esi, eax
lea eax, [ebp - 0x434]
push eax
call edi
add esi, eax
lea eax, [ebp - 0x534]
push eax
call edi
add esi, eax
lea eax, [ebp - 0x234]
push eax
call edi
add esi, 6
add eax, esi
add eax, dword [ebp - 0x770]
mov esi, dword [ebp - 0x768]
push esi
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov ecx, dword [ebp - 0x1c]
cmp eax, ecx
jae 0x100073f3
push 0x42
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
mov esi, eax
mov dword [ebp - 0x768], esi
lea eax, [ebp - 0x234]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 0x770]
add eax, esi
push eax
call fcn.10007f70
add esp, 0xc
lea eax, [ebp - 0x234]
push eax
call edi
mov esi, dword [ebp - 0x770]
inc esi
add esi, eax
lea eax, [ebp - 0x534]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x534]
push eax
mov eax, dword [ebp - 0x768]
add eax, esi
push eax
call fcn.10007f70
add esp, 0xc
lea eax, [ebp - 0x534]
push eax
call edi
inc eax
add esi, eax
lea eax, [ebp - 0x434]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x434]
push eax
mov eax, dword [ebp - 0x768]
add eax, esi
push eax
call fcn.10007f70
add esp, 0xc
lea eax, [ebp - 0x434]
push eax
call edi
inc eax
add esi, eax
lea eax, [ebp - 0x134]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x768]
add eax, esi
push eax
call fcn.10007f70
add esp, 0xc
lea eax, [ebp - 0x134]
push eax
call edi
inc eax
add esi, eax
lea eax, [ebp - 0x334]
push eax
call edi
inc eax
push eax
lea eax, [ebp - 0x334]
push eax
mov eax, dword [ebp - 0x768]
add eax, esi
push eax
call fcn.10007f70
add esp, 0xc
lea eax, [ebp - 0x334]
push eax
call edi
inc eax
add eax, esi
mov dword [ebp - 0x770], eax
mov eax, dword [ebp - 0x788]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
inc eax
mov dword [ebp - 0x788], eax
cmp eax, dword [ebp - 0x780]
jl 0x100070f2
push dword [ebp - 0x774]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x42
push dword [ebp - 0x770]
push dword [ebp - 0x768]
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10008710
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.10008710
mov esp, ebp
pop ebp
ret