Function at 0x10098920
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x806c
call fcn.10126240
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x8068], eax
push ebx
push esi
xor ebx, ebx
push 0xfff
lea eax, [esp + 0x7075]
push ebx
push eax
mov byte [esp + 0x707c], bl
call fcn.10116880
push 0xfff
lea ecx, [esp + 0x451]
push ebx
push ecx
mov byte [esp + 0x458], bl
call fcn.10116880
push 0xfff
lea edx, [esp + 0x2c7d]
push ebx
push edx
mov byte [esp + 0x2c84], bl
call fcn.10116880
push 0xfff
lea eax, [esp + 0x5099]
push ebx
push eax
mov byte [esp + 0x50a0], bl
call fcn.10116880
push 0xfff
lea ecx, [esp + 0x60a5]
push ebx
push ecx
mov byte [esp + 0x60ac], bl
call fcn.10116880
push 0xfff
lea edx, [esp + 0x40b1]
push ebx
push edx
mov byte [esp + 0x40b8], bl
call fcn.10116880
or esi, 0xffffffff
add esp, 0x48
cmp dword [0x1018e0b4], esi
jne 0x100989fa
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, esi
jne 0x100989fa
mov dword [0x1018e0b4], ebx
cmp dword [0x1018e11c], esi
jne 0x10098a0c
call fcn.1004f190
mov dword [0x1018e11c], eax
cmp dword [0x10191cb8], ebx
jne 0x100992cd
push ebp
push edi
push str.ModuleUsage_x64_RegKey...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
lea eax, [esp + 0x454]
push str.SoftwareMicrosoftWindowsCurrentVersionModuleUsage
push eax
call fcn.1010d6a8
lea ecx, [esp + 0x45c]
push ecx
lea edx, [esp + 0x2c80]
push str.HKLM64_s
push edx
call fcn.1010d6a8
add esp, 0x20
lea eax, [esp + 0x10]
push eax
push 0x20119
lea ecx, [esp + 0x450]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10062150
test eax, eax
jne 0x10098bcf
xor edi, edi
cmp dword [0x10191cb8], ebx
jne 0x10098bcf
jmp 0x10098aa0
mov eax, dword [esp + 0x10]
push 0x410
lea edx, [esp + 0x144c]
push edx
push edi
push eax
mov byte [esp + 0x1458], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x10098bc4
cmp dword [0x10191874], ebx
je 0x10098adb
push 0x10191c8c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea ecx, [esp + 0x1448]
push ecx
lea edx, [esp + 0x607c]
mov ebp, 1
add dword [0x10191cbc], ebp
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x1448]
push 0x2f
push eax
call fcn.1010d780
add esp, 8
cmp eax, ebx
je 0x10098b25
mov byte [eax], 0x5c
inc eax
push 0x2f
push eax
call fcn.1010d780
add esp, 8
cmp eax, ebx
jne 0x10098b12
lea ecx, [esp + 0x24]
push ecx
mov dword [esp + 0x28], ebx
call fcn.1004f240
add esp, 4
test eax, eax
je 0x10098b61
push ebx
push ebx
xor edx, edx
lea ecx, [esp + 0x1450]
call fcn.10044660
mov edx, dword [esp + 0x2c]
push edx
mov esi, eax
call fcn.1004f2c0
add esp, 0xc
cmp esi, ebx
jne 0x10098b61
add edi, ebp
jmp 0x10098bb6
cmp dword [0x10191874], ebx
je 0x10098b74
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cc4], ebp
cmp dword [0x1018e0b4], 0xffffffff
jne 0x10098b98
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x10098b98
mov dword [0x1018e0b4], ebx
push ebx
push ebp
push 6
lea ecx, [esp + 0x2c74]
lea ebx, [esp + 0x1454]
call fcn.10093730
add esp, 0xc
add edi, ebp
xor ebx, ebx
cmp dword [0x10191cb8], ebx
je 0x10098aa0
jmp 0x10098bcf
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SharedDLL_x64_RegKey...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
lea ecx, [esp + 0x454]
push str.SoftwareMicrosoftWindowsCurrentVersionSharedDlls
push ecx
call fcn.1010d6a8
lea edx, [esp + 0x45c]
push edx
lea eax, [esp + 0x2c80]
push str.HKLM64_s
push eax
call fcn.1010d6a8
add esp, 0x20
lea ecx, [esp + 0x10]
push ecx
push 0x20119
lea edx, [esp + 0x450]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10062150
test eax, eax
jne 0x10098d70
xor ebp, ebp
cmp dword [0x10191cb8], ebx
jne 0x10098d70
lea esp, [esp]
mov eax, 0x1000
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x144c]
push ecx
lea edx, [esp + 0x3c]
push edx
mov edx, dword [esp + 0x1c]
push ebx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x408c]
push ecx
push ebp
push edx
mov byte [esp + 0x1468], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x10098d65
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x24], ebx
call fcn.1004f240
add esp, 4
test eax, eax
je 0x10098cd6
push ebx
push ebx
xor edx, edx
lea ecx, [esp + 0x4080]
call fcn.10044660
mov ecx, dword [esp + 0x28]
push ecx
mov esi, eax
call fcn.1004f2c0
add esp, 0xc
cmp esi, ebx
jne 0x10098cd6
inc ebp
jmp 0x10098d57
lea edx, [esp + 0x4078]
push edx
lea eax, [esp + 0x2a64]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edi, edi
lea esi, [esp + 0x2a60]
call fcn.10014dd0
cmp eax, 1
jne 0x10098d02
inc ebp
jmp 0x10098d57
cmp dword [0x10191874], ebx
je 0x10098d15
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
inc dword [0x10191cc4]
cmp dword [0x1018e0b4], 0xffffffff
jne 0x10098d39
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x10098d39
mov dword [0x1018e0b4], ebx
push ebx
push 2
push 8
lea ecx, [esp + 0x2c74]
lea ebx, [esp + 0x4084]
call fcn.10093730
add esp, 0xc
inc ebp
xor ebx, ebx
cmp dword [0x10191cb8], ebx
je 0x10098c50
jmp 0x10098d70
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Checking_x64_App_Path_Entries...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
lea edx, [esp + 0x454]
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
push edx
call fcn.1010d6a8
lea eax, [esp + 0x45c]
push eax
lea ecx, [esp + 0x2c80]
push str.HKLM64_s
push ecx
call fcn.1010d6a8
lea edx, [esp + 0x468]
push edx
lea eax, [esp + 0x509c]
push str.HKLM64_s
push eax
call fcn.1010d6a8
add esp, 0x2c
lea ecx, [esp + 0x10]
push ecx
push 0x20119
lea edx, [esp + 0x450]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10062150
test eax, eax
jne 0x10098f5e
mov dword [esp + 0x14], ebx
cmp dword [0x10191cb8], ebx
jne 0x10098f5e
jmp 0x10098e10
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push 0x410
lea eax, [esp + 0x144c]
push eax
push ecx
push edx
mov byte [esp + 0x1458], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x10098f53
lea eax, [esp + 0x28]
push eax
push 9
push ebx
mov ebp, 1
add dword [0x10191cbc], ebp
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x1454]
push ecx
push edx
mov byte [esp + 0x245c], bl
mov dword [esp + 0x40], 0x410
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x10098f41
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x244c]
push ecx
push ebx
push ebx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10098f36
cmp byte [esp + 0x2449], 0x3a
jne 0x10098f36
lea edi, [esp + 0x2448]
call fcn.10014390
test eax, eax
jne 0x10098f36
mov eax, edi
push eax
lea ecx, [esp + 0x3c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edi, edi
lea esi, [esp + 0x38]
call fcn.10014dd0
test eax, eax
jne 0x10098f36
mov ecx, esi
call fcn.10044a30
test eax, eax
jne 0x10098f36
lea edx, [esp + 0x1448]
push edx
lea eax, [esp + 0x44c]
push eax
lea ecx, [esp + 0x2c70]
push str.HKLM64_s_s
push ecx
call fcn.1010d6a8
add dword [0x10191cc4], ebp
call fcn.100935b0
mov edx, esi
push edx
push ebp
push 0xe
lea ecx, [esp + 0x5094]
lea ebx, [esp + 0x1464]
call fcn.10093730
add esp, 0x1c
xor ebx, ebx
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add dword [esp + 0x14], ebp
cmp dword [0x10191cb8], ebx
je 0x10098e10
jmp 0x10098f5e
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Installer_x64_RegKey...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
lea edx, [esp + 0x454]
push str.SoftwareMicrosoftWindowsCurrentVersionInstallerFolders
push edx
call fcn.1010d6a8
lea eax, [esp + 0x45c]
push eax
lea ecx, [esp + 0x2c80]
push str.HKLM64_s
push ecx
call fcn.1010d6a8
add esp, 0x20
lea edx, [esp + 0x10]
push edx
push 0x20119
lea eax, [esp + 0x450]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10062150
test eax, eax
jne 0x10099118
xor esi, esi
cmp dword [0x10191cb8], ebx
jne 0x10099118
jmp 0x10098fe0
push 0x40f
lea ecx, [esp + 0x3c6d]
push ebx
push ecx
mov byte [esp + 0x3c74], bl
call fcn.10116880
add esp, 0xc
mov eax, 0x1000
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x144c]
push eax
lea ecx, [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x1c]
push ebx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x408c]
push eax
push esi
push ecx
mov byte [esp + 0x1468], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1009910d
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x4078]
push edx
lea eax, [esp + 0x3c6c]
push eax
call edi
lea ecx, [esp + 0x4078]
call fcn.10044a30
cmp eax, 1
jne 0x10099074
inc esi
jmp 0x100990ff
lea ecx, [esp + 0x4078]
push ecx
lea edx, [esp + 0x244]
push edx
call edi
lea eax, [esp + 0x240]
push eax
call fcn.10014290
add esp, 4
lea ecx, [esp + 0x240]
call fcn.10044a30
cmp eax, 1
jne 0x100990aa
inc esi
jmp 0x100990ff
cmp dword [0x10191874], ebx
je 0x100990bd
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
inc dword [0x10191cc4]
cmp dword [0x1018e0b4], 0xffffffff
jne 0x100990e1
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x100990e1
mov dword [0x1018e0b4], ebx
push ebx
push 2
push 9
lea ecx, [esp + 0x2c74]
lea ebx, [esp + 0x4084]
call fcn.10093730
add esp, 0xc
inc esi
xor ebx, ebx
cmp dword [0x10191cb8], ebx
je 0x10098fe0
jmp 0x10099118
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.ARPCache_x64_RegKey...
push str.Scanning__s
call fcn.1010e391
push 0x10149d6c
call fcn.1010e391
lea edx, [esp + 0x454]
push str.SoftwareMicrosoftWindowsCurrentVersionApp_ManagementARPCache
push edx
call fcn.1010d6a8
lea eax, [esp + 0x45c]
push eax
lea ecx, [esp + 0x2c80]
push str.HKLM64_s
push ecx
call fcn.1010d6a8
lea edx, [esp + 0x468]
push edx
lea eax, [esp + 0x509c]
push str.HKLM64_s
push eax
call fcn.1010d6a8
add esp, 0x2c
lea ecx, [esp + 0x10]
push ecx
push 0x20119
lea edx, [esp + 0x450]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10062150
test eax, eax
jne 0x100992cb
xor edi, edi
cmp dword [0x10191cb8], ebx
jne 0x100992cb
lea esp, [esp]
mov ecx, dword [esp + 0x10]
push 0x410
lea eax, [esp + 0x144c]
push eax
push edi
push ecx
mov byte [esp + 0x1458], bl
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x100992c0
cmp dword [0x10191874], ebx
je 0x100991eb
push 0x10191c8c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
lea edx, [esp + 0x1448]
push edx
lea eax, [esp + 0x285c]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_s
mov esi, 1
add dword [0x10191cbc], esi
push eax
call fcn.1010d6a8
add esp, 0xc
lea ecx, [esp + 0x30]
push ecx
push 0x20119
lea edx, [esp + 0x2860]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10062150
test eax, eax
je 0x100992a5
lea eax, [esp + 0x448]
push eax
lea ecx, [esp + 0x2c6c]
push str.HKLM_s
push ecx
call fcn.1010d6a8
add esp, 0xc
cmp dword [0x10191874], ebx
je 0x10099263
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cc4], esi
cmp dword [0x1018e0b4], 0xffffffff
jne 0x10099287
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x10099287
mov dword [0x1018e0b4], ebx
push ebx
push esi
push 0xb
lea ecx, [esp + 0x5084]
lea ebx, [esp + 0x1454]
call fcn.10093730
add esp, 0xc
xor ebx, ebx
jmp 0x100992b0
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, esi
cmp dword [0x10191cb8], ebx
je 0x100991b0
jmp 0x100992cb
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
mov ecx, dword [esp + 0x8070]
pop esi
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x806c
ret