Function at 0x1000bedc
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x254
mov eax, 0x10085a1e
call fcn.1006d55a
mov ebx, ecx
mov dword [ebp - 0x250], ebx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x248]
push ecx
push dword [ebp + 0xc]
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000c1b2
and dword [ebp - 0x24c], eax
mov esi, dword [0x100c47a0]
push 0x14
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x254], pe_nt_image_headers32
cmp edx, 1
jne 0x1000bfb4
mov eax, esi
cdq
sub eax, edx
mov edi, eax
mov dword [ebp - 0x25c], 0x81
mov eax, dword [ebp - 0x25c]
xor ecx, ecx
sar edi, 1
test edi, edi
jle 0x1000bfa9
mov eax, esi
cdq
and edx, 3
add edx, eax
sar edx, 2
xor ebx, ebx
mov eax, edi
mov dword [ebp - 0x244], edi
test edx, edx
jle 0x1000bf98
mov eax, ebx
mov dword [ebp - 0x258], edx
add dword [ebp - 0x25c], eax
dec eax
dec dword [ebp - 0x258]
jne 0x1000bf83
mov eax, dword [ebp - 0x244]
add ebx, ecx
dec eax
mov dword [ebp - 0x244], eax
jne 0x1000bf77
mov eax, dword [ebp - 0x25c]
inc ecx
cmp ecx, eax
jl 0x1000bf5e
mov ebx, dword [ebp - 0x250]
xor esi, esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000c19f
test eax, eax
jne 0x1000c161
lea eax, [ebp - 0x244]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000c17a
mov esi, dword [0x100c47a0]
push 0x16
lea ecx, [esi + 1]
lea eax, [esi + 2]
imul eax, ecx
imul eax, esi
cdq
pop ecx
idiv ecx
cmp edx, 0xe
jne 0x1000c087
test esi, esi
je 0x1000c087
push 3
pop edi
mov ecx, esi
and ecx, 0x80000001
jns 0x1000c043
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x1000c050
mov eax, esi
cdq
sub eax, edx
mov esi, eax
sar esi, 1
jmp 0x1000c057
lea esi, [esi*2 + 1]
mov eax, esi
cdq
idiv edi
mov dword [0x100c47a0], esi
sub edx, 0
je 0x1000c070
dec edx
dec edx
je 0x1000c073
dec edx
je 0x1000c074
jmp 0x1000c07d
add esi, 2
inc esi
add esi, 2
mov dword [0x100c47a0], esi
test esi, esi
jne 0x1000c034
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x258]
push eax
xor esi, esi
push esi
push str.DisplayName
push dword [ebp - 0x244]
mov dword [ebp - 0x250], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000c159
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x228]
call fcn.10001027
lea eax, [ebp - 0x228]
push eax
mov ecx, ebx
mov dword [ebp - 4], esi
call fcn.1000c291
test al, al
jne 0x1000c14a
lea eax, [ebp - 0x228]
push eax
mov ecx, ebx
call fcn.1000c2fe
cmp byte [ebx + 0x14], 0
je 0x1000c134
lea eax, [ebp - 0x110]
push eax
mov ecx, ebx
call fcn.1000c394
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x240]
call fcn.10001027
push eax
lea ecx, [ebp - 0x228]
call fcn.1000be3e
lea ecx, [ebp - 0x240]
call fcn.10001056
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebx + 0xc]
call fcn.1000c76b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.10001056
push dword [ebp - 0x244]
call edi
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x254], pe_nt_image_headers32
jmp 0x1000c180
mov eax, dword [ebp - 0x24c]
push esi
push esi
push esi
push esi
lea ecx, [ebp - 0x254]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push eax
push dword [ebp - 0x248]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x1000bfe0
push dword [ebp - 0x248]
call edi
call fcn.1006d509
ret 8