Function at 0x40c2c8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff01c
push ebx
push esi
push edi
lea esi, [ebp - 0xfe4]
call fcn.00423d14
test al, al
jne 0x40c57a
cmp dword [ebp + 8], 0
je 0x40c57a
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x40c57a
push esi
mov esi, 0x4c0618
lea edi, [ebp - 0x7e4]
mov ecx, 0x1f4
rep movsd dword es:[edi], dword [esi]
pop esi
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
push edx
push 9
push 0
mov ecx, dword [ebp + 8]
push ecx
push reloc.OLEAUT32.DLL_SysReAllocString
call fcn.004117d8
add esp, 0x14
test eax, eax
jne 0x40c558
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x40c542
push esi
mov esi, 0x4c0de9
lea edi, [ebp - 0x9e4]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
pop esi
mov eax, pe_nt_image_headers32
push eax
lea edx, [ebp - 0x9e4]
push edx
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
push ecx
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.DLL_RegEnumKeyA
test eax, eax
jne 0x40c54f
push esi
mov esi, 0x4c0fea
lea edi, [ebp - 0xbe4]
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
pop esi
push pe_nt_image_headers32
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0xbe4]
push edx
call fcn.00411b40
add esp, 0xc
push pe_nt_image_headers32
lea ecx, [ebp - 0xbe4]
push ecx
call fcn.00412194
add esp, 8
push pe_nt_image_headers32
lea eax, [ebp - 0x9e4]
push eax
lea edx, [ebp - 0xbe4]
push edx
call fcn.00411af8
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0xc], ecx
lea eax, [ebp - 0xc]
push eax
push 9
push 0
lea edx, [ebp - 0xbe4]
push edx
push reloc.OLEAUT32.DLL_SysReAllocString
call fcn.004117d8
add esp, 0x14
test eax, eax
jne 0x40c542
xor ebx, ebx
jmp 0x40c52c
push esi
lea edi, [ebp - 0xde4]
mov esi, 0x4c11eb
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
pop esi
mov ecx, 0x80
mov dword [ebp - 0x10], pe_nt_image_headers32
push esi
mov edi, esi
mov esi, 0x4c13ec
lea eax, [ebp - 0x14]
rep movsd dword es:[edi], dword [esi]
pop esi
lea edx, [ebp - 0x10]
mov dword [ebp - 0x14], pe_nt_image_headers32
push eax
push esi
push 0
push 0
push edx
lea ecx, [ebp - 0xde4]
mov eax, ebx
push ecx
push eax
inc ebx
mov edx, dword [ebp - 0xc]
push edx
call sub.ADVAPI32.DLL_RegEnumValueA
cmp eax, 0x103
je 0x40c539
test eax, eax
jne 0x40c52c
push str.DisplayName
lea ecx, [ebp - 0xde4]
push ecx
call fcn.0048c010
add esp, 8
test eax, eax
jne 0x40c52c
cmp byte [esi], 0
je 0x40c52c
push 0x4c15fa
push esi
call fcn.0048bf69
add esp, 8
test eax, eax
jne 0x40c52c
lea eax, [ebp - 0x7e4]
push eax
call fcn.0048be70
pop ecx
mov edi, eax
push 0x4c15fe
call fcn.0048be70
pop ecx
add edi, eax
push esi
call fcn.0048be70
pop ecx
add edi, eax
add edi, edi
cmp edi, 0x1f4
jb 0x40c4fe
cmp byte [ebp - 0x7e4], 0
je 0x40c4fe
lea eax, [ebp - 0x7e4]
push eax
push str.INSTALLED_PROGRAMS:
push 0x4c1600
call fcn.00426664
add esp, 0xc
mov byte [ebp - 0x7e4], 0
push 0x7d0
push esi
lea edx, [ebp - 0x7e4]
push edx
call fcn.00411af8
add esp, 0xc
lea ecx, [ebp - 0x7e4]
push 0x7d0
push 0x4c15fe
push ecx
call fcn.00411af8
add esp, 0xc
call fcn.00423d14
test al, al
je 0x40c405
mov eax, dword [ebp - 0xc]
push eax
call sub.ADVAPI32.DLL_RegCloseKey
call fcn.00423d14
test al, al
je 0x40c341
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.DLL_RegCloseKey
cmp byte [ebp - 0x7e4], 0
je 0x40c57a
lea ecx, [ebp - 0x7e4]
push ecx
push str.INSTALLED_PROGRAMS:
push 0x4c1600
call fcn.00426664
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret