Function at 0x46d650
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c2592
mov eax, dword fs:[0]
push eax
sub esp, 0x4c0
mov eax, dword [0x50c080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x498], ecx
mov al, byte [ebp + 8]
lea ecx, [ebp - 0x490]
mov byte [ebp - 0x491], al
movzx eax, al
inc eax
mov dword [ebp - 0x490], 0
push ecx
shl eax, 8
or eax, 0x20019
push eax
push 0
push str.SOFTWAREMICROSOFTWINDOWSCURRENTVERSIONUNINSTALL
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x46ddad
push 0x200
xor ebx, ebx
lea eax, [ebp - 0x214]
push ebx
push eax
call fcn.00493220
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
add esp, 0xc
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x200
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x46dd9c
mov dword [ebp - 0x48c], eax
lea eax, [ebp - 0x48c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x46dcc5
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x488], 0x200
push eax
lea eax, [ebp - 0x418]
push eax
push 2
push str.DisplayName
push esi
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x46dcb3
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x46d790
sub eax, edx
sar eax, 1
cmp eax, 0xc
jb 0x46d7ce
mov esi, 0xc
xor edx, edx
nop dword [eax + eax]
movzx ecx, word [ebp + edx - 0x414]
movzx eax, word [edx + 0x4ee540]
cmp cx, ax
jne 0x46d7d7
add edx, 2
sub esi, 1
jne 0x46d7b0
jmp 0x46d800
cmp eax, 0xa
jb 0x46db12
mov esi, 0xa
xor edx, edx
nop
movzx ecx, word [ebp + edx - 0x414]
movzx eax, word [edx + str.ThreatDown]
cmp cx, ax
jne 0x46db12
add edx, 2
sub esi, 1
jne 0x46d7e0
lea ecx, [ebp - 0x484]
call fcn.0046d530
lea ecx, [ebp - 0x414]
mov dword [ebp - 4], 0
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d820
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x468]
call fcn.0040db20
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d850
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x480]
call fcn.0040db20
mov al, byte [ebp - 0x491]
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 0x420], al
call fcn.00467cf0
mov byte [ebp - 4], 1
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x46d898
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.D:JenkinsworkspaceN_SUCommon_VS2022_srcSUCommonInstalledProducts.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
cmp byte [ebp - 0x491], 0
mov ecx, str.__64_
mov esi, str.__32_
cmove esi, ecx
mov ecx, eax
push 0x3a
call fcn.0040f7e0
mov edx, str.:_Found
mov ecx, eax
call fcn.00411050
lea edx, [ebp - 0x414]
mov ecx, eax
call fcn.0041b9a0
mov edx, str._installed_as
mov ecx, eax
call fcn.00411050
lea edx, [ebp - 0x214]
mov ecx, eax
call fcn.0041b9a0
mov edx, esi
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 0
add esp, 4
mov ecx, dword [ebp - 0x49c]
cmp ecx, 7
jbe 0x46d965
mov edx, dword [ebp - 0x4b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x46d95b
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46de7e
push ecx
push edx
call fcn.00490f7d
add esp, 8
lea eax, [ebp - 0x488]
mov dword [ebp - 0x488], 0x200
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
push eax
push 2
push str.DisplayVersion
push 0
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x46d9c4
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46d9a2
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.0040db20
lea eax, [ebp - 0x488]
push eax
push 0
lea eax, [ebp - 0x418]
push eax
push 2
push str.InstallLocation
push 0
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x46da58
mov eax, dword [ebp - 0x488]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004911c6
add esp, 4
mov esi, eax
lea eax, [ebp - 0x488]
push eax
push esi
lea eax, [ebp - 0x418]
push eax
push 2
push str.InstallLocation
push 0
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x46da4f
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46da33
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x438]
call fcn.0040db20
push esi
call fcn.00490f8b
add esp, 4
lea ecx, [ebp - 0x4b0]
call fcn.00467cf0
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x46da72
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.D:JenkinsworkspaceN_SUCommon_VS2022_srcSUCommonInstalledProducts.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0x49
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_DisplayVersion
mov ecx, eax
call fcn.00411050
cmp dword [ebp - 0x43c], 7
lea edx, [ebp - 0x450]
push dword [ebp - 0x440]
cmova edx, dword [ebp - 0x450]
mov ecx, eax
call fcn.00412550
add esp, 4
mov edx, str.__InstallLocation
mov ecx, eax
call fcn.00411050
cmp dword [ebp - 0x424], 7
lea edx, [ebp - 0x438]
push dword [ebp - 0x428]
cmova edx, dword [ebp - 0x438]
mov ecx, eax
call fcn.00412550
add esp, 4
push eax
call fcn.004113d0
mov byte [ebp - 4], 0
jmp 0x46dc49
lea eax, [ebp - 0x214]
push str.949D1792_E377_4348_8BC4_6D643EF49B21
push eax
call fcn.0049adec
add esp, 8
test eax, eax
jne 0x46dcb3
lea ecx, [ebp - 0x484]
call fcn.0046d530
push 0x19
push str.ThreatDown_Endpoint_Agent
lea ecx, [ebp - 0x468]
mov dword [ebp - 4], 3
call fcn.0040db20
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x46db60
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x480]
call fcn.0040db20
mov al, byte [ebp - 0x491]
lea ecx, [ebp - 0x4b0]
mov byte [ebp - 0x420], al
call fcn.00467cf0
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x46dba8
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.D:JenkinsworkspaceN_SUCommon_VS2022_srcSUCommonInstalledProducts.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0x52
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Found
mov ecx, eax
call fcn.00411050
cmp dword [ebp - 0x454], 7
lea edx, [ebp - 0x468]
push dword [ebp - 0x458]
cmova edx, dword [ebp - 0x468]
mov ecx, eax
call fcn.00412550
add esp, 4
mov ecx, str.__64_
cmp byte [ebp - 0x491], 0
mov esi, str.__32_
mov edx, str._installed_as
cmove esi, ecx
mov ecx, eax
call fcn.00411050
lea edx, [ebp - 0x214]
mov ecx, eax
call fcn.0041b9a0
mov edx, esi
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x49c]
add esp, 4
cmp ecx, 7
jbe 0x46dc8c
mov edx, dword [ebp - 0x4b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x46dc82
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46de7e
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov ecx, dword [ebp - 0x498]
lea eax, [ebp - 0x484]
push eax
lea ecx, [ecx + 4]
call fcn.0046fec0
lea ecx, [ebp - 0x484]
mov dword [ebp - 4], 0xffffffff
call fcn.00462420
push dword [ebp - 0x48c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
jmp 0x46d6e4
lea ecx, [ebp - 0x4b0]
call fcn.00467cf0
mov dword [ebp - 4], 5
cmp dword [eax + 0x14], 7
mov edi, dword [eax + 0x10]
jbe 0x46dce2
mov eax, dword [eax]
push edi
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.D:JenkinsworkspaceN_SUCommon_VS2022_srcSUCommonInstalledProducts.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0x5a
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Error_opening_uninstall_key__
mov ecx, eax
call fcn.00411050
lea edx, [ebp - 0x214]
mov ecx, eax
call fcn.0041b9a0
mov edx, 0x4f8f08
mov ecx, eax
call fcn.00411050
push esi
mov ecx, eax
call fcn.0041b750
mov edx, 0x4f8f04
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov ecx, dword [ebp - 0x49c]
cmp ecx, 7
jbe 0x46dd9c
mov edx, dword [ebp - 0x4b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x46dd92
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46de7e
push ecx
push edx
call fcn.00490f7d
add esp, 8
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46de60
lea ecx, [ebp - 0x4c8]
call fcn.00467cf0
mov dword [ebp - 4], 6
cmp dword [eax + 0x14], 7
mov ecx, dword [eax + 0x10]
jbe 0x46ddca
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x50f6d0
call fcn.00412550
add esp, 4
mov edx, str.D:JenkinsworkspaceN_SUCommon_VS2022_srcSUCommonInstalledProducts.cpp
mov ecx, eax
call fcn.00411050
mov edx, 0x4ec568
mov ecx, eax
call fcn.00411050
push 0x62
mov ecx, eax
call fcn.0040f7e0
mov edx, str.:_Error_opening_root_uninstall_key__
mov ecx, eax
call fcn.00411050
push esi
mov ecx, eax
call fcn.0041b750
mov edx, 0x4f8f04
mov ecx, eax
call fcn.00411050
push eax
call fcn.004113d0
mov ecx, dword [ebp - 0x4b4]
add esp, 4
cmp ecx, 7
jbe 0x46de60
mov edx, dword [ebp - 0x4c8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x46de56
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46de83
push ecx
push edx
call fcn.00490f7d
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00490c46
mov esp, ebp
pop ebp
ret 4
call fcn.004961af
call fcn.004961af
int3