Function at 0x403607
Capabilities:
Get installed programs
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x318
push esi
push edi
push 6
mov esi, str.C:Program_FilesWinamp
pop ecx
lea edi, [ebp - 0x110]
rep movsd dword es:[edi], dword [esi]
push 0x3b
xor eax, eax
pop ecx
lea edi, [ebp - 0xf8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x318]
push 0x104
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x318]
push 0x8000
push eax
call fcn.00403045
pop ecx
test eax, eax
pop ecx
je 0x40367a
push 0x30
push str.PIMP_Installer
push str.Installer_corrupted
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40383e
cmp byte [0x406860], 0
je 0x40369b
lea eax, [ebp - 0x110]
push 0x406860
push eax
call fcn.00403287
pop ecx
pop ecx
jmp 0x403805
push ebx
lea eax, [ebp - 4]
mov ebx, 0x20019
push eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, 0x80000002
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push edi
call esi
test eax, eax
jne 0x403713
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x104
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.ProgramFilesDir
mov dword [ebp - 8], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40370a
cmp dword [ebp - 8], 1
jne 0x40370a
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00402fad
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x110]
push eax
call fcn.00402f99
cmp byte [ebp + eax - 0x111], 0x5c
pop ecx
jne 0x40373f
lea eax, [ebp - 0x110]
push eax
call fcn.00402f99
and byte [ebp + eax - 0x111], 0
pop ecx
lea eax, [ebp - 0x110]
push str.Winamp
push eax
call fcn.00402ffa
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push ebx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallWinamp
push edi
call esi
test eax, eax
pop ebx
jne 0x403805
push 1
lea eax, [ebp - 0xc]
pop esi
mov dword [ebp - 0xc], 0x104
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.UninstallString
mov dword [ebp - 8], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4037fc
cmp dword [ebp - 8], esi
jne 0x4037fc
lea eax, [ebp - 0x214]
push eax
call fcn.00402f99
pop ecx
lea eax, [ebp + eax - 0x214]
lea ecx, [ebp - 0x214]
cmp eax, ecx
jb 0x4037fc
cmp byte [eax], 0x5c
je 0x4037cd
dec eax
lea ecx, [ebp - 0x214]
cmp eax, ecx
jae 0x4037bd
lea ecx, [ebp - 0x214]
cmp eax, ecx
jb 0x4037fc
and byte [eax], 0
lea ecx, [ebp - 0x214]
mov al, byte [ecx]
cmp al, 0x20
je 0x4037ea
cmp al, 0x22
jne 0x4037ed
inc ecx
jmp 0x4037e0
lea eax, [ebp - 0x110]
push ecx
push eax
call fcn.00402fad
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp byte [0x406860], al
setne al
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.00403bd9
pop ecx
test eax, eax
pop ecx
jne 0x403836
push 0x30
push 0x406aa0
push str.Installation_aborted
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
xor eax, eax
pop esi
leave
ret 0x10