Function at 0x406aea
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x384
mov eax, 0x420f3a
call fcn.0040daee
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 0x388], ebx
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
mov dword [ebp - 0x390], esi
mov byte [esi], bl
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x374]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
mov dword [ebp - 0x388], 1
mov dword [ebp - 0x374], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x406d7c
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x37c]
push eax
lea eax, [ebp - 0x31c]
push eax
push ebx
push dword [ebp - 0x374]
mov dword [ebp - 0x380], ebx
mov dword [ebp - 0x37c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edi, 0x103
jmp 0x406d74
cmp eax, ebx
jne 0x406d40
lea eax, [ebp - 0x378]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 0x374]
mov dword [ebp - 0x378], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406d40
push 0x104
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.0040d580
push 0x104
lea eax, [ebp - 0x114]
push ebx
push eax
call fcn.0040d580
add esp, 0x18
lea eax, [ebp - 0x38c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push str.ConsoleBrand
push dword [ebp - 0x378]
mov dword [ebp - 0x38c], edi
mov dword [ebp - 0x384], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x406c38
lea eax, [ebp - 0x384]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push ebx
push str.ConsoleExePath
push dword [ebp - 0x378]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x378]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x340], 0xf
mov dword [ebp - 0x344], ebx
mov byte [ebp - 0x354], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x406c63
sub eax, ecx
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x354]
call fcn.0040440d
mov dword [ebp - 4], 1
lea eax, [ebp - 0x114]
mov dword [ebp - 0x324], 0xf
mov dword [ebp - 0x328], ebx
mov byte [ebp - 0x338], bl
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x406ca5
sub eax, ecx
push eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x338]
call fcn.0040440d
mov byte [ebp - 4], 2
cmp dword [ebp - 0x344], ebx
je 0x406d1d
cmp dword [ebp - 0x328], ebx
je 0x406d1d
push ebx
lea edx, [ebp - 0x338]
lea ecx, [ebp - 0x370]
call fcn.00407319
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x370]
call fcn.00409000
test al, al
je 0x406d0b
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x338]
push eax
mov ecx, esi
call fcn.00401f10
mov byte [ebp - 4], 2
push ebx
push 1
lea ecx, [ebp - 0x370]
call fcn.004014d0
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp - 0x338]
call fcn.00401480
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp - 0x354]
call fcn.00401480
inc dword [ebp - 0x380]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x37c]
push eax
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 0x380]
mov dword [ebp - 0x37c], 0x104
push dword [ebp - 0x374]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, edi
jne 0x406b89
cmp dword [ebp - 0x374], ebx
je 0x406d90
push dword [ebp - 0x374]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.0040db71
ret