Function at 0x49d5e0
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x136c
call fcn.004a9b70
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
xor esi, esi
lea eax, [ebp - 0x10f]
push esi
push eax
mov dword [ebp - 0x1330], 0xffffffff
mov byte [ebp - 0x110], 0
call fcn.004a3190
add esp, 0xc
mov dword [ebp - 0x1348], 0x104
mov dword [ebp - 0x132c], esi
mov dword [ebp - 0x1334], esi
mov ebx, 0xff
cmp dword [ebp - 0x1334], 1
jne 0x49d669
cmp dword [0x4d2afc], 0
je 0x49d920
mov ecx, dword [0x4c6444]
mov dword [ebp - 0x1344], ecx
mov dword [0x4c6444], 0x20119
mov eax, dword [0x4c6444]
lea edx, [ebp - 0x1338]
push edx
push eax
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x49d8e0
lea ecx, [ebp - 0x610]
push ecx
xor ecx, ecx
call fcn.0047ebe0
add esp, 4
lea edx, [ebp - 0x1354]
push edx
lea eax, [ebp - 0x1368]
push eax
lea ecx, [ebp - 0x1358]
push ecx
lea edx, [ebp - 0x1360]
push edx
lea eax, [ebp - 0x134c]
push eax
lea ecx, [ebp - 0x1364]
push ecx
lea edx, [ebp - 0x135c]
push edx
lea eax, [ebp - 0x132c]
push eax
mov eax, dword [ebp - 0x1338]
push esi
lea ecx, [ebp - 0x1348]
push ecx
lea edx, [ebp - 0x110]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x132c], esi
je 0x49d8d3
lea ecx, [ebp - 0x1354]
push ecx
lea edx, [ebp - 0x1340]
push edx
lea eax, [ebp - 0x1328]
push eax
mov eax, dword [ebp - 0x1338]
push 0
lea ecx, [ebp - 0x133c]
push ecx
lea edx, [ebp - 0xf28]
push edx
push esi
push eax
mov dword [ebp - 0x1340], ebx
mov dword [ebp - 0x133c], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, edi
inc esi
inc edi
cmp ecx, dword [ebp - 0x132c]
ja 0x49d8d3
cmp eax, 0x103
je 0x49d8d3
test eax, eax
jne 0x49d704
lea edx, [ebp - 0xf28]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x49d8c8
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov edx, 0x7ffffffe
mov eax, ebx
lea ecx, [ebp - 0x510]
call fcn.00401000
mov eax, ebx
lea ecx, [ebp - 0x510]
cmp byte [ecx], 0
je 0x49d7a1
inc ecx
dec eax
jne 0x49d796
jmp 0x49d7c3
test eax, eax
je 0x49d7c3
mov ecx, ebx
sub ecx, eax
mov eax, ebx
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0x510]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, ebx
lea eax, [ebp - 0x510]
jmp 0x49d7d0
cmp byte [eax], 0
je 0x49d7db
inc eax
dec edx
jne 0x49d7d0
jmp 0x49d7ff
test edx, edx
je 0x49d7ff
lea eax, [ebp - 0xf28]
push eax
mov ecx, ebx
sub ecx, edx
mov eax, ebx
sub eax, ecx
lea ecx, [ebp + ecx - 0x510]
mov edx, 0x7fffffff
call fcn.00401000
push ebx
lea ecx, [ebp - 0x510]
push str.DisplayName
push ecx
lea ecx, [ebp - 0x718]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
mov edx, 0x4bbc38
lea ecx, [ebp - 0x718]
call fcn.0047dee0
test eax, eax
je 0x49d8c8
push ebx
lea edx, [ebp - 0x510]
push str.DisplayVersion
push edx
lea ecx, [ebp - 0x818]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
lea edx, [ebp - 0x818]
lea ecx, [ebp - 0x610]
call fcn.0047dee0
test eax, eax
jne 0x49d8c8
push ebx
lea eax, [ebp - 0x510]
push str.InstallLocation
push eax
lea ecx, [ebp - 0x920]
mov edx, 0x80000002
call fcn.0048e050
add esp, 0xc
lea ecx, [ebp - 0x510]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x208
ja 0x49d8c8
lea edx, [ebp - 0x510]
push edx
lea eax, [ebp - 0xb28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0xb28]
push ecx
push 0x80000002
call fcn.0048f3b0
add esp, 8
inc dword [ebp - 0x1330]
jmp 0x49d704
mov edx, dword [ebp - 0x1338]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1334]
inc eax
mov dword [ebp - 0x1334], eax
cmp eax, 2
jl 0x49d63d
cmp dword [0x4d2afc], 0
je 0x49d90a
mov eax, dword [ebp - 0x1344]
mov dword [0x4c6444], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1330]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret