Function at 0x409437
Capabilities:
Check if file exists
Get file attributes
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 0x10], edx
push eax
push 1
xor ebx, ebx
mov dword [ebp - 0x14], ecx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallB2
push reloc.OLEAUT32.dll_SysReAllocString
mov esi, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409699
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x2000
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x409698
mov esi, dword [ebp - 0x14]
lea ebx, [edi + 0xc00]
push 0x104
xor ecx, ecx
push edi
mov esi, dword [esi]
mov dword [ebp - 0xc], ecx
push ecx
jmp 0x40966c
inc dword [ebp - 0xc]
push str.SoftwareRimArtsB2Settings
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 4]
push eax
push 1
xor eax, eax
push eax
push edi
push VariantInit
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409662
lea ecx, [ebp - 8]
mov dword [ebp - 8], 0x400
push ecx
lea eax, [edi + 0x800]
xor edx, edx
push eax
mov byte [eax], dl
lea eax, [ebp - 0x18]
push eax
push edx
push str.DataDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409662
lea eax, [edi + 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, eax
cmp byte [ecx + edi + 0x7ff], 0x5c
jne 0x409530
xor edx, edx
mov byte [ecx + edi + 0x7ff], dl
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x400
push eax
push ebx
lea eax, [ebp - 0x18]
xor ecx, ecx
push eax
push ecx
push str.DataDirBak
mov byte [ebx], cl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40957f
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + ebx - 1], 0x5c
jne 0x40956b
xor edx, edx
mov byte [eax + ebx - 1], dl
push ebx
lea eax, [edi + 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40957f
mov byte [ebx], al
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [edi + 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x409662
test al, 0x10
je 0x409662
push 0xfa0
lea eax, [esi + 0x10]
xor ecx, ecx
push eax
mov word [eax], cx
lea eax, [edi + 0x800]
push 0xffffffffffffffff
push eax
xor eax, eax
push eax
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esi + 0x10]
xor edx, edx
cmp word [eax], dx
je 0x4095ff
push eax
call fcn.004c96f6
pop ecx
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x4b374558
lea ecx, [eax*2 + 0x12]
mov dword [esi + 8], 0x1000007
mov eax, dword [ebp - 0x10]
mov dword [esi], ecx
add esi, ecx
inc dword [eax]
cmp byte [ebx], 0
je 0x409662
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x409662
test al, 0x10
je 0x409662
push 0xfa0
lea eax, [esi + 0x10]
xor ecx, ecx
push eax
push 0xffffffffffffffff
mov word [eax], cx
xor eax, eax
push ebx
push eax
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [esi + 0x10]
xor edx, edx
cmp word [eax], dx
je 0x409662
push eax
call fcn.004c96f6
pop ecx
mov dword [esi + 0xc], eax
mov dword [esi + 4], 0x4b374558
lea ecx, [eax*2 + 0x12]
mov dword [esi + 8], 0x1000007
mov eax, dword [ebp - 0x10]
mov dword [esi], ecx
add esi, ecx
inc dword [eax]
mov eax, dword [ebp - 0xc]
push 0x104
push edi
push eax
push VariantInit
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x4094b1
mov eax, dword [ebp - 0x14]
push edi
mov dword [eax], esi
xor eax, eax
xor esi, esi
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
cmp dword [ebp - 4], 0
je 0x4096a8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret