Function at 0x40e970
Capabilities:
Get installed programs

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
push 8
call 0xbaa1b0
add esp, 4
mov dword [ebp - 0x24], eax
mov edi, eax
mov esi, 0x48b2f0
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push 8
call 0xbaa1b0
add esp, 4
mov dword [ebp - 0x28], eax
mov edi, eax
mov esi, 0x48b2f0
lodsd eax, dword [esi]
stosd dword es:[edi], eax
lodsd eax, dword [esi]
stosd dword es:[edi], eax
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.00452810
add esp, 0x10
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40ea1c
push ebx
call fcn.004517d6
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xff
mov dword [ebp - 0x2c], esp
lea eax, [ebp - 0xc]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
nop
nop
cmp dword [ebp - 0x2c], esp
je 0x40ea5e
push 0x59
push 0x408a20d
push 6
call fcn.004517d0
add esp, 0xc
mov dword [ebp - 0x2c], esp
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp - 0x14]
push dword [ebp - 0xc]
xor eax, eax
call dword [0x58ec60]
nop
nop
cmp dword [ebp - 0x2c], esp
je 0x40ea93
push 0xca
push 0x408a20d
push 6
call fcn.004517d0
add esp, 0xc
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40f333
mov dword [ebp - 8], 0xff
mov dword [ebp - 0x2c], esp
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp - 0x14]
push dword [ebp - 0xc]
xor eax, eax
call dword [0x58ec60]
nop
nop
cmp dword [ebp - 0x2c], esp
je 0x40eadc
push 0x16c
push 0x408a20d
push 6
call fcn.004517d0
add esp, 0xc
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
mov ecx, 2
call fcn.00403dcf
add esp, 8
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40eb0b
push ebx
call 0xbaa290
add esp, 4
pop eax
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x14]
push str.DisplayIcon
push dword [ebp - 0x18]
mov ecx, 2
call fcn.00403dcf
add esp, 8
mov dword [ebp - 0x2c], eax
push 0
push 0
push 0
push 0x80000004
push 0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x40eb43
mov eax, 0x48b2ec
push eax
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x698
call fcn.00454390
add esp, 0x28
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x40eb75
push ebx
call 0xbaa290
add esp, 4
mov eax, dword [ebp - 0x30]
push eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x40eb89
push ebx
call 0xbaa290
add esp, 4
pop eax
mov dword [ebp - 0x1c], eax
push 0x80000002
push 0
push 0
push 0
push 0
push 0
push 0x80000004
push 0
push str..KB
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40ebbe
mov eax, 0x48b2ec
push eax
push 4
mov ebx, 0x148
call fcn.00452fe0
add esp, 0x34
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
je 0x40ebe3
jmp 0x40f31c
push 0x80000002
push 0
push 0
push 0
push 0
push 0
push 0x80000004
push 0
push 0x496548
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40ec14
mov eax, 0x48b2ec
push eax
push 4
mov ebx, 0x148
call fcn.00452fe0
add esp, 0x34
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
je 0x40ec39
jmp 0x40f31c
push str.UninstallString
push dword [ebp - 0x18]
mov ecx, 2
call fcn.00403dcf
add esp, 8
mov dword [ebp - 0x2c], eax
push 0
push 0
push 0
push 0x80000004
push 0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x40ec6a
mov eax, 0x48b2ec
push eax
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x698
call fcn.00454390
add esp, 0x28
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x40ec9c
push ebx
call 0xbaa290
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x40ecaf
mov eax, 0x48b2ec
push eax
push 1
mov ebx, 0x174
call fcn.00451f50
add esp, 0x10
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x40ecd5
push ebx
call 0xbaa290
add esp, 4
push 0x48b2ec
push dword [ebp - 0x34]
call fcn.00403cc4
add esp, 8
cmp eax, 0
mov eax, 0
setne al
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x40ed03
push ebx
call 0xbaa290
add esp, 4
cmp dword [ebp - 0x38], 0
je 0x40f31c
push str.DisplayName
push dword [ebp - 0x18]
mov ecx, 2
call fcn.00403dcf
add esp, 8
mov dword [ebp - 0x2c], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x40ed38
mov eax, 0x48b2ec
push eax
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6ac
call fcn.00454520
add esp, 0x1c
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x40ed6a
push ebx
call 0xbaa290
add esp, 4
cmp dword [ebp - 0x30], 1
jne 0x40f317
push str.DisplayName
push dword [ebp - 0x18]
mov ecx, 2
call fcn.00403dcf
add esp, 8
mov dword [ebp - 0x2c], eax
push 0
push 0
push 0
push 0x80000004
push 0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x40eda5
mov eax, 0x48b2ec
push eax
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x698
call fcn.00454390
add esp, 0x28
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x40edd7
push ebx
call 0xbaa290
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x40edea
mov eax, 0x48b2ec
push eax
push 1
mov ebx, 0x174
call fcn.00451f50
add esp, 0x10
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x40ee10
push ebx
call 0xbaa290
add esp, 4
mov eax, dword [ebp - 0x34]
push eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x40ee24
push ebx
call 0xbaa290
add esp, 4
pop eax
mov dword [ebp - 0x20], eax
push str.DisplayVersion
push dword [ebp - 0x18]
mov ecx, 2
call fcn.00403dcf
add esp, 8
mov dword [ebp - 0x2c], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x40ee53
mov eax, 0x48b2ec
push eax
push 0x80000301
push 0
push 4
push 2
mov ebx, 0x6ac
call fcn.00454520
add esp, 0x1c
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x40ee85
push ebx
call 0xbaa290
add esp, 4
cmp dword [ebp - 0x30], 1
jne 0x40f01a
push str.DisplayName
push dword [ebp - 0x18]
mov ecx, 2
call fcn.00403dcf
add esp, 8
mov dword [ebp - 0x2c], eax
push 0
push 0
push 0
push 0x80000004
push 0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x40eec0
mov eax, 0x48b2ec
push eax
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x698
call fcn.00454390
add esp, 0x28
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x40eef2
push ebx
call 0xbaa290
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x40ef05
mov eax, 0x48b2ec
push eax
push 1
mov ebx, 0x174
call fcn.00451f50
add esp, 0x10
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x40ef2b
push ebx
call 0xbaa290
add esp, 4
push str.DisplayVersion
push dword [ebp - 0x18]
mov ecx, 2
call fcn.00403dcf
add esp, 8
mov dword [ebp - 0x38], eax
push 0
push 0
push 0
push 0x80000004
push 0
mov eax, dword [ebp - 0x38]
test eax, eax
jne 0x40ef5c
mov eax, 0x48b2ec
push eax
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x698
call fcn.00454390
add esp, 0x28
mov dword [ebp - 0x3c], eax
mov ebx, dword [ebp - 0x38]
test ebx, ebx
je 0x40ef8e
push ebx
call 0xbaa290
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0x3c]
test eax, eax
jne 0x40efa1
mov eax, 0x48b2ec
push eax
push 1
mov ebx, 0x174
call fcn.00451f50
add esp, 0x10
mov dword [ebp - 0x40], eax
mov ebx, dword [ebp - 0x3c]
test ebx, ebx
je 0x40efc7
push ebx
call 0xbaa290
add esp, 4
push dword [ebp - 0x40]
push 0x48b2e8
push dword [ebp - 0x34]
mov ecx, 3
call fcn.00403dcf
add esp, 0xc
mov dword [ebp - 0x44], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x40eff2
push ebx
call 0xbaa290
add esp, 4
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x40f002
push ebx
call 0xbaa290
add esp, 4
mov eax, dword [ebp - 0x44]
push eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x40f016
push ebx
call 0xbaa290
add esp, 4
pop eax
mov dword [ebp - 0x20], eax
push 0
mov ebx, 0x350
call fcn.004524a0
add esp, 4
cmp dword [ebp + 8], 1
jne 0x40f143
push 0xa0000101
push 0
push 0x496580
push 1
mov ebx, 0x168
call fcn.00452980
add esp, 0x10
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0
push 0
push dword [ebp - 0x30]
mov dword [ebp - 0x34], 0
push 0
push dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040f4a8
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x40f08f
push ebx
call 0xbaa290
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
jne 0x40f100
push 0xa0000101
push 0
push 0x49658c
push 1
mov ebx, 0x168
call fcn.00452980
add esp, 0x10
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x44], 0
push 0
push dword [ebp - 0x44]
mov dword [ebp - 0x48], 0
push 0
push dword [ebp - 0x48]
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040f4a8
mov dword [ebp - 0x4c], eax
mov ebx, dword [ebp - 0x40]
test ebx, ebx
je 0x40f0f2
push ebx
call 0xbaa290
add esp, 4
cmp dword [ebp - 0x4c], 0xffffffff
jne 0x40f100
xor eax, eax
jmp 0x40f105
mov eax, 1
test eax, eax
je 0x40f143
mov dword [ebp - 0x2c], esp
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
nop
cmp dword [ebp - 0x2c], esp
je 0x40f139
push 0x7a8
push 0x408a20d
push 6
call fcn.004517d0
add esp, 0xc
mov eax, 0x496598
jmp 0x40f3d5
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0
push 0
push dword [ebp - 0x30]
mov eax, str.Microsoft
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0040f4a8
mov dword [ebp - 0x38], eax
mov ebx, dword [ebp - 0x34]
test ebx, ebx
je 0x40f183
push ebx
call 0xbaa290
add esp, 4
cmp dword [ebp - 0x38], 0xffffffff
je 0x40f192
jmp 0x40f317
lea eax, [ebp - 0x24]
push eax
push 4
mov eax, 2
call fcn.00451d80
add esp, 8
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x30], ebx
call fcn.00401420
mov dword [ebp - 0x34], ecx
mov edi, dword [ebp - 0x30]
mov dword [edi], 1
add edi, 4
mov eax, ecx
inc eax
mov dword [edi], eax
add edi, 4
cmp edi, ebx
je 0x40f1d5
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x34]
inc eax
shl eax, 2
add eax, 8
push eax
push dword [ebp - 0x30]
call fcn.004517dc
add esp, 8
mov dword [ebp - 0x24], eax
mov edi, eax
add edi, 8
mov eax, dword [ebp - 0x34]
shl eax, 2
add edi, eax
mov eax, dword [ebp - 0x2c]
push edi
test eax, eax
je 0x40f218
push eax
mov ebx, eax
call fcn.00403d64
inc eax
push eax
call 0xbaa1b0
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [edi], eax
push str.Publisher
push dword [ebp - 0x18]
mov ecx, 2
call fcn.00403dcf
add esp, 8
mov dword [ebp - 0x2c], eax
push 0
push 0
push 0
push 0x80000004
push 0
mov eax, dword [ebp - 0x2c]
test eax, eax
jne 0x40f24c
mov eax, 0x48b2ec
push eax
push 0x80000301
push 0
push 4
push 3
mov ebx, 0x698
call fcn.00454390
add esp, 0x28
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x40f27e
push ebx
call 0xbaa290
add esp, 4
lea eax, [ebp - 0x28]
push eax
push 4
mov eax, 2
call fcn.00451d80
add esp, 8
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x38], ebx
call fcn.00401420
mov dword [ebp - 0x3c], ecx
mov edi, dword [ebp - 0x38]
mov dword [edi], 1
add edi, 4
mov eax, ecx
inc eax
mov dword [edi], eax
add edi, 4
cmp edi, ebx
je 0x40f2c1
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3c]
inc eax
shl eax, 2
add eax, 8
push eax
push dword [ebp - 0x38]
call fcn.004517dc
add esp, 8
mov dword [ebp - 0x28], eax
mov edi, eax
add edi, 8
mov eax, dword [ebp - 0x3c]
shl eax, 2
add edi, eax
mov eax, dword [ebp - 0x34]
push edi
test eax, eax
je 0x40f304
push eax
mov ebx, eax
call fcn.00403d64
inc eax
push eax
call 0xbaa1b0
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop edi
mov dword [edi], eax
mov ebx, dword [ebp - 0x30]
test ebx, ebx
je 0x40f317
push ebx
call 0xbaa290
add esp, 4
jmp 0x40f31c
push 0
mov ebx, 0x350
call fcn.004524a0
add esp, 4
jmp 0x40ea96
mov dword [ebp - 0x2c], esp
push dword [ebp - 0xc]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
nop
cmp dword [ebp - 0x2c], esp
je 0x40f35f
push 0x95b
push 0x408a20d
push 6
call fcn.004517d0
add esp, 0xc
cmp dword [ebp + 8], 1
jne 0x40f36e
jmp 0x40f3cb
push 0xa0000004
push 0
push dword [ebp - 0x28]
push 0xa0000004
push 0
push dword [ebp - 0x24]
push 0x80000004
push 0
push str.SoftList
push 3
mov ebx, 0
mov eax, 0x45b839
call fcn.00451e20
add esp, 0x28
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x58e8a8
mov eax, dword [esp]
mov eax, dword [eax]
mov eax, dword [eax]
call dword [eax + 0x2c]
mov ebx, dword [ebp - 0x2c]
test ebx, ebx
je 0x40f3cb
push ebx
call fcn.004517d6
add esp, 4
mov eax, 0x4965c0
jmp 0x40f3d5
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40f3e6
push ebx
call 0xbaa290
add esp, 4
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x40f3f6
push ebx
call 0xbaa290
add esp, 4
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x40f406
push ebx
call fcn.004517d6
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x40f416
push ebx
call 0xbaa290
add esp, 4
mov ebx, dword [ebp - 0x24]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x40f434
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x40f430
imul eax, dword [ebx]
jmp 0x40f425
mov ecx, eax
test ecx, ecx
je 0x40f453
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x40f44c
push ebx
push eax
call 0xbaa290
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x40f43a
call 0xbaa290
add esp, 4
mov ebx, dword [ebp - 0x28]
push ebx
mov ecx, dword [ebx]
add ebx, 4
test ecx, ecx
je 0x40f479
mov eax, dword [ebx]
add ebx, 4
dec ecx
je 0x40f475
imul eax, dword [ebx]
jmp 0x40f46a
mov ecx, eax
test ecx, ecx
je 0x40f498
push ecx
mov eax, dword [ebx]
test eax, eax
je 0x40f491
push ebx
push eax
call 0xbaa290
add esp, 4
pop ebx
add ebx, 4
pop ecx
dec ecx
jne 0x40f47f
call 0xbaa290
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8