Function at 0x41cea0
Capabilities:
Check http status code
Check if file exists
Get installed programs

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43bf55
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x44a1b0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
xor eax, eax
mov word [ebp - 0xa0], ax
mov edi, 7
push 0x3f
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallItibiti_is1
lea esi, [ebp - 0xa0]
mov byte [ebp - 0x14d], 0
mov dword [ebp - 0x8c], edi
mov dword [ebp - 0x90], ebx
call fcn.00406270
mov byte [ebp - 4], 1
xor ecx, ecx
push 0x4b
mov eax, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallItibiti_is1
lea esi, [ebp - 0x4c]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], cx
call fcn.00406270
mov eax, dword [ebp - 0xa0]
mov edi, 8
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x164], ebx
cmp dword [ebp - 0x8c], edi
jae 0x41cf4d
lea eax, [ebp - 0xa0]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 0x164]
push edx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x15c], ebx
cmp dword [ebp - 0x38], edi
jae 0x41cf7f
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x15c]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
mov byte [ebp - 4], 4
cmp dword [ebp - 0x164], ebx
jne 0x41d3b2
mov eax, dword [ebp - 0x15c]
cmp eax, ebx
jne 0x41d3bc
mov dword [ebp - 0x194], ebx
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0x18c], ebx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 5
call fcn.00415bb0
push eax
mov eax, str.Knctr.exe
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 6
call fcn.0041d630
add esp, 4
mov byte [ebp - 4], 8
cmp dword [ebp - 0x54], edi
jb 0x41cffd
mov edx, dword [ebp - 0x68]
push edx
call fcn.0041e13f
add esp, 4
mov eax, 7
mov dword [ebp - 0x54], eax
xor ecx, ecx
mov dword [ebp - 0x1c], eax
xor edx, edx
push 0x4e
mov eax, str.http:__www.itibitiphone.com_download_download_0e122fd48b17_Itibiti_Knctr_C.exe
lea esi, [ebp - 0x30]
mov dword [ebp - 0x58], ebx
mov word [ebp - 0x68], cx
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], dx
call fcn.00406270
lea eax, [ebp - 0x154]
push ebx
push eax
lea edx, [ebp - 0x194]
mov ecx, esi
mov byte [ebp - 4], 9
call fcn.00412fc0
add esp, 8
mov byte [ebp - 4], 8
cmp dword [ebp - 0x1c], edi
jb 0x41d05a
mov ecx, dword [ebp - 0x30]
push ecx
call fcn.0041e13f
add esp, 4
cmp dword [ebp - 0x154], 0xc8
jne 0x41d378
lea eax, [ebp - 0x194]
lea ecx, [ebp - 0x84]
call fcn.0040f9f0
test al, al
je 0x41d378
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x70], edi
jae 0x41d094
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41d378
mov eax, str._verysilent
lea ecx, [ebp - 0xbc]
call fcn.00405c70
lea edx, [ebp - 0xbc]
lea ecx, [ebp - 0x84]
call fcn.0041d4c0
lea esi, [ebp - 0xbc]
call fcn.004063b0
lea eax, [ebp - 0xa0]
lea esi, [ebp - 0x174]
mov byte [ebp - 0x14d], 1
call fcn.00416370
lea eax, [ebp - 0x4c]
lea esi, [ebp - 0x16c]
call fcn.00416370
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x174], ebx
jne 0x41d10d
cmp dword [ebp - 0x16c], ebx
je 0x41d361
cmp dword [0x44aee8], ebx
je 0x41d350
lea edx, [ebp - 0x14c]
push edx
call fcn.004118b0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x184], ebx
mov dword [ebp - 0x180], ebx
mov dword [ebp - 0x17c], ebx
mov eax, 0x444660
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 0xe
call fcn.00405c70
mov eax, str.http:__www.google_analytics.com_collect
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 0xf
call fcn.00405c70
sub esp, 0x1c
mov byte [ebp - 4], 0x10
mov eax, str.knctr
mov ecx, esp
mov dword [ebp - 0x154], esp
call fcn.00405c70
sub esp, 0x1c
mov byte [ebp - 4], 0x11
mov eax, str.bundleinstalled
mov ecx, esp
mov dword [ebp - 0x1a8], esp
call fcn.00405c70
sub esp, 0x1c
mov byte [ebp - 4], 0x12
mov eax, 0x444b7c
mov ecx, esp
mov dword [ebp - 0x198], esp
call fcn.00405c70
sub esp, 0x1c
mov byte [ebp - 4], 0x13
mov ecx, 0x44aebc
mov esi, esp
mov dword [ebp - 0x1a4], esp
call fcn.004054c0
sub esp, 0x1c
mov byte [ebp - 4], 0x14
mov ecx, 0x44aea0
mov esi, esp
mov dword [ebp - 0x1a0], esp
call fcn.004054c0
sub esp, 0x1c
mov ecx, 0x44aed8
mov esi, esp
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x19c], esp
call fcn.004054c0
lea eax, [ebp - 0xd8]
push eax
mov byte [ebp - 4], 0x10
call fcn.0041c1a0
add esp, 0xac
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], 0x16
call fcn.00419960
xor edi, edi
cmp edi, 3
jge 0x41d29b
mov eax, str.POST
lea ecx, [ebp - 0xf4]
call fcn.00405c70
lea ecx, [ebp - 0x184]
push ecx
lea edx, [ebp - 0xbc]
push edx
lea eax, [ebp - 0x14c]
push eax
lea edx, [ebp - 0x24]
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 0x17
call fcn.00411d90
lea esi, [ebp - 0xf4]
mov bl, al
mov byte [ebp - 4], 0x16
call fcn.004063b0
lea ecx, [ebp - 0x68]
push ecx
lea ecx, [ebp - 0x184]
call fcn.00419870
add esp, 4
test bl, bl
je 0x41d294
cmp dword [ebp - 0x13c], 0xc8
je 0x41d299
inc edi
xor ebx, ebx
jmp 0x41d225
xor ebx, ebx
cmp dword [ebp - 0xc4], 0x10
jb 0x41d2b3
mov edx, dword [ebp - 0xd8]
push edx
call fcn.0041e13f
add esp, 4
mov edi, 8
mov dword [ebp - 0xc4], 0xf
mov dword [ebp - 0xc8], ebx
mov byte [ebp - 0xd8], 0
cmp dword [ebp - 0xa8], edi
jb 0x41d2e6
mov eax, dword [ebp - 0xbc]
push eax
call fcn.0041e13f
add esp, 4
xor ecx, ecx
mov esi, 7
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xac], ebx
mov word [ebp - 0xbc], cx
cmp dword [ebp - 0x54], edi
jb 0x41d311
mov edx, dword [ebp - 0x68]
push edx
call fcn.0041e13f
add esp, 4
xor eax, eax
mov word [ebp - 0x68], ax
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x58], ebx
cmp eax, ebx
je 0x41d330
push eax
call fcn.0041e13f
add esp, 4
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x41d340
push eax
call fcn.0041e13f
add esp, 4
lea ecx, [ebp - 0x14c]
push ecx
mov byte [ebp - 4], 0xb
call fcn.00411a50
mov eax, dword [ebp - 0x16c]
cmp eax, ebx
je 0x41d361
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0x16c], ebx
cmp eax, ebx
je 0x41d378
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x70], edi
jb 0x41d38c
mov edx, dword [ebp - 0x84]
push edx
call fcn.0041e13f
add esp, 4
xor eax, eax
mov word [ebp - 0x84], ax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x70], 7
mov dword [ebp - 0x74], ebx
cmp eax, ebx
je 0x41d3b2
push eax
call fcn.0041e13f
add esp, 4
mov eax, dword [ebp - 0x15c]
cmp eax, ebx
je 0x41d3c3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x15c], ebx
cmp eax, ebx
je 0x41d3da
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x164], ebx
cmp dword [ebp - 0x38], edi
jb 0x41d3f1
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.0041e13f
add esp, 4
xor edx, edx
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], dx
cmp dword [ebp - 0x8c], edi
jb 0x41d418
mov eax, dword [ebp - 0xa0]
push eax
call fcn.0041e13f
add esp, 4
mov al, byte [ebp - 0x14d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041e14a
mov esp, ebp
pop ebp
ret