Function at 0x413376
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5557a8
mov eax, dword fs:[0]
push eax
mov eax, 0x1320
call fcn.0052a310
mov eax, dword [0x5aff20]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov edi, ecx
push 7
mov dword [ebp - 0x1328], eax
pop eax
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x132c], edi
mov dword [ebp - 0x101c], eax
mov dword [ebp - 0x1020], ebx
mov word [ebp - 0x1030], cx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1054], eax
xor eax, eax
mov dword [ebp - 0x1058], ebx
mov word [ebp - 0x1068], ax
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
lea esi, [ebp - 0x104c]
mov byte [ebp - 4], 1
call fcn.0040829d
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1038], 8
mov eax, dword [ebp - 0x104c]
jae 0x413414
mov eax, esi
lea ecx, [ebp - 0x1310]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x41353d
lea eax, [ebp - 0x130c]
push eax
call fcn.00413d1a
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1318]
push eax
lea eax, [ebp - 0x814]
push eax
mov byte [ebp - 4], 3
mov dword [ebp - 0x1314], ebx
push ebx
jmp 0x413503
cmp eax, 0xea
je 0x413521
lea eax, [ebp - 0x814]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x413477
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x814]
lea esi, [ebp - 0x1030]
call fcn.00409cec
cmp dword [ebp - 0x101c], 8
mov eax, dword [ebp - 0x1030]
jae 0x4134a8
mov eax, esi
mov edx, dword [ebp - 0x1328]
lea ecx, [ebp - 0x130c]
push ecx
mov ecx, dword [ebp - 0x1310]
push eax
call fcn.00412156
test eax, eax
je 0x4134e5
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x104c]
lea ecx, [ebp - 0x10c0]
call fcn.0040946e
lea eax, [ebp - 0x130c]
push eax
call fcn.0041a478
inc dword [ebp - 0x1314]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1318]
push eax
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 0x1314]
push dword [ebp - 0x1310]
mov dword [ebp - 0x1318], 0x800
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
je 0x413463
push dword [ebp - 0x1310]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x130c]
push eax
mov byte [ebp - 4], 2
call fcn.00413ea3
push 0x3c
pop eax
mov ecx, str.SoftWareMicrosoftWindowsCurrentVersionInstallerUserData
lea esi, [ebp - 0x104c]
call fcn.00409cec
cmp dword [ebp - 0x1038], 8
mov eax, dword [ebp - 0x104c]
jae 0x413561
mov eax, esi
lea ecx, [ebp - 0x131c]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x4137d5
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1324]
push eax
lea eax, [ebp - 0x1014]
push eax
mov dword [ebp - 0x1320], ebx
push ebx
jmp 0x4137af
cmp eax, 0xea
je 0x4137c9
lea eax, [ebp - 0x1014]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4135ba
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x1014]
lea esi, [ebp - 0x1068]
call fcn.00409cec
push str.Products
mov eax, esi
push eax
call fcn.004082e5
cmp dword [ebp - 0x1054], 8
mov eax, dword [ebp - 0x1068]
jae 0x4135f8
mov eax, esi
lea ecx, [ebp - 0x1310]
push ecx
push 0x20019
push ebx
push eax
push dword [ebp - 0x131c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x413791
lea eax, [ebp - 0x130c]
push eax
call fcn.00413d1a
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1314]
push eax
lea eax, [ebp - 0x814]
push eax
mov byte [ebp - 4], 4
mov dword [ebp - 0x1318], ebx
push ebx
jmp 0x41375b
cmp eax, 0xea
je 0x413775
lea eax, [ebp - 0x814]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41365c
sub eax, edx
sar eax, 1
lea ecx, [ebp - 0x814]
lea esi, [ebp - 0x1030]
call fcn.00409cec
push str.InstallProperties
mov eax, esi
push eax
call fcn.004082e5
cmp dword [ebp - 0x101c], 8
mov eax, dword [ebp - 0x1030]
jae 0x41369a
mov eax, esi
mov edx, dword [ebp - 0x1328]
lea ecx, [ebp - 0x130c]
push ecx
mov ecx, dword [ebp - 0x1310]
push eax
call fcn.00412156
test eax, eax
je 0x41373d
lea eax, [ebp - 0x10a0]
push 0x585004
push eax
lea ebx, [ebp - 0x104c]
call fcn.0040ae0a
lea ecx, [ebp - 0x1068]
push ecx
lea ecx, [ebp - 0x1084]
push ecx
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.0040ade1
add esp, 0x10
mov ebx, eax
lea eax, [ebp - 0x10c0]
mov byte [ebp - 4], 6
call fcn.00409383
push 1
xor edi, edi
lea esi, [ebp - 0x1084]
mov byte [ebp - 4], 5
call fcn.00409659
push 1
lea esi, [ebp - 0x10a0]
mov byte [ebp - 4], 4
call fcn.00409659
mov edi, dword [ebp - 0x132c]
lea eax, [ebp - 0x130c]
push eax
call fcn.0041a478
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor ebx, ebx
inc dword [ebp - 0x1318]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1314]
push eax
lea eax, [ebp - 0x814]
push eax
push dword [ebp - 0x1318]
push dword [ebp - 0x1310]
mov dword [ebp - 0x1314], 0x800
call edi
cmp eax, ebx
je 0x413648
push dword [ebp - 0x1310]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x130c]
push eax
mov byte [ebp - 4], 2
call fcn.00413ea3
inc dword [ebp - 0x1320]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1324]
push eax
lea eax, [ebp - 0x1014]
push eax
push dword [ebp - 0x1320]
push dword [ebp - 0x131c]
mov dword [ebp - 0x1324], 0x800
call edi
cmp eax, ebx
je 0x4135a6
push dword [ebp - 0x131c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
xor edi, edi
lea esi, [ebp - 0x104c]
mov byte [ebp - 4], 1
call fcn.00409659
push 1
lea esi, [ebp - 0x1068]
mov byte [ebp - 4], bl
call fcn.00409659
or dword [ebp - 4], 0xffffffff
push 1
lea esi, [ebp - 0x1030]
call fcn.00409659
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005220b2
leave
ret 4