Function at 0x41bf60
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x628
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x413]
push ebx
push eax
mov byte [ebp - 0x414], bl
call fcn.005dfd60
push str.unins.exe
push 0x6af4b8
call fcn.004ec4e0
add esp, 0x14
test eax, eax
jne 0x41c33d
push ebx
push 0x104
lea ecx, [ebp - 0x414]
push ecx
push 0x60c81c
push str.UString
push 0x60c810
call fcn.004edfd0
add esp, 0x18
cmp byte [ebp - 0x414], bl
je 0x41bff4
push 0x615678
push str.UStringDefined
push 0x60c810
call fcn.004ee3d0
mov dword [ebp - 0x624], 1
jmp 0x41c00a
push ebx
push str.UStringDefined
push 0x60c810
call fcn.004ee3d0
mov dword [ebp - 0x624], ebx
add esp, 0xc
push esi
cmp byte [0x6b2720], bl
jne 0x41c044
push ebx
push 0x104
push 0x6b2720
push 0x60c81c
push 0x615660
push 0x60c810
call fcn.004edfd0
add esp, 0x18
cmp byte [0x6b2720], bl
je 0x41c16a
cmp byte [0x6b2518], bl
jne 0x41c176
push 0x103
lea edx, [ebp - 0x20b]
push ebx
push edx
mov byte [ebp - 0x20c], bl
call fcn.005dfd60
lea eax, [ebp - 0x20c]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push eax
xor esi, esi
call fcn.005dfb23
add esp, 0x14
lea ecx, [ebp - 0x620]
push ecx
lea edx, [ebp - 0x20c]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x41c16a
push edi
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.005dfd60
mov edx, dword [ebp - 0x620]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push ebx
push edx
call edi
test eax, eax
jne 0x41c13a
jmp 0x41c0e0
push 0x6b2720
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x108]
push 0x6b2720
push eax
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x41c143
push 0x103
lea ecx, [ebp - 0x107]
push ebx
push ecx
inc esi
mov byte [ebp - 0x108], bl
call fcn.005dfd60
mov eax, dword [ebp - 0x620]
add esp, 0xc
push 0x104
lea edx, [ebp - 0x108]
push edx
push esi
push eax
call edi
test eax, eax
je 0x41c0e0
mov ecx, dword [ebp - 0x620]
push ecx
jmp 0x41c163
lea edx, [ebp - 0x108]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_s
push 0x6b2518
call fcn.005dfb23
mov eax, dword [ebp - 0x620]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
cmp byte [0x6b2518], bl
je 0x41c33c
mov esi, 0x207
push esi
lea ecx, [ebp - 0x30f]
push ebx
push ecx
mov byte [ebp - 0x310], bl
call fcn.005dfd60
push esi
lea edx, [ebp - 0x61b]
push ebx
push edx
mov dword [ebp - 0x620], esi
mov byte [ebp - 0x61c], bl
call fcn.005dfd60
add esp, 0x18
lea eax, [ebp - 0x620]
push eax
lea ecx, [ebp - 0x310]
push ecx
push str.UninstallString
push 0x6b2518
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x628], esi
call fcn.004d5770
lea edx, [ebp - 0x628]
push edx
lea eax, [ebp - 0x61c]
push eax
push str.QuietUninstallString
push 0x6b2518
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
push ebx
lea ecx, [ebp - 0x310]
push str.esremove
push ecx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x41c22e
push ebx
lea edx, [ebp - 0x61c]
push str.esremove
push edx
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
jne 0x41c2ef
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.005dfd60
push 0x6af4b8
lea ecx, [ebp - 0x108]
push str._sESREMOVE.EXE
push ecx
call fcn.005dfb23
add esp, 0x18
lea edx, [ebp - 0x108]
push edx
push str.UninstallString
push 0x6b2518
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
lea eax, [ebp - 0x108]
push eax
push str.QuietUninstallString
push 0x6b2518
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004e7720
cmp dword [ebp - 0x624], ebx
jne 0x41c2f7
cmp byte [ebp - 0x310], bl
je 0x41c2be
lea ecx, [ebp - 0x310]
push ecx
push str.UninstallString
push 0x60c810
call fcn.004ee3d0
add esp, 0xc
cmp byte [ebp - 0x61c], bl
je 0x41c33c
lea edx, [ebp - 0x61c]
push edx
push str.QuietUninstallString
push 0x60c810
call fcn.004ee3d0
add esp, 0xc
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x624], ebx
je 0x41c33c
push ebx
push ebx
push str.unins.exe
push 0x6af4b8
call fcn.00517250
push ebx
push ebx
push str.unins.dat
push 0x6af4b8
call fcn.00517250
push ebx
push str.UninstallString
push 0x60c810
call fcn.004ee3d0
push ebx
push str.QuietUninstallString
push 0x60c810
call fcn.004ee3d0
add esp, 0x38
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret