Function at 0x41f370
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46560c
mov eax, dword fs:[0]
push eax
sub esp, 0x4c0
mov eax, dword [0x483068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x498], ecx
mov al, byte [ebp + 8]
lea ecx, [ebp - 0x490]
mov byte [ebp - 0x491], al
movzx eax, al
inc eax
push ecx
shl eax, 8
or eax, 0x20019
push eax
push 0
push str.SOFTWAREMICROSOFTWINDOWSCURRENTVERSIONUNINSTALL
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x41f962
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
xor ebx, ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x200
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x41f948
lea eax, [ebp - 0x48c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x41f871
lea eax, [ebp - 0x488]
mov dword [ebp - 0x488], 0x200
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x418]
push eax
push 2
push str.DisplayName
push esi
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x41f85f
lea eax, [ebp - 0x214]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41f486
sub eax, edx
sar eax, 1
cmp eax, 0xc
jb 0x41f4b7
push 0xc
mov edx, 0x477a14
lea ecx, [ebp - 0x214]
call fcn.00406450
add esp, 4
test eax, eax
jne 0x41f4b7
mov al, 1
jmp 0x41f4b9
xor al, al
test al, al
je 0x41f85f
xor eax, eax
mov dword [ebp - method.InstalledProducts::InstalledProduct.virtual_0], vtable.InstalledProducts::InstalledProduct.0
push eax
push 0x476f08
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 7
mov word [ebp - 0x480], ax
call fcn.00409520
xor eax, eax
mov dword [ebp - 4], 0
push eax
push 0x476f08
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 7
mov word [ebp - 0x468], ax
call fcn.00409520
xor eax, eax
mov byte [ebp - 4], 1
push eax
push 0x476f08
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
call fcn.00409520
xor eax, eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
mov byte [ebp - 0x420], al
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], 2
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f593
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x468]
call fcn.00409520
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f5c0
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x480]
call fcn.00409520
mov al, byte [ebp - 0x491]
lea ecx, [ebp - 0x4b4]
mov byte [ebp - 0x420], al
call fcn.0041f060
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x41f608
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4858e0
call fcn.00408830
add esp, 4
mov edx, str.d:jenkinsworkspace_n_sucommon_src_sucommoninstalledproducts.cpp
mov ecx, eax
call fcn.004073d0
mov edx, 0x476f7c
mov ecx, eax
call fcn.004073d0
push 0x30
mov ecx, eax
call fcn.00405950
mov edx, str.:_Found
mov ecx, eax
call fcn.004073d0
lea edx, [ebp - 0x214]
mov ecx, eax
call fcn.00407760
mov edx, str._installed_as
mov ecx, eax
call fcn.004073d0
lea edx, [ebp - 0x414]
mov ecx, eax
call fcn.00407760
cmp byte [ebp - 0x491], 0
mov ecx, str.__64_
mov edx, str.__32_
cmove edx, ecx
mov ecx, eax
call fcn.004073d0
push eax
call fcn.00407a20
mov byte [ebp - 4], 2
add esp, 4
mov edx, dword [ebp - 0x4a0]
cmp edx, 8
jb 0x41f6d3
mov ecx, dword [ebp - 0x4b4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41f6c9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fa33
push edx
push ecx
call fcn.004290dc
add esp, 8
lea eax, [ebp - 0x488]
mov dword [ebp - 0x488], 0x200
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x418]
push eax
push 2
push str.DisplayVersion
push 0
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x41f732
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f710
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.00409520
lea eax, [ebp - 0x488]
push eax
push 0
lea eax, [ebp - 0x418]
push eax
push 2
push str.InstallLocation
push 0
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x41f7c6
mov eax, dword [ebp - 0x488]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00429397
add esp, 4
mov esi, eax
lea eax, [ebp - 0x488]
push eax
push esi
lea eax, [ebp - 0x418]
push eax
push 2
push str.InstallLocation
push 0
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x41f7bd
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f7a1
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x438]
call fcn.00409520
push esi
call fcn.004293a0
add esp, 4
mov edi, dword [ebp - 0x498]
mov esi, dword [edi + 8]
cmp dword [edi + 0xc], esi
je 0x41f837
lea eax, [ebp - 0x480]
mov dword [ebp - 0x49c], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.InstalledProducts::InstalledProduct.0
push eax
call fcn.00405520
lea eax, [ebp - 0x468]
mov byte [ebp - 4], 4
lea ecx, [esi + 0x1c]
push eax
call fcn.00405520
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 5
lea ecx, [esi + 0x34]
push eax
call fcn.00405520
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 6
lea ecx, [esi + 0x4c]
push eax
call fcn.00405520
mov al, byte [ebp - 0x420]
mov byte [esi + 0x64], al
add dword [edi + 8], 0x68
jmp 0x41f847
lea eax, [ebp - 0x484]
push eax
push esi
lea ecx, [edi + 4]
call fcn.004213b0
lea ecx, [ebp - 0x484]
mov dword [ebp - 4], 0xffffffff
call fcn.0041f130
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
push dword [ebp - 0x48c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
jmp 0x41f3e5
lea ecx, [ebp - 0x4b4]
call fcn.0041f060
mov dword [ebp - 4], 7
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x41f88e
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4858e0
call fcn.00408830
add esp, 4
mov edx, str.d:jenkinsworkspace_n_sucommon_src_sucommoninstalledproducts.cpp
mov ecx, eax
call fcn.004073d0
mov edx, 0x476f7c
mov ecx, eax
call fcn.004073d0
push 0x45
mov ecx, eax
call fcn.00405950
mov edx, str.:_Error_opening_uninstall_key__
mov ecx, eax
call fcn.004073d0
lea edx, [ebp - 0x414]
mov ecx, eax
call fcn.00407760
mov edx, 0x479100
mov ecx, eax
call fcn.004073d0
push esi
mov ecx, eax
call fcn.004057b0
mov edx, 0x4790fc
mov ecx, eax
call fcn.004073d0
push eax
call fcn.00407a20
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov edx, dword [ebp - 0x4a0]
cmp edx, 8
jb 0x41f948
mov ecx, dword [ebp - 0x4b4]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41f93e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fa33
push edx
push ecx
call fcn.004290dc
add esp, 8
inc ebx
test esi, esi
je 0x41f3e5
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41fa15
lea ecx, [ebp - 0x4cc]
call fcn.0041f060
mov dword [ebp - 4], 8
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x41f97f
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x4858e0
call fcn.00408830
add esp, 4
mov edx, str.d:jenkinsworkspace_n_sucommon_src_sucommoninstalledproducts.cpp
mov ecx, eax
call fcn.004073d0
mov edx, 0x476f7c
mov ecx, eax
call fcn.004073d0
push 0x4d
mov ecx, eax
call fcn.00405950
mov edx, str.:_Error_opening_root_uninstall_key__
mov ecx, eax
call fcn.004073d0
push esi
mov ecx, eax
call fcn.004057b0
mov edx, 0x4790fc
mov ecx, eax
call fcn.004073d0
push eax
call fcn.00407a20
mov edx, dword [ebp - 0x4b8]
add esp, 4
cmp edx, 8
jb 0x41fa15
mov ecx, dword [ebp - 0x4cc]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x41fa0b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41fa33
push edx
push ecx
call fcn.004290dc
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004290a8
mov esp, ebp
pop ebp
ret 4
call fcn.00443bfc
int3