Function at 0x40317f
Capabilities:
Get installed programs
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
mov esi, str.C:Program_Files
lea edi, [ebp - 0x110]
push 0x3c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0xff]
mov esi, dword [sym.imp.USER32.dll_FindWindowA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor edi, edi
mov ebx, str.Winamp_v1.x
push edi
push ebx
call esi
test eax, eax
je 0x4031e0
push 5
push 0x49e8b4
push str.You_must_first_exit__nWinamp_before_installing._n
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
je 0x40338a
push edi
push ebx
jmp 0x4031ba
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call ebx
test eax, eax
jne 0x403264
push 1
lea eax, [ebp - 0xc]
pop esi
mov dword [ebp - 0xc], 0x104
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 8]
push eax
push edi
push str.ProgramFilesDir
mov dword [ebp - 8], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40325b
cmp dword [ebp - 8], esi
jne 0x40325b
lea edi, [ebp - 0x214]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x110]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [ebp - 0x110]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ebp + ecx - 0x111], 0x5c
jne 0x403293
lea edi, [ebp - 0x110]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
and byte [ebp + ecx - 0x111], al
lea edi, [ebp - 0x110]
or ecx, 0xffffffff
xor eax, eax
mov esi, 0x49e954
repne scasb al, byte es:[edi]
dec edi
lea eax, [ebp - 4]
movsd dword es:[edi], dword [esi]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallWinamp
push 0x80000002
movsd dword es:[edi], dword [esi]
call ebx
test eax, eax
jne 0x403377
push 1
lea eax, [ebp - 0xc]
pop esi
mov dword [ebp - 0xc], 0x104
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.UninstallString
mov dword [ebp - 8], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40336e
cmp dword [ebp - 8], esi
jne 0x40336e
lea edi, [ebp - 0x214]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ebp + ecx - 0x214]
lea ecx, [ebp - 0x214]
cmp eax, ecx
jb 0x40336e
cmp byte [eax], 0x5c
je 0x40332b
dec eax
lea ecx, [ebp - 0x214]
cmp eax, ecx
jae 0x40331b
lea ecx, [ebp - 0x214]
cmp eax, ecx
jb 0x40336e
and byte [eax], 0
lea edi, [ebp - 0x214]
mov al, byte [edi]
cmp al, 0x20
je 0x403348
cmp al, 0x22
jne 0x40334b
inc edi
jmp 0x40333e
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x110]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x110]
push eax
call fcn.00403652
test eax, eax
pop ecx
jne 0x40339d
xor edi, edi
push 0x30
push 0x49e8b4
push str.Installation_aborted
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10