Function at 0x49c6e0
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10a0
call fcn.004a9b70
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x443]
push ebx
push eax
mov byte [ebp - 0x444], bl
call fcn.004a3190
mov eax, 0x80000002
add esp, 0xc
mov dword [ebp - 0x106c], 0x104
mov dword [ebp - 0x104c], ebx
mov dword [ebp - 0x1080], eax
mov dword [ebp - 0x107c], VariantCopy
mov dword [ebp - 0x1078], eax
cmp dword [0x4d2a68], ebx
je 0x49c85d
mov dword [ebp - 0x1048], 2
cmp dword [0x4d2afc], ebx
je 0x49c782
mov ecx, dword [0x4c6444]
mov edx, dword [0x4c6448]
mov dword [ebp - 0x1048], 3
mov dword [ebp - 0x1060], ecx
mov dword [ebp - 0x1058], edx
xor esi, esi
cmp dword [ebp - 0x1048], ebx
jle 0x49c839
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp esi, 2
jge 0x49c7f8
push str.SoftwareBillP_StudiosWinPatrolUnInstall
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x208
ja 0x49c7cf
push str.SoftwareBillP_StudiosWinPatrolUnInstall
lea eax, [ebp - 0x33c]
push eax
call edi
lea ecx, [ebp - 0x33c]
push ecx
push 0x80000001
call fcn.0048f3b0
add esp, 8
push str.SoftwareBillP_StudiosWinPatrolUnInstallUSER
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x208
ja 0x49c82c
push str.SoftwareBillP_StudiosWinPatrolUnInstallUSER
lea edx, [ebp - 0x33c]
push edx
call edi
lea eax, [ebp - 0x33c]
push eax
jmp 0x49c81f
push str.SoftwareBillP_StudiosWinPatrolUnInstall64
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x208
ja 0x49c82c
push str.SoftwareBillP_StudiosWinPatrolUnInstall64
lea ecx, [ebp - 0x33c]
push ecx
call edi
lea edx, [ebp - 0x33c]
push edx
push 0x80000001
call fcn.0048f3b0
add esp, 8
inc esi
cmp esi, dword [ebp - 0x1048]
jl 0x49c796
cmp dword [ebp + 8], ebx
jne 0x49c870
cmp dword [0x4d2afc], ebx
je 0x49c85d
mov eax, dword [ebp - 0x1060]
mov ecx, dword [ebp - 0x1058]
mov dword [0x4c6444], eax
mov dword [0x4c6448], ecx
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
xor edi, edi
mov dword [ebp - 0x1054], edi
cmp dword [ebp - 0x1048], ebx
jle 0x49cb85
push edi
push str.Type___d
lea edx, [ebp - 0x28]
push 0x20
push edx
call fcn.00402830
push str.InitUninstallPrograms
lea esi, [ebp - 0x28]
call fcn.0047fb10
add esp, 0x14
cmp edi, 2
jge 0x49c8bb
mov eax, 0x20019
mov dword [0x4c6448], 0xf003f
jmp 0x49c8c0
mov eax, 0x20119
mov ecx, dword [ebp + edi*4 - 0x1080]
lea edx, [ebp - 0x1050]
push edx
push eax
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
push ecx
mov dword [0x4c6444], eax
mov dword [ebp - 0x105c], ebx
mov dword [ebp - 0x1064], ebx
mov dword [ebp - 0x1070], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x49cb65
lea eax, [ebp - 0x1090]
push eax
lea ecx, [ebp - 0x1098]
push ecx
lea edx, [ebp - 0x1084]
push edx
lea eax, [ebp - 0x10a0]
push eax
lea ecx, [ebp - 0x109c]
push ecx
lea edx, [ebp - 0x1094]
push edx
lea eax, [ebp - 0x1088]
push eax
lea ecx, [ebp - 0x104c]
push ecx
mov ecx, dword [ebp - 0x1050]
push ebx
lea edx, [ebp - 0x106c]
push edx
lea eax, [ebp - 0x444]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x104c], ebx
je 0x49cb65
mov esi, dword [ebp - 0x105c]
mov eax, 0xff
mov dword [ebp - 0x1068], eax
mov dword [ebp - 0x1074], eax
lea edx, [ebp - 0x1090]
push edx
lea eax, [ebp - 0x1068]
push eax
lea ecx, [ebp - 0x1044]
push ecx
mov ecx, dword [ebp - 0x1050]
push ebx
lea edx, [ebp - 0x1074]
push edx
lea eax, [ebp - 0xc44]
push eax
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, dword [ebp - 0x1064]
mov edx, ecx
inc esi
inc ecx
mov dword [ebp - 0x105c], esi
mov dword [ebp - 0x1064], ecx
cmp edx, dword [ebp - 0x104c]
ja 0x49cb65
cmp eax, 0x103
je 0x49cb65
cmp eax, ebx
jne 0x49c95b
lea eax, [ebp - 0xc44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x49c95b
lea eax, [ebp - 0x844]
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov ecx, eax
mov edx, 0x400
sub esi, ecx
mov edi, edi
lea ecx, [edx + 0x7ffffbfe]
test ecx, ecx
je 0x49ca19
mov cl, byte [esi + eax]
cmp cl, bl
je 0x49ca19
mov byte [eax], cl
inc eax
dec edx
jne 0x49ca00
jmp 0x49ca1d
cmp edx, ebx
jne 0x49ca1e
dec eax
mov byte [eax], bl
mov eax, 0x400
lea ecx, [ebp - 0x844]
jmp 0x49ca30
cmp byte [ecx], bl
je 0x49ca3a
inc ecx
dec eax
jne 0x49ca30
jmp 0x49ca86
cmp eax, ebx
je 0x49ca86
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x844]
je 0x49ca7d
mov edi, 0x4b17dc
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
cmp esi, ebx
je 0x49ca79
mov dl, byte [edi + eax]
cmp dl, bl
je 0x49ca79
mov byte [eax], dl
dec ecx
inc eax
dec esi
cmp ecx, ebx
jne 0x49ca63
jmp 0x49ca7d
cmp ecx, ebx
jne 0x49ca7e
dec eax
mov edi, dword [ebp - 0x1054]
mov byte [eax], bl
mov eax, 0x400
lea ecx, [ebp - 0x844]
cmp byte [ecx], bl
je 0x49ca9b
inc ecx
dec eax
jne 0x49ca91
jmp 0x49cae8
cmp eax, ebx
je 0x49cae8
mov edx, 0x400
sub edx, eax
mov ecx, 0x400
sub ecx, edx
lea eax, [ebp + edx - 0x844]
je 0x49cadf
lea edi, [ebp - 0xc44]
lea esi, [ecx + edx + 0x7ffffbff]
sub edi, eax
cmp esi, ebx
je 0x49cadb
mov dl, byte [edi + eax]
cmp dl, bl
je 0x49cadb
mov byte [eax], dl
dec ecx
inc eax
dec esi
cmp ecx, ebx
jne 0x49cac5
jmp 0x49cadf
cmp ecx, ebx
jne 0x49cae0
dec eax
mov edi, dword [ebp - 0x1054]
mov byte [eax], bl
push 0xff
lea edx, [ebp - 0x844]
push str.DisplayName
push edx
mov edx, dword [ebp - 0x1070]
lea ecx, [ebp - 0x134]
call fcn.0048e050
add esp, 0xc
test eax, eax
je 0x49c95b
mov eax, edi
sub eax, ebx
je 0x49cb57
dec eax
je 0x49cb49
dec eax
jne 0x49c95b
lea eax, [ebp - 0xc44]
push eax
push str.SoftwareBillP_StudiosWinPatrolUnInstall64
lea ecx, [ebp - 0x134]
mov edx, 0x80000001
call fcn.0048e390
add esp, 8
jmp 0x49c95b
lea ecx, [ebp - 0xc44]
push ecx
push str.SoftwareBillP_StudiosWinPatrolUnInstallUSER
jmp 0x49cb31
lea edx, [ebp - 0xc44]
push edx
push str.SoftwareBillP_StudiosWinPatrolUnInstall
jmp 0x49cb31
mov eax, dword [ebp - 0x1050]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
mov dword [ebp - 0x1054], edi
cmp edi, dword [ebp - 0x1048]
jl 0x49c884
cmp dword [0x4d2afc], ebx
je 0x49cba5
mov ecx, dword [ebp - 0x1060]
mov edx, dword [ebp - 0x1058]
mov dword [0x4c6444], ecx
mov dword [0x4c6448], edx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret