Function at 0x41a920
Capabilities:
Get installed programs

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5ddcb9
mov eax, dword fs:[0]
push eax
sub esp, 0xd40
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
neg ebx
mov dword [ebp - 0xd3c], eax
sbb ebx, ebx
add ebx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xd4c], ebx
call fcn.00452596
test al, al
je 0x41a98f
sal byte [esp + ebx - 0x29], 0x52
xlatb
push edx
lodsd eax, dword [esi]
xchg dword [ebx], esi
js 0x41a970
mov cl, 0x41
imul ecx, dword [edi + ebx*2 - 0x36], 0xa4db2479
or ebx, dword [ecx - 0x5d]
push es
dec byte [ebx - 0xd4b63]
dec dword [ebp - 0xd377b]
call dword [eax + 0x68]
aas
add byte [edi], cl
add byte [edx], ch
lea eax, [ebp - 0xd38]
push eax
push 0xf003f
push 0
push str.softwareMicrosoftWindowsCurrentVersionUninstall
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41a9d7
push 0
lea eax, [ebp - 0xd38]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41b470
call fcn.00452620
test al, al
je 0x41a9f3
insd dword es:[edi], dx
invalid
call fcn.00452596
test al, al
je 0x41aa17
cmp ah, byte [ebx + edx]
invalid
call fcn.00452551
test al, al
je 0x41aa39
push ss
sbb dword [0x3df742c0], ecx
cmpsb byte [esi], byte es:[edi]
scasd eax, dword es:[edi]
imul esi, ebx, 0x20
sub al, byte [ebx + 0x27]
cmpsb byte [esi], byte es:[edi]
sar dword [esi + 0x38], 0xd4
cli
outsd dx, dword [esi]
test dword [ebx], edi
sbb al, 0x6a
add byte [ebp - 0xd337b], cl
call dword [eax + 0x6a]
add byte [eax + 0x3f], ch
add byte [edi], cl
add byte [edx], ch
push 0
lea eax, [ebp - 0xd34]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5e6c34
push dword [ebp - 0xd38]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x41aa75
push dword [ebp - 0xd38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41b470
call fcn.00452551
test al, al
je 0x41aa9a
push cs
cmp al, 0xf7
mov bl, 0
out 8, al
push ecx
scasb al, byte es:[edi]
int 0x3e
adc dword [ebp - 0x6a267e9d], edx
sub eax, dword [ecx + 0x2e67b79b]
jmp 0x30dfddca
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.00480620
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00480620
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.00480620
push 0x208
lea eax, [ebp - 0xa38]
push 0
push eax
call fcn.00480620
push 0x208
lea eax, [ebp - 0xc40]
push 0
push eax
call fcn.00480620
push 0x208
lea eax, [ebp - 0x830]
push 0
push eax
call fcn.00480620
add esp, 0x48
lea ecx, [ebp - 0xd18]
push str.10.3.1.0
call fcn.00404060
push str.10.3
lea ecx, [ebp - 0xd00]
mov dword [ebp - 4], 0
call fcn.00404060
mov ebx, dword [ebp - 0xd3c]
lea ecx, [ebp - 0xd30]
push ebx
mov byte [ebp - 4], 1
call fcn.00404060
mov byte [ebp - 4], 2
call fcn.00452620
test al, al
je 0x41ab7a
sub dword [ebx + 0x71fbc558], esp
push ss
in eax, dx
jae 0x41ab5f
pop ss
push edx
leave
push ebx
call 0x5badb0c4
pop ebp
pop es
je 0x41ab42
outsb dx, byte [esi]
mov byte [0xc49d8bc1], al
invalid
cmp dword [ebp - 0xd20], 0
je 0x41accf
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xd30]
push eax
lea ecx, [ebp - 0xd18]
call fcn.004029a0
mov dword [ebp - 0xd48], 0
mov dword [ebp - 0xd44], 0
mov dword [ebp - 0xd40], 0
push 0x5e8850
lea ecx, [ebp - 0xc70]
mov byte [ebp - 4], 3
call fcn.00404060
push ebx
lea ecx, [ebp - 0xce8]
mov byte [ebp - 4], 4
call fcn.00404060
lea eax, [ebp - 0xd48]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0xc70]
push eax
lea eax, [ebp - 0xce8]
push eax
call fcn.004575da
mov eax, dword [ebp - 0xcd4]
add esp, 0xc
cmp eax, 8
jb 0x41ac1e
inc eax
lea ecx, [ebp - 0xce8]
push eax
push dword [ebp - 0xce8]
call fcn.00402c10
xor eax, eax
mov dword [ebp - 0xcd4], 7
mov word [ebp - 0xce8], ax
mov eax, dword [ebp - 0xc5c]
mov dword [ebp - 0xcd8], 0
mov byte [ebp - 4], 3
cmp eax, 8
jb 0x41ac5d
inc eax
lea ecx, [ebp - 0xc70]
push eax
push dword [ebp - 0xc70]
call fcn.00402c10
mov ecx, dword [ebp - 0xd44]
mov eax, 0x2aaaaaab
mov esi, dword [ebp - 0xd48]
sub ecx, esi
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 4
jne 0x41acc0
lea eax, [ebp - 0xd00]
cmp eax, esi
je 0x41ac97
push 0xffffffffffffffff
push 0
push esi
mov ecx, eax
call fcn.004029a0
push 0x5e8850
lea ecx, [ebp - 0xd00]
call fcn.0040aa00
mov eax, dword [ebp - 0xd48]
lea ecx, [ebp - 0xd00]
push 0xffffffffffffffff
add eax, 0x18
push 0
push eax
call fcn.00405b10
lea ecx, [ebp - 0xd48]
mov byte [ebp - 4], 2
call fcn.00405ef0
call fcn.00452482
test al, al
je 0x41acea
push ebx
div edx
enter 0xffffffffffffce8c, 0x3c
call 0xe311871c
ret 0x6f4d
call fcn.00452146
test al, al
je 0x41ad0e
invalid
call fcn.00452146
test al, al
je 0x41ad32
dec edi
mov dword [ecx - 0x2128793f], esi
inc edx
dec esp
push ds
inc ecx
mov ebx, 0x7cd2460c
lodsb al, byte [esi]
outsb dx, byte [esi]
sub al, 0x5b
jmp 0x41ad21
call fcn.0041b700
mov esi, eax
mov dword [ebp - 0xc74], 7
xor eax, eax
mov dword [ebp - 0xc78], 0
mov word [ebp - 0xc88], ax
mov dword [ebp - 0xc44], 7
mov dword [ebp - 0xc48], eax
mov word [ebp - 0xc58], ax
mov byte [ebp - 4], 7
test esi, esi
je 0x41ade5
mov eax, dword [esi]
lea ecx, [ebp - 0xc70]
push ecx
mov ecx, esi
call dword [eax + 0x30]
push eax
lea ecx, [ebp - 0xc88]
call fcn.00404270
mov eax, dword [ebp - 0xc5c]
cmp eax, 8
jb 0x41adad
inc eax
lea ecx, [ebp - 0xc70]
push eax
push dword [ebp - 0xc70]
call fcn.00402c10
mov eax, dword [esi]
lea ecx, [ebp - 0xc70]
push ecx
mov ecx, esi
call dword [eax + 0x34]
push eax
lea ecx, [ebp - 0xc58]
call fcn.00404270
mov eax, dword [ebp - 0xc5c]
cmp eax, 8
jb 0x41ade5
inc eax
lea ecx, [ebp - 0xc70]
push eax
push dword [ebp - 0xc70]
call fcn.00402c10
invalid
call fcn.00452077
test al, al
je 0x41ae0e
dec esp
nop
mov edx, 0x6bfe8b11
cld
jle 0x41ae21
call 0x80311c1f
pushal
pushal
outsb dx, byte [esi]
sub dl, byte [esi]
test eax, 0xec2b7ae2
jnp 0x41addd
lcall 0x76f9, 0xe810e4e7
add eax, dword [eax]
call fcn.0045250c
test al, al
je 0x41ae33
wait
ret
in eax, 0x8c
jno 0x41ae3f
je 0x41ae98
add dword [ebx + 0x57], 0x45
inc ebp
xchg ebx, eax
push cs
outsd dx, dword [esi]
xor edx, dword [ecx - 0x7cab1714]
mov ebp, 0xfffff388
add byte [ebp + 0x12], dh
cmp dword [ebp - 0xc78], 0
jne 0x41ae4e
push 7
push 0x5e7d48
lea ecx, [ebp - 0xc88]
call fcn.00402ac0
dec eax
jge 0x41aea0
add byte [ebp - 0xc8773], cl
invalid
call fcn.00452551
test al, al
je 0x41ae73
cmpsd dword [esi], dword es:[edi]
xor al, byte [edi]
mov ebx, 0xdd3e4a9e
lodsb al, byte [esi]
or al, 0xf5
jae 0x41ae2a
test byte ds:[edx + 0x5162656e], al
mov bl, 0x79
push ecx
bound ebp, qword [esi + 0x41]
push 0xf3b8bd83
invalid
cmp dword [ebp - 0xc48], 0
jne 0x41ae8e
push 0x14
push 0x5e8854
lea ecx, [ebp - 0xc58]
call fcn.00402ac0
push 1
push 0x5e8880
lea ecx, [ebp - 0xc88]
call fcn.00405c20
invalid
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xd00]
push eax
lea ecx, [ebp - 0xc88]
call fcn.00405b10
call fcn.00452620
add eax, dword [eax]
test al, al
je 0x41aeda
invalid
call fcn.00402310
mov ecx, eax
call fcn.00471d04
push eax
lea ecx, [ebp - 0xcb8]
call fcn.00404060
push 0xd
push 0x5e76a0
lea ecx, [ebp - 0xcb8]
mov byte [ebp - 4], 8
call fcn.00405c20
call fcn.00452482
test al, al
je 0x41af23
dec eax
mov cl, 0x5e
rcl ch, cl
cdq
mov dh, bh
xchg ebx, eax
lodsd eax, dword [esi]
xlatb
lodsd eax, dword [esi]
ffreep st(1)
lodsb al, byte [esi]
pushfd
jge 0x41aeb9
call fcn.00452146
test al, al
je 0x41af47
mov gs, word [edi]
xor bl, byte [edx + 0x28]
outsd dx, dword [esi]
salc
mov ebx, 0xfe8dace5
mov ebx, 0xec755ce2
adc dh, cl
push ebp
and eax, 0x89e8ef2b
invalid
call fcn.00452146
test al, al
je 0x41af6b
sti
sub ah, byte [ebp + ebp + 0x3d]
fdivrp st(2)
xlatb
or ebx, dword [ebx]
fdiv qword [eax + 0x36]
lodsd eax, dword [esi]
mov al, 0x36
adc edi, dword [eax - 0x37eb757a]
inc edx
mov ebp, 0xe84212b3
mov al, byte [0x8bfffe73]
enter 0xffffffffffff8de8, 0x6d
add eax, 0x8d8d5000
pushal
invalid
call fcn.00402310
mov ecx, eax
call fcn.00471d04
push eax
lea ecx, [ebp - 0xca0]
call fcn.00404060
push 0xc
push 0x5e8884
lea ecx, [ebp - 0xca0]
mov byte [ebp - 4], 9
call fcn.00405c20
call fcn.00452077
test al, al
je 0x41afc2
aad 0x82
xor byte [ebp + 0x4bf49dae], ah
jne 0x41afb0
pop ds
mov edx, cr3
xor edi, dword [edx]
sub ah, bl
push esp
push ebp
dec ebx
mov byte [eax + 0x5c], bh
bound esi, qword [eax + edi*2]
inc edx
lahf
lcall 0x375, 0x45e8cb8a
add byte [eax + eax*8 - 0x83be38c], al
nop
xchg eax, edi
mov ah, 0xc0
xor dword [edi + 0x7f], ecx
mov ah, 0xca
mov byte [esi + ebp*2], ah
popal
pushal
push ss
add byte [ebp + 0x5776c296], dl
shr byte [ecx - 0x44], cl
adc ch, byte [eax - 0x60]
mov byte [esi], bl
call fcn.0045250c
test al, al
je 0x41afe7
invalid
push 0x5e88a0
lea ecx, [ebp - 0xcd0]
call fcn.00404060
cmp dword [ebp - 0xca4], 8
lea ecx, [ebp - 0xcb8]
mov byte [ebp - 4], 0xa
lea edx, [ebp - 0x628]
cmovae ecx, dword [ebp - 0xcb8]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41b015
cmp dword [ebp - 0xc74], 8
lea ecx, [ebp - 0xc88]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0xc88]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41b040
cmp dword [ebp - 0xc8c], 8
lea ecx, [ebp - 0xca0]
lea edx, [ebp - 0x420]
cmovae ecx, dword [ebp - 0xca0]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41b070
cmp dword [ebp - 0xcbc], 8
lea ecx, [ebp - 0xcd0]
lea edx, [ebp - 0xa38]
cmovae ecx, dword [ebp - 0xcd0]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41b0a0
cmp dword [ebp - 0xc44], 8
lea ecx, [ebp - 0xc58]
lea edx, [ebp - 0xc40]
cmovae ecx, dword [ebp - 0xc58]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41b0d0
cmp dword [ebp - 0xd04], 8
lea ecx, [ebp - 0xd18]
lea edx, [ebp - 0x830]
cmovae ecx, dword [ebp - 0xd18]
nop dword [eax + eax]
inc esp
add byte [eax], al
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x41b100
call fcn.0045218b
test al, al
je 0x41b12b
mov ebx, 0xe64862cb
je 0x41b0fd
mov byte [edi], ch
mov al, bl
sbb eax, 0xb1794a4a
out dx, al
call fcn.00452101
test al, al
je 0x41b14a
jmp 0x41b17b
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b153
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e88ac
push dword [ebp - 0xd34]
call esi
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b191
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x420]
push eax
push 1
push 0
push str.UninstallString
push dword [ebp - 0xd34]
call esi
lea ecx, [ebp - 0x628]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b1d0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x628]
push eax
push 1
push 0
push str.DisplayIcon
push dword [ebp - 0xd34]
call esi
lea ecx, [ebp - 0x830]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b210
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x830]
push eax
push 1
push 0
push str.DisplayVersion
push dword [ebp - 0xd34]
call esi
lea ecx, [ebp - 0xa38]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b250
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xa38]
push eax
push 1
push 0
push str.Publisher
push dword [ebp - 0xd34]
call esi
lea ecx, [ebp - 0xc40]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b290
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0xc40]
push eax
push 1
push 0
push str.URLInfoAbout
push dword [ebp - 0xd34]
call esi
call fcn.004524c7
test al, al
je 0x41b2d8
invalid
fdivr qword [eax - 0x2e4348be]
pushfd
sub al, 0xf3
ljmp 0xd324
call fcn.00452215
test al, al
je 0x41b2f8
push esi
sub dword [ecx + 0x71], 0xf0309085
xchg ebx, eax
daa
das
jo 0x41b2ba
cmc
sub al, 0x14
pushfd
mov ah, 1
lodsb al, byte [esi]
push cs
outsd dx, dword [esi]
call fcn.00452101
test al, al
je 0x41b320
add byte [eax + eax*8 - 0x5051e08c], al
scasb al, byte es:[edi]
scasd eax, dword es:[edi]
dec eax
rcl dword [eax - 0x79d4ff46], cl
test eax, 0x96adfcd8
lodsd eax, dword [esi]
xchg esi, eax
pop ds
jge 0x41b2fc
ja 0x41b346
pop eax
ljmp 0x9a6a
push dword [ebp - 0xd34]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xd38]
call esi
call fcn.00452077
test al, al
je 0x41b358
int3
xchg byte [ecx], dh
dec edi
popal
pop esp
push edx
out dx, al
add ch, byte [eax - 0x76]
jo 0x41b30d
in al, 0x92
sub byte [eax - 0x7a74e95c], bl
inc esp
invalid
mov eax, dword [ebp - 0xcbc]
cmp eax, 8
jb 0x41b376
inc eax
lea ecx, [ebp - 0xcd0]
push eax
push dword [ebp - 0xcd0]
call fcn.00402c10
xor eax, eax
mov dword [ebp - 0xcbc], 7
mov word [ebp - 0xcd0], ax
mov eax, dword [ebp - 0xc8c]
mov dword [ebp - 0xcc0], 0
cmp eax, 8
jb 0x41b3b1
inc eax
lea ecx, [ebp - 0xca0]
push eax
push dword [ebp - 0xca0]
call fcn.00402c10
xor eax, eax
mov dword [ebp - 0xc8c], 7
mov word [ebp - 0xca0], ax
mov eax, dword [ebp - 0xca4]
mov dword [ebp - 0xc90], 0
cmp eax, 8
jb 0x41b3ec
inc eax
lea ecx, [ebp - 0xcb8]
push eax
push dword [ebp - 0xcb8]
call fcn.00402c10
xor eax, eax
mov dword [ebp - 0xca4], 7
mov word [ebp - 0xcb8], ax
mov eax, dword [ebp - 0xc44]
mov dword [ebp - 0xca8], 0
cmp eax, 8
jb 0x41b427
inc eax
lea ecx, [ebp - 0xc58]
push eax
push dword [ebp - 0xc58]
call fcn.00402c10
xor eax, eax
mov dword [ebp - 0xc44], 7
lea ecx, [ebp - 0xc88]
mov dword [ebp - 0xc48], 0
mov word [ebp - 0xc58], ax
call fcn.00447330
lea ecx, [ebp - 0xd30]
call fcn.00447330
lea ecx, [ebp - 0xd00]
call fcn.00447330
lea ecx, [ebp - 0xd18]
call fcn.00447330
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret 8