Function at 0x402074
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push esi
push edi
cmp dword [0x41506c], 0
je reloc.gdi32.dll_SetWorldTransform
push dword [0x41506c]
call fcn.00401871
mov dword [0x41506c], 0
cmp dword [0x415070], 0
je reloc.gdi32.dll_SetWorldTransform
push dword [0x415070]
call fcn.00401871
mov dword [0x415070], 0
lea eax, [ebp - 0x1010]
push eax
call fcn.00401000
lea eax, [ebp - 0x1014]
push eax
call fcn.00401000
lea eax, [ebp - 4]
push eax
push reloc.shlwapi.dll_ChrCmpIA
push reloc.gdi32.dll_SetWorldTransform
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 0x100c], 0
mov dword [ebp - 0x1008], 0xfff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push reloc.shlwapi.dll_ChrCmpIA
call fcn.00401db1
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov edx, eax
lea eax, [ebp - 0x1004]
push eax
push edx
call fcn.00401e05
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 0x1020], eax
lea eax, [ebp - 0x1018]
push eax
push reloc.shlwapi.dll_SHRegDeleteUSValueW
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push reloc.gdi32.dll_SetWorldTransform
call fcn.00401d2a
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp eax, 1
jbe reloc.gdi32.dll_SetWorldTransform
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401537
lea eax, [ebp - 0x1018]
push eax
push reloc.shlwapi.dll_StrDupA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push reloc.gdi32.dll_SetWorldTransform
add byte [eax - reloc.gdi32.dll_SetWorldTransform], al
jmp dword [ebx]
invalid
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x1018], 1
jbe reloc.gdi32.dll_SetWorldTransform
push eax
push eax
lea eax, [ebp - 0x1004]
push eax
call sub.kernel32.dll_lstrlenA
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401537
pop eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401537
call fcn.00401871
jmp reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 0x1004]
push eax
call sub.kernel32.dll_lstrlenA
inc eax
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401537
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
inc dword [ebp - 0x100c]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push 0
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401522
push 0
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401522
lea eax, [ebp - 0x101c]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.ole32.dll_GetHGlobalFromStream
test eax, eax
js reloc.gdi32.dll_SetWorldTransform
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401091
mov dword [ebp - 0x1018], eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401888
mov dword [0x41506c], eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_GlobalLock
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov ecx, dword [ebp - 0x1018]
mov esi, eax
mov edi, dword [0x41506c]
rep movsb byte es:[edi], byte [esi]
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_GlobalUnlock
lea eax, [ebp - 0x101c]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.ole32.dll_GetHGlobalFromStream
test eax, eax
js reloc.gdi32.dll_SetWorldTransform
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401091
mov dword [ebp - 0x1018], eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401888
mov dword [0x415070], eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_GlobalLock
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov ecx, dword [ebp - 0x1018]
mov esi, eax
mov edi, dword [0x415070]
rep movsb byte es:[edi], byte [esi]
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_GlobalUnlock
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401026
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401026
pop edi
pop esi
leave
ret