Function at 0x439de7
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push 0x2dc
mov eax, 0x4cf644
call fcn.004a9f73
mov edi, ecx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2b8]
push ecx
push 0x20019
xor ebx, ebx
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push ebx
push esi
push eax
mov dword [ebp - 0x2c0], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x439e47
push esi
push eax
push 0x467
push str.CDataCollect::CollectSaftWareList
push str._n__s:_d__RegOpenKeyEx_is_error__d__Path:_s
push ecx
call fcn.0044d523
pop ecx
push eax
call fcn.0044d561
add esp, 0x18
jmp 0x43a0e7
push 0xf
xor eax, eax
pop ecx
mov dword [ebp - 0x254], ecx
mov dword [ebp - 0x258], eax
mov byte [ebp - 0x268], al
mov dword [ebp - 4], eax
mov dword [ebp - 0x26c], ecx
mov dword [ebp - 0x270], eax
mov byte [ebp - 0x280], al
push 0x103
mov byte [ebp - 4], 1
push eax
mov byte [ebp - 0x220], al
lea eax, [ebp - 0x21f]
push eax
call fcn.004aa670
add esp, 0xc
mov dword [ebp - 0x2c4], 0x104
lea eax, [ebp - 0x2d8]
xor esi, esi
mov dword [ebp - 0x2bc], esi
push eax
lea eax, [ebp - 0x2dc]
push eax
lea eax, [ebp - 0x2e0]
push eax
lea eax, [ebp - 0x2e8]
push eax
lea eax, [ebp - 0x2e4]
push eax
lea eax, [ebp - 0x2cc]
push eax
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x2bc]
push eax
push esi
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x2b8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [ebp - 0x2bc]
test eax, eax
je 0x43a0a0
push 0xf
xor ecx, ecx
pop edx
mov dword [ebp - 0x23c], edx
mov dword [ebp - 0x240], ecx
mov byte [ebp - 0x250], cl
mov dword [ebp - 0x224], edx
mov dword [ebp - 0x228], ecx
mov byte [ebp - 0x238], cl
mov byte [ebp - 4], 3
mov esi, ecx
test eax, eax
je 0x43a080
lea eax, [ebp - 0x2d8]
mov dword [ebp - 0x2c8], 0x104
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x118]
push eax
push esi
push dword [ebp - 0x2b8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x439fd9
push str.DisplayName
lea ecx, [ebp - 0x2b0]
call fcn.00404860
lea eax, [ebp - 0x118]
mov byte [ebp - 4], 4
or ebx, 1
lea ecx, [ebp - 0x298]
push eax
mov dword [ebp - 0x2c0], ebx
call fcn.00404860
lea eax, [ebp - 0x238]
mov dword [ebp - 4], 5
push eax
lea eax, [ebp - 0x2b0]
or ebx, 2
push eax
lea eax, [ebp - 0x298]
mov dword [ebp - 0x2c0], ebx
push eax
push dword [ebp - 0x2b8]
call fcn.004364cc
mov byte [ebp - 0x2b1], 1
test al, al
jne 0x439fe0
mov byte [ebp - 0x2b1], 0
test bl, 2
je 0x439ff7
push 0
push 1
lea ecx, [ebp - 0x298]
and ebx, 0xfffffffd
call fcn.00404b60
mov dword [ebp - 4], 3
test bl, 1
je 0x43a015
push 0
push 1
lea ecx, [ebp - 0x2b0]
and ebx, 0xfffffffe
call fcn.00404b60
cmp byte [ebp - 0x2b1], 0
je 0x43a070
lea eax, [ebp - 0x118]
mov ecx, edi
push eax
call fcn.0043a0ef
cmp dword [ebp - 0x224], 0x10
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
push eax
push 0x4a3
push str.CDataCollect::CollectSaftWareList
push str.__s:_d_SoftWare:_s
call fcn.0044d523
push eax
call fcn.0044d561
add esp, 0x14
lea eax, [ebp - 0x238]
lea ecx, [edi + 0x1c0]
push eax
call fcn.0043a1ec
inc esi
push 0
pop ecx
cmp esi, dword [ebp - 0x2bc]
jb 0x439f3c
push ecx
push 1
lea ecx, [ebp - 0x238]
call fcn.00404b60
xor esi, esi
lea ecx, [ebp - 0x250]
push esi
push 1
call fcn.00404b60
jmp 0x43a0bf
push 0x4ab
push str.CDataCollect::CollectSaftWareList
push str.__s:_d_RegQueryInfoKey
push ecx
call fcn.0044d523
pop ecx
push eax
call fcn.0044d561
add esp, 0x10
push dword [ebp - 0x2b8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push 1
lea ecx, [ebp - 0x280]
call fcn.00404b60
push esi
push 1
lea ecx, [ebp - 0x268]
call fcn.00404b60
call fcn.004a9f22
ret 8