Function at 0x401690
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Get process heap force flags
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x39c
mov dword [esp + 0x2c], eax
lea ebp, [esp + 0x190]
mov dword [esp + 0x4c], 0xff
mov dword [esp + 0x30], 0
jmp 0x401790
lea ecx, [esp + 0x50]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisplayName
mov dword [esp], eax
call esi
sub esp, 0x18
test eax, eax
jne 0x401773
lea eax, [esp + 0x58]
mov dword [esp + 0x60], 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], str.WindowsInstaller
mov dword [esp], eax
call esi
sub esp, 0x18
test eax, eax
jne 0x401737
cmp dword [esp + 0x5c], 4
je 0x401b20
mov eax, dword [esp + 0x48]
lea ebx, [esp + 0x54]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.UninstallString
mov dword [esp], eax
call esi
sub esp, 0x18
test eax, eax
je 0x401878
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
add dword [esp + 0x30], 1
mov dword [esp + 0x4c], 0xff
lea eax, [esp + 0x4c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x18], 0
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebp
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
sub esp, 0x20
cmp eax, 0x103
je 0x401b10
lea eax, [esp + 0x48]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], 0
mov dword [esp + 4], ebp
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
sub esp, 0x14
lea eax, [esp + 0x58]
lea edi, [esp + 0x60]
mov dword [esp + 0x60], 4
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
lea ebx, [esp + 0x5c]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], str.SystemComponent
mov dword [esp], eax
call esi
sub esp, 0x18
test eax, eax
mov eax, dword [esp + 0x48]
jne 0x4016c0
cmp dword [esp + 0x5c], 4
jne 0x4016c0
cmp dword [esp + 0x58], 1
jne 0x4016c0
jmp 0x401777
mov edx, dword [esp + 0x54]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 0x34], eax
call eax
sub esp, 0xc
mov edi, eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x14], ebx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.UninstallString
mov dword [esp], eax
call esi
sub esp, 0x18
mov eax, dword [section..bss]
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
add eax, 1
mov dword [section..bss], eax
lea eax, [eax + eax*4]
shl eax, 2
mov dword [esp + 0xc], eax
mov eax, dword [0x407004]
mov dword [esp + 8], eax
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapReAlloc]
mov edx, dword [section..bss]
sub esp, 0x10
mov dword [0x407004], eax
cmp word [esp + 0x190], 0
lea edx, [edx + edx*4]
lea ebx, [eax + edx*4 - 0x14]
mov eax, dword [esp + 0x2c]
mov dword [ebx], eax
je 0x401de8
mov eax, ebp
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x401940
sub eax, ebp
add eax, 2
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
call eax
mov dword [ebx + 4], eax
mov eax, dword [section..bss]
sub esp, 0xc
lea edx, [eax + eax*4]
mov eax, dword [0x407004]
lea ebx, [eax + edx*4 - 0x14]
xor eax, eax
mov ecx, dword [ebx + 4]
lea esi, [esi]
movzx edx, word [ebp + eax]
mov word [ecx + eax], dx
add eax, 2
test dx, dx
jne 0x401990
mov edx, dword [esp + 0x50]
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov dword [esp + 8], edx
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [esp + 0x34]
call eax
mov edx, dword [0x407004]
sub esp, 0xc
mov dword [ebx + 8], eax
lea eax, [esp + 0x50]
mov dword [esp + 0x14], eax
mov eax, dword [section..bss]
lea eax, [eax + eax*4]
lea eax, [edx + eax*4]
mov eax, dword [eax - 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 4], str.DisplayName
mov dword [esp], eax
call esi
mov edx, dword [section..bss]
mov eax, dword [0x407004]
sub esp, 0x18
lea ecx, [edx + edx*4]
lea eax, [eax + ecx*4 - 0x14]
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], 0
test byte [0x404000], 8
je 0x401773
test edi, edi
je 0x401bbf
mov eax, edi
shr eax, 0x10
je 0x4020b0
mov dword [esp + 4], 0xffffffff
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x402106
movzx edx, word [edi]
test dx, dx
je 0x402187
lea esi, [esi]
mov ecx, eax
lea eax, [eax + 1]
cmp word [edi + ecx*2 + 2], 0
jne 0x401a78
mov ebx, 0x224c
lea eax, [esp + 0x66]
lea esi, [esp + 0x186]
mov word [esp + 0x64], bx
jmp 0x401ad8
cmp dx, 9
je 0x401d58
cmp dx, 0xa
jne 0x401ce6
mov ebx, 0x6e5c
add eax, 2
mov word [eax - 2], bx
lea ebx, [ecx - 1]
cmp eax, esi
ja 0x401df8
test ecx, ecx
jle 0x401df8
movzx edx, word [edi]
mov ecx, ebx
add edi, 2
cmp dx, 0xd
je 0x401cb0
jbe 0x401aa0
cmp dx, 0x22
je 0x401d40
cmp dx, 0x5c
jne 0x401cd9
mov ebx, 0x5c5c
add eax, 2
mov word [eax - 2], bx
jmp 0x401ac0
add esp, 0x39c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
cmp dword [esp + 0x58], 1
jne 0x401737
mov eax, 0x73
mov edx, str.msiexec__x_s
jmp 0x401b44
movzx eax, word [edx + 2]
add edx, 2
test ax, ax
jne 0x401b40
sub edx, str.msiexec__x_s
sar edx, 1
cmp word [esp + 0x190], 0
mov eax, edx
je 0x401b77
mov eax, ebp
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x401b68
sub eax, ebp
sar eax, 1
add eax, edx
add eax, eax
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [esp + 0x34], eax
call eax
sub esp, 0xc
mov edi, eax
mov dword [esp + 8], ebp
mov dword [esp + 4], str.msiexec__x_s
mov dword [esp], eax
call dword [0x40829c]
jmp 0x4018d3
mov dword [esp + 0x38], str._null_
mov ebx, dword [eax + 8]
test ebx, ebx
je 0x401e43
mov eax, ebx
shr eax, 0x10
je 0x4020d0
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x402125
cmp word [ebx], 0
je 0x402151
lea esi, [esi]
nop
mov edx, eax
lea eax, [eax + 1]
cmp word [ebx + edx*2 + 2], 0
jne 0x401c08
mov edi, 0x224c
mov dword [esp + 0x34], ebx
lea ecx, [esp + 0x66]
lea esi, [esp + 0x186]
mov word [esp + 0x64], di
jmp 0x401c65
cmp ax, 9
je 0x401cc8
cmp ax, 0xa
jne 0x401d76
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea eax, [edx - 1]
cmp ecx, esi
ja 0x401e60
test edx, edx
jle 0x401e60
mov edx, eax
add dword [esp + 0x34], 2
mov eax, dword [esp + 0x34]
movzx eax, word [eax - 2]
cmp ax, 0xd
je 0x401ca0
jbe 0x401c30
cmp ax, 0x22
je 0x401dd0
cmp ax, 0x5c
jne 0x401d69
mov ebx, 0x5c5c
add ecx, 2
mov word [ecx - 2], bx
jmp 0x401c50
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x401c50
mov edx, 0x725c
add eax, 2
mov word [eax - 2], dx
jmp 0x401ac0
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x401c50
lea ebx, [edx - 0x20]
cmp bx, 0x5e
jbe 0x4020fc
mov ebx, edx
mov byte [eax], 0x5c
add eax, 5
shr bx, 0xc
movzx ebx, bx
movzx ebx, byte [ebx + str.0123456789abcdefwmain]
mov byte [eax - 4], bl
mov ebx, edx
shr bx, 8
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefwmain]
mov byte [eax - 3], bl
mov ebx, edx
and edx, 0xf
shr bx, 4
movzx edx, byte [edx + str.0123456789abcdefwmain]
and ebx, 0xf
movzx ebx, byte [ebx + str.0123456789abcdefwmain]
mov byte [eax - 1], dl
mov byte [eax - 2], bl
jmp 0x401ac0
mov edx, 0x225c
add eax, 2
mov word [eax - 2], dx
jmp 0x401ac0
mov ebx, 0x745c
add eax, 2
mov word [eax - 2], bx
jmp 0x401ac0
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x4020f2
mov edi, eax
mov byte [ecx], 0x5c
add ecx, 5
shr di, 0xc
movzx edi, di
movzx ebx, byte [edi + str.0123456789abcdefwmain]
mov edi, eax
shr di, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdefwmain]
mov edi, eax
and eax, 0xf
shr di, 4
movzx eax, byte [eax + str.0123456789abcdefwmain]
and edi, 0xf
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdefwmain]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x401c50
mov edi, 0x225c
add ecx, 2
mov word [ecx - 2], di
jmp 0x401c50
mov eax, 2
jmp 0x40194e
mov byte [eax], 0x22
test ebx, ebx
jle 0x40219a
mov ecx, 0x2e2e
mov byte [eax + 3], 0x2e
lea edx, [eax + 4]
mov word [eax + 1], cx
lea eax, [esp + 0x64]
mov byte [edx], 0
mov dword [esp], eax
call dbg.__wine_dbg_strdup
mov edx, dword [section..bss]
mov dword [esp + 0x38], eax
mov eax, dword [0x407004]
lea ecx, [edx + edx*4]
lea eax, [eax + ecx*4 - 0x14]
mov ebx, dword [eax + 8]
test ebx, ebx
jne 0x401bd2
mov ebx, dword [eax + 4]
mov edi, str._null_
test ebx, ebx
jne 0x401ea5
mov eax, str._null_
jmp 0x40204c
mov byte [ecx], 0x22
test eax, eax
jle 0x402164
mov edx, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], dx
mov byte [eax], 0
lea eax, [esp + 0x64]
mov dword [esp], eax
call dbg.__wine_dbg_strdup
mov edx, dword [section..bss]
mov edi, eax
mov eax, dword [0x407004]
lea ecx, [edx + edx*4]
lea eax, [eax + ecx*4 - 0x14]
mov ebx, dword [eax + 4]
test ebx, ebx
je 0x401e4f
mov eax, ebx
shr eax, 0x10
je 0x402090
mov dword [esp + 4], 0xffffffff
mov dword [esp], ebx
call dword [sym.imp.kernel32.dll_IsBadStringPtrW]
sub esp, 8
test eax, eax
jne 0x402141
cmp word [ebx], 0
je 0x40216c
lea esi, [esi]
lea esi, [esi]
mov edx, eax
lea eax, [eax + 1]
cmp word [ebx + edx*2 + 2], 0
jne 0x401ee0
mov eax, 0x224c
mov dword [esp + 0x34], ebx
lea ecx, [esp + 0x66]
lea esi, [esp + 0x186]
mov word [esp + 0x64], ax
mov dword [esp + 0x3c], edi
jmp 0x401f45
cmp ax, 9
je 0x401f90
cmp ax, 0xa
jne 0x401fab
mov eax, 0x6e5c
add ecx, 2
mov word [ecx - 2], ax
lea esi, [esi]
lea eax, [edx - 1]
cmp ecx, esi
ja 0x402018
test edx, edx
jle 0x402018
mov edx, eax
add dword [esp + 0x34], 2
mov eax, dword [esp + 0x34]
movzx eax, word [eax - 2]
cmp ax, 0xd
je 0x401f80
jbe 0x401f10
cmp ax, 0x22
je 0x402000
cmp ax, 0x5c
jne 0x401f9e
mov ebx, 0x5c5c
add ecx, 2
mov word [ecx - 2], bx
jmp 0x401f30
mov eax, 0x725c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x401f30
mov eax, 0x745c
add ecx, 2
mov word [ecx - 2], ax
jmp 0x401f30
lea edi, [eax - 0x20]
cmp di, 0x5e
jbe 0x4020e8
mov edi, eax
mov byte [ecx], 0x5c
add ecx, 5
shr di, 0xc
movzx edi, di
movzx ebx, byte [edi + str.0123456789abcdefwmain]
mov edi, eax
shr di, 8
and edi, 0xf
mov byte [ecx - 4], bl
movzx ebx, byte [edi + str.0123456789abcdefwmain]
mov edi, eax
and eax, 0xf
shr di, 4
movzx eax, byte [eax + str.0123456789abcdefwmain]
and edi, 0xf
mov byte [ecx - 3], bl
movzx ebx, byte [edi + str.0123456789abcdefwmain]
mov byte [ecx - 1], al
mov byte [ecx - 2], bl
jmp 0x401f30
mov edi, 0x225c
add ecx, 2
mov word [ecx - 2], di
jmp 0x401f30
mov byte [ecx], 0x22
mov edi, dword [esp + 0x3c]
test eax, eax
jle 0x40217f
mov edx, 0x2e2e
mov byte [ecx + 3], 0x2e
lea eax, [ecx + 4]
mov word [ecx + 1], dx
mov byte [eax], 0
lea eax, [esp + 0x64]
mov dword [esp], eax
call dbg.__wine_dbg_strdup
mov edx, dword [section..bss]
mov esi, dword [esp + 0x38]
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], str.allocated_entry__d:__s___s____s_n
mov dword [esp + 8], str.FetchFromRootKey
mov dword [esp + 4], global___dbch
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0
jmp 0x401773
movzx ebx, bx
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call sym._wine_dbg_sprintf.constprop.0
mov edx, dword [section..bss]
jmp 0x40204c
movzx edi, di
mov dword [esp], str._04x
mov dword [esp + 4], edi
call sym._wine_dbg_sprintf.constprop.0
jmp 0x401e22
movzx ebx, bx
mov dword [esp], str._04x
mov dword [esp + 4], ebx
call sym._wine_dbg_sprintf.constprop.0
jmp 0x401e8a
mov byte [ecx], al
add ecx, 1
jmp 0x401f30
mov byte [ecx], al
add ecx, 1
jmp 0x401c50
mov byte [eax], dl
add eax, 1
jmp 0x401ac0
mov edx, dword [section..bss]
mov eax, dword [0x407004]
mov dword [esp + 0x38], str._invalid_
lea ecx, [edx + edx*4]
lea eax, [eax + ecx*4 - 0x14]
jmp 0x401bc7
mov edx, dword [section..bss]
mov eax, dword [0x407004]
mov edi, str._invalid_
lea ecx, [edx + edx*4]
lea eax, [eax + ecx*4 - 0x14]
jmp 0x401e9e
mov edx, dword [section..bss]
mov eax, str._invalid_
jmp 0x40204c
mov esi, 0x224c
mov byte [esp + 0x66], 0x22
lea ecx, [esp + 0x66]
mov word [esp + 0x64], si
lea eax, [ecx + 1]
jmp 0x401e7b
mov eax, 0x224c
mov byte [esp + 0x66], 0x22
lea ecx, [esp + 0x66]
mov word [esp + 0x64], ax
lea eax, [ecx + 1]
jmp 0x402037
mov byte [esp + 0x66], 0x22
mov eax, 0x224c
mov word [esp + 0x64], ax
lea eax, [esp + 0x66]
lea edx, [eax + 1]
jmp 0x401e13