Function at 0x40bc80
Capabilities:
Get installed programs

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5777c2
mov eax, dword fs:[0]
push eax
sub esp, 0x2cc
mov eax, dword [0x5bda40]
xor eax, ebp
mov dword [ebp - 0x5c], eax
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x290], ecx
mov dword [ebp - 0x30], 0x104
xor eax, eax
mov word [ebp - 0x264], ax
push 0x206
push 0
lea ecx, [ebp - 0x262]
push ecx
call fcn.0053f680
add esp, 0xc
mov byte [ebp - 0x35], 0
lea edx, [ebp - 0x34]
push edx
push 0xf003f
push 0
push 0x59e498
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bd07
mov eax, dword [ebp - 0x290]
mov byte [eax + 5], 1
jmp 0x40bd30
lea ecx, [ebp - 0x34]
push ecx
push 0xf003f
push 0
push 0x59e510
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40bd30
mov edx, dword [ebp - 0x290]
mov byte [edx + 5], 1
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x28]
call fcn.0051de71
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.00410610
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.00410610
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x54]
call fcn.004103b0
mov byte [ebp - 4], 3
lea edi, [ebp - 0x268]
call fcn.004fb7d0
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0x298], eax
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x298]
push ecx
lea ecx, [ebp - 0x10]
call fcn.00406980
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x268]
call fcn.004072c0
mov edx, dword [ebp - 0x10]
push edx
push 0x59e590
lea eax, [ebp - 0x58]
push eax
call fcn.004089d0
add esp, 0xc
push 0
lea ecx, [ebp - 0x58]
call fcn.004072e0
push eax
lea ecx, [ebp - 0x28]
call fcn.0051deec
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x40beb3
lea ecx, [ebp - 0x28]
call fcn.0051dcc3
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x28]
call fcn.0051de32
test eax, eax
je 0x40bdf7
jmp 0x40bdd4
lea ecx, [ebp - 0x28]
call fcn.00409330
test eax, eax
je 0x40beae
lea ecx, [ebp - 0x58]
call fcn.00407060
lea ecx, [ebp - 0x26c]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0051e17c
mov dword [ebp - 0x29c], eax
mov edx, dword [ebp - 0x29c]
mov dword [ebp - 0x2a0], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x59e5a0
lea eax, [ebp - 0x58]
push eax
call fcn.004089d0
add esp, 0x10
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x26c]
call fcn.004072c0
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
push 0x59e5ac
lea edx, [ebp - 0x58]
push edx
push ecx
call fcn.00406e40
add esp, 0xc
mov dword [ebp - 0x2a4], eax
call fcn.0050ba00
add esp, 4
mov dword [ebp - 0x2a8], eax
cmp dword [ebp - 0x2a8], 0
je 0x40beae
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x54]
call fcn.00410590
mov ecx, dword [ebp - 0x3c]
add ecx, 1
mov dword [ebp - 0x3c], ecx
jmp 0x40bdd4
cmp dword [ebp - 0x3c], 0
jne 0x40bf51
push ecx
mov ecx, esp
mov dword [ebp - 0x274], esp
push 0x59e5c4
call fcn.00406900
mov dword [ebp - 0x2ac], eax
mov edx, dword [ebp - 0x2ac]
mov dword [ebp - 0x2b0], edx
mov byte [ebp - 4], 6
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x278], esp
mov eax, dword [ebp + 8]
push eax
call fcn.00410ea0
mov dword [ebp - 0x2b4], eax
mov ecx, dword [ebp - 0x2b4]
mov dword [ebp - 0x2b8], ecx
mov byte [ebp - 4], 7
push ecx
mov ecx, esp
mov dword [ebp - 0x27c], esp
lea edx, [ebp - 0x10]
push edx
call fcn.004068e0
mov dword [ebp - 0x2bc], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x290]
call fcn.0040baf0
mov byte [ebp - 0x2bd], al
movzx eax, byte [ebp - 0x2bd]
test eax, eax
je 0x40bf4c
mov byte [ebp - 0x35], 1
jmp 0x40c002
push ecx
mov ecx, esp
mov dword [ebp - 0x280], esp
push 0x59e5d8
call fcn.00406900
mov dword [ebp - 0x2c4], eax
mov ecx, dword [ebp - 0x2c4]
mov dword [ebp - 0x2c8], ecx
mov byte [ebp - 4], 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x284], esp
mov edx, dword [ebp + 8]
push edx
call fcn.00410ea0
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2d0], eax
mov byte [ebp - 4], 9
mov ecx, dword [ebp - 0x3c]
sub ecx, 1
push ecx
lea ecx, [ebp - 0x54]
call fcn.00410560
push ecx
mov ecx, esp
mov dword [ebp - 0x288], esp
push eax
call fcn.004068e0
mov dword [ebp - 0x2d4], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x290]
call fcn.0040baf0
mov byte [ebp - 0x2d5], al
movzx edx, byte [ebp - 0x2d5]
test edx, edx
je 0x40bfec
mov byte [ebp - 0x35], 1
mov eax, dword [ebp - 0x3c]
sub eax, 1
mov dword [ebp - 0x3c], eax
mov ecx, 1
test ecx, ecx
jne 0x40beb3
mov dl, byte [ebp - 0x35]
mov byte [ebp - 0x289], dl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x54]
call fcn.00410520
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
call fcn.004072c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x58]
call fcn.004072c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0051de9a
mov al, byte [ebp - 0x289]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [ebp - 0x5c]
xor ecx, ebp
call fcn.00538a54
mov esp, ebp
pop ebp
ret 4