Function at 0x404570
Capabilities:
Get installed programs
Query or enumerate registry value

Disassembly:
sub esp, 0x628
push ebx
push ebp
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [esp + 0xc]
push edi
push eax
xor ebx, ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallFetion
mov ebp, ecx
push 0x80000002
mov dword [esp + 0x1c], ebx
call esi
test eax, eax
je 0x4045b2
lea ecx, [esp + 0x10]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallFetion
push 0x80000001
call esi
test eax, eax
jne 0x4045ff
mov dl, byte [0x415b30]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x31]
mov byte [esp + 0x30], dl
mov edx, dword [esp + 0x10]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
lea ecx, [esp + 0x30]
push eax
push ecx
push ebx
push ebx
push str.UninstallString
push edx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40460e
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x628
ret 4
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push 4
push ebx
push ebx
lea edx, [esp + 0x44]
push 0x80000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4045ff
lea eax, [esp + 0x18]
push ebx
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
test eax, eax
je 0x40468a
lea ecx, [esp + 0x20]
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
test eax, eax
je 0x40468a
mov ecx, dword [esp + 0x63c]
lea eax, [esp + 0x20]
push eax
push ecx
mov ecx, ebp
call fcn.004044c0
test eax, eax
jg 0x40468a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x628
ret 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dl, byte [0x415b30]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x135]
mov byte [esp + 0x134], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x30]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
dec esi
js 0x4046f3
mov al, byte [esp + esi + 0x30]
cmp al, 0x5c
je 0x4046d5
cmp al, 0x2f
je 0x4046d5
dec esi
jns 0x4046c4
jmp 0x4046f3
lea eax, [esp + 0x30]
lea ecx, [esp + 0x134]
push eax
push str._sOem.config
push ecx
mov byte [esp + esi + 0x3c], bl
call fcn.00406b75
add esp, 0xc
lea edx, [esp + 0x134]
push ebx
push edx
call fcn.00406cf3
add esp, 8
cmp eax, 0xffffffff
je 0x4045ff
lea eax, [esp + 0x134]
push 0x412810
push eax
call fcn.00405d6c
add esp, 8
cmp esi, ebx
mov edi, eax
jle 0x4045ff
cmp edi, ebx
je 0x4045ff
test byte [edi + 0xc], 0x10
jne 0x4047c4
push edi
lea ecx, [esp + 0x23c]
push 0x400
push ecx
call fcn.00406d39
lea edx, [esp + 0x244]
push str._Tag_
push edx
call fcn.00405ef0
mov esi, eax
add esp, 0x14
cmp esi, ebx
je 0x4047a4
add esi, 5
push str.__Tag_
push esi
call fcn.00405ef0
add esp, 8
cmp eax, ebx
je 0x4047a4
mov byte [eax], bl
mov ecx, dword [0x41641c]
cmp ecx, ebx
jne 0x404792
mov ecx, 0x410280
sub eax, esi
inc eax
push eax
push esi
push ecx
call fcn.0040eef0
add esp, 0xc
test eax, eax
je 0x4047c2
test byte [edi + 0xc], 0x10
je 0x40473e
push edi
call fcn.00405b85
add esp, 4
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x628
ret 4
mov bl, 1
push edi
call fcn.00405b85
add esp, 4
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x628
ret 4