Function at 0x3ec3f80
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x4d
push 0
push 0
dec ecx
jne 0x3ec3f88
push ecx
push ebx
push esi
push edi
mov ebx, eax
lea edi, [ebp - 0x22e]
xor eax, eax
push ebp
push 0x3ec42c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.03cb7e50
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
push 0x3ec42d8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x3ec429e
xor esi, esi
mov dword [ebp - 0x1c], 0x20a
mov eax, edi
xor ecx, ecx
mov edx, 0x20a
call fcn.03cb5b68
jmp 0x3ec4273
lea eax, [ebp - 0x238]
mov edx, edi
mov ecx, 0x105
call fcn.03cb8e3c
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x234]
mov edx, 0x3ec4350
call fcn.03cb8fec
mov eax, dword [ebp - 0x234]
lea ecx, [ebp - 4]
mov edx, 0x3ec43c8
call fcn.03ec3eac
lea eax, [ebp - 0x240]
mov edx, edi
mov ecx, 0x105
call fcn.03cb8e3c
mov ecx, dword [ebp - 0x240]
lea eax, [ebp - 0x23c]
mov edx, 0x3ec43ec
call fcn.03cb8fec
mov eax, dword [ebp - 0x23c]
lea ecx, [ebp - 8]
mov edx, 0x3ec4464
call fcn.03ec3eac
lea eax, [ebp - 0x248]
mov edx, edi
mov ecx, 0x105
call fcn.03cb8e3c
mov ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x244]
mov edx, 0x3ec4490
call fcn.03cb8fec
mov eax, dword [ebp - 0x244]
lea ecx, [ebp - 0x14]
mov edx, 0x3ec4508
call fcn.03ec3eac
lea eax, [ebp - 0x250]
mov edx, edi
mov ecx, 0x105
call fcn.03cb8e3c
mov ecx, dword [ebp - 0x250]
lea eax, [ebp - 0x24c]
mov edx, 0x3ec452c
call fcn.03cb8fec
mov eax, dword [ebp - 0x24c]
lea ecx, [ebp - 0xc]
mov edx, 0x3ec45a4
call fcn.03ec3eac
lea eax, [ebp - 0x258]
mov edx, edi
mov ecx, 0x105
call fcn.03cb8e3c
mov ecx, dword [ebp - 0x258]
lea eax, [ebp - 0x254]
mov edx, 0x3ec45d0
call fcn.03cb8fec
mov eax, dword [ebp - 0x254]
lea ecx, [ebp - 0x10]
mov edx, 0x3ec4648
call fcn.03ec3eac
lea eax, [ebp - 0x260]
mov edx, edi
mov ecx, 0x105
call fcn.03cb8e3c
mov ecx, dword [ebp - 0x260]
lea eax, [ebp - 0x25c]
mov edx, 0x3ec4680
call fcn.03cb8fec
mov eax, dword [ebp - 0x25c]
lea ecx, [ebp - 0x18]
mov edx, 0x3ec46f8
call fcn.03ec3eac
lea eax, [ebp - 0x268]
mov edx, edi
mov ecx, 0x105
call fcn.03cb8e3c
mov ecx, dword [ebp - 0x268]
lea eax, [ebp - 0x264]
mov edx, 0x3ec4718
call fcn.03cb8fec
mov edx, dword [ebp - 0x264]
mov ecx, 0x3ec4790
mov eax, 0x80000002
call fcn.03e6ece4
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x10], 0
jne 0x3ec41a3
lea eax, [ebp - 0x10]
mov edx, 0x3ec47b8
call fcn.03cb8278
cmp dword [ebp - 4], 0
je 0x3ec425d
push dword [ebx]
push dword [ebp - 4]
push 0x3ec47c8
mov eax, ebx
mov edx, 3
call fcn.03cb9074
push dword [ebx]
push dword [ebp - 8]
push 0x3ec47d8
mov eax, ebx
mov edx, 3
call fcn.03cb9074
push dword [ebx]
lea edx, [ebp - 0x26c]
mov eax, dword [ebp - 0x24]
call fcn.03cd2394
push dword [ebp - 0x26c]
push 0x3ec47e8
mov eax, ebx
mov edx, 3
call fcn.03cb9074
push dword [ebx]
push dword [ebp - 0x14]
push 0x3ec47f8
mov eax, ebx
mov edx, 3
call fcn.03cb9074
push dword [ebx]
push dword [ebp - 0x18]
push 0x3ec4808
mov eax, ebx
mov edx, 3
call fcn.03cb9074
push dword [ebx]
push dword [ebp - 0xc]
push 0x3ec4818
mov eax, ebx
mov edx, 3
call fcn.03cb9074
push dword [ebx]
push dword [ebp - 0x10]
push 0x3ec4828
push 0x3ec4838
mov eax, ebx
mov edx, 4
call fcn.03cb9074
mov eax, edi
xor ecx, ecx
mov edx, 0x20a
call fcn.03cb5b68
mov dword [ebp - 0x1c], 0x20a
inc esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push edi
push esi
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegEnumKeyExW
cmp eax, 0x103
jne 0x3ec3fee
mov eax, dword [ebp - 0x20]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3ec42d0
lea eax, [ebp - 0x26c]
mov edx, 0xf
call fcn.03cb7eb0
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.03cb7eb0
ret