Function at 0x412630
Capabilities:
Check if file exists
Get installed programs
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x49638f
mov eax, dword fs:[0]
push eax
sub esp, 0xda4
mov eax, dword [0x4d01d4]
xor eax, esp
mov dword [esp + 0xda0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4d01d4]
xor eax, esp
push eax
lea eax, [esp + 0xdb8]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xdc8]
push 0xffffffffffffffff
push 0x49f68c
lea ecx, [esp + 0x84]
call dword [sym.imp.DTLUI.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_wchar_t_const___int_]
xor ebx, ebx
mov dword [esp + 0xdc0], ebx
mov esi, str.STR_VER
lea edi, [esp + 0x44]
call fcn.0040ba70
mov byte [esp + 0xdc0], 1
mov ecx, eax
call fcn.0048cdb0
mov esi, dword [reloc.DTLUI.dll___YCDuiString_DuiLib__QAEABV01_PB_W_Z]
push eax
lea ecx, [esp + 0x80]
call esi
mov byte [esp + 0xdc0], bl
mov ecx, edi
call fcn.0048cfe0
call fcn.00403860
lea ecx, [esp + 0x44]
push ecx
lea ecx, [eax + 0xc]
call fcn.0048b8d0
mov byte [esp + 0xdc0], 2
mov edi, 8
cmp dword [eax + 0x18], edi
jb 0x4126f3
mov eax, dword [eax + 4]
jmp 0x4126f6
add eax, 4
push eax
lea ecx, [esp + 0x80]
call esi
mov byte [esp + 0xdc0], bl
cmp dword [esp + 0x5c], edi
jb 0x41271a
mov edx, dword [esp + 0x48]
push edx
call fcn.00471099
add esp, 4
xor eax, eax
mov edi, 7
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], ebx
mov word [esp + 0x48], ax
cmp dword [ebp + 0x58c], ebx
je 0x412c20
push 0x206
lea edx, [esp + 0x392]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x398], cx
call fcn.00473d50
add esp, 0xc
push 0x104
lea eax, [esp + 0x390]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..._ver.ini
lea ecx, [esp + 0x390]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [esp + 0x100]
call dword [sym.imp.DTLUI.dll_public:_void___thiscall_DuiLib::CDuiString::constructor_void_]
mov byte [esp + 0xdc0], 3
lea edx, [esp + 0x38c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4128b2
push 0x103
lea eax, [esp + 0x189]
push ebx
push eax
mov byte [esp + 0x190], bl
call fcn.00473d50
add esp, 0xc
lea ecx, [esp + 0x38c]
push ecx
lea ecx, [esp + 0x48]
call fcn.0048d8d0
mov byte [esp + 0xdc0], 4
push 0x4a4c34
mov ecx, eax
call fcn.0048cf10
push eax
call fcn.00472e0d
add esp, 8
mov esi, eax
mov byte [esp + 0xdc0], 3
lea ecx, [esp + 0x44]
call fcn.0048d020
cmp esi, ebx
jne 0x41283a
mov byte [esp + 0xdc0], bl
mov esi, dword [sym.imp.DTLUI.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
lea ecx, [esp + 0x100]
call esi
mov dword [esp + 0xdc0], 0xffffffff
lea ecx, [esp + 0x7c]
call esi
jmp 0x412c35
push esi
lea edx, [esp + 0x188]
push 0x104
push edx
call fcn.00472e24
add esp, 0xc
test eax, eax
je 0x412869
lea eax, [esp + 0x184]
push eax
lea ecx, [esp + 0x104]
call dword [sym.imp.DTLUI.dll_public:_class_DuiLib::CDuiString_const____thiscall_DuiLib::CDuiString::operator_char_const__]
lea ecx, [esp + 0x100]
call dword [sym.imp.DTLUI.dll_public:_bool___thiscall_DuiLib::CDuiString::IsEmpty_void_const]
test al, al
jne 0x412c0c
mov esi, dword [sym.imp.DTLUI.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::GetData_void_const]
lea ecx, [esp + 0x100]
call esi
push eax
lea ecx, [esp + 0x80]
call esi
mov ecx, dword [ebp + 0x58c]
push eax
push str._sc_ff0000__s__c
push ecx
call dword [sym.imp.DTLUI.dll_public:_void___cdecl_DuiLib::CLabelUI::SetFormatText_wchar_t_const__]
add esp, 0x10
jmp 0x412c0c
mov edx, dword [ebp + 0x58c]
mov esi, dword [edx]
lea ecx, [esp + 0x7c]
add esi, 0x2c
call dword [sym.imp.DTLUI.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const]
mov ecx, dword [ebp + 0x58c]
push eax
mov eax, dword [esi]
call eax
xor ecx, ecx
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], ebx
mov word [esp + 0x48], cx
mov byte [esp + 0xdc0], 5
mov ecx, 0x2f
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall29FE44D7_BC89_4188_8B0E_F6BA073C15A4_is1
lea edi, [esp + 0x9a4]
rep movsd dword es:[edi], dword [esi]
push 0x14a
lea edx, [esp + 0xa66]
push ebx
push edx
mov dword [esp + 0x20], ebx
movsw word es:[edi], word [esi]
call fcn.00473d50
add esp, 0xc
lea eax, [esp + 0x14]
push eax
push 0xf003f
push ebx
lea ecx, [esp + 0x9b0]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x48], 0x104
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412bdd
push ebx
push ebx
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x28]
push ebx
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x58]
push eax
push ebx
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push 0x206
lea eax, [esp + 0x18a]
xor edx, edx
push ebx
push eax
mov word [esp + 0x190], dx
call fcn.00473d50
push 0x207
lea ecx, [esp + 0xbbd]
push ebx
push ecx
mov byte [esp + 0xbc4], bl
call fcn.00473d50
xor esi, esi
add esp, 0x18
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x18], ebx
jbe 0x412bd2
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
add edx, 2
add eax, 2
mov dword [esp + 0x30], edx
lea ecx, [esp + 0x30]
push ecx
mov dword [esp + 0x3c], eax
lea edx, [esp + 0xbb0]
push edx
lea eax, [esp + 0x48]
push eax
mov eax, dword [esp + 0x20]
push ebx
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x198]
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea ecx, [esp + 0x184]
push str.DisplayVersion
push ecx
call fcn.00471b5e
add esp, 8
test eax, eax
jne 0x412bc3
lea edx, [esp + 0x24]
push edx
mov edx, dword [esp + 0x18]
push ebx
lea eax, [esp + 0x28]
push eax
push ebx
lea ecx, [esp + 0x194]
push ecx
push edx
mov dword [esp + 0x38], 1
call ebp
mov eax, dword [esp + 0x24]
push eax
call fcn.00470850
add esp, 4
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x18]
mov edi, eax
push edi
lea edx, [esp + 0x28]
push edx
push ebx
lea eax, [esp + 0x194]
push eax
push ecx
call ebp
push 0x206
lea eax, [esp + 0x59a]
xor edx, edx
push ebx
push eax
mov word [esp + 0x5a0], dx
call fcn.00473d50
push edi
lea ecx, [esp + 0x5a4]
push 0x104
push ecx
call fcn.004717be
lea eax, [esp + 0x5ac]
add esp, 0x18
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x412ab0
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x598]
lea esi, [esp + 0x48]
call fcn.00403b50
push edi
call fcn.00471099
add esp, 4
call fcn.00403860
lea edx, [esp + 0x60]
push edx
lea ecx, [eax + 0xc]
call fcn.0048b8d0
mov byte [esp + 0xdc0], 6
mov eax, dword [esp + 0x58]
mov esi, 8
cmp eax, ebx
jbe 0x412b91
mov ecx, dword [esp + 0x64]
cmp dword [esp + 0x78], esi
jae 0x412b12
lea ecx, [esp + 0x64]
mov edi, dword [esp + 0x74]
push ecx
lea ecx, [esp + 0x48]
call fcn.0040ae60
test eax, eax
je 0x412b91
push 0x206
lea ecx, [esp + 0x7a2]
xor eax, eax
push ebx
push ecx
mov word [esp + 0x7a8], ax
call fcn.00473d50
mov eax, dword [esp + 0x70]
add esp, 0xc
cmp dword [esp + 0x78], esi
jae 0x412b52
lea eax, [esp + 0x64]
push eax
lea edx, [esp + 0x7a0]
push 0x104
push edx
call fcn.004717be
mov eax, dword [esp + 0x80]
add esp, 0xc
lea ecx, [eax + eax]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x7a0]
push edx
push 1
push ebx
lea eax, [esp + 0x194]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [esp + 0xdc0], 5
cmp dword [esp + 0x78], esi
jb 0x412bac
mov edx, dword [esp + 0x64]
push edx
call fcn.00471099
add esp, 4
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x78], 7
mov dword [esp + 0x74], ebx
mov word [esp + 0x64], ax
inc esi
mov dword [esp + 0x1c], esi
cmp esi, dword [esp + 0x18]
jb 0x4129c4
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0xdc0], 3
cmp dword [esp + 0x5c], 8
jb 0x412bf9
mov edx, dword [esp + 0x48]
push edx
call fcn.00471099
add esp, 4
xor eax, eax
mov dword [esp + 0x5c], 7
mov dword [esp + 0x58], ebx
mov word [esp + 0x48], ax
mov byte [esp + 0xdc0], bl
lea ecx, [esp + 0x100]
call dword [sym.imp.DTLUI.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov dword [esp + 0xdc0], 0xffffffff
lea ecx, [esp + 0x7c]
call dword [sym.imp.DTLUI.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov ecx, dword [esp + 0xdb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xda0]
xor ecx, esp
call fcn.00470f4c
add esp, 0xdb0
ret 4