Function at 0x4e99f9
Capabilities:
Get installed programs
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x458], eax
test eax, eax
je 0x4ea092
push ebx
push esi
xor ecx, ecx
lea esi, [eax + 0x21c]
push edi
xor ebx, ebx
mov word [esi], cx
lea edi, [eax + 0x424]
mov word [edi], cx
cmp dword [eax], ebx
jne 0x4ea065
call fcn.004e3cd3
movzx eax, al
mov dword [ebp - 0x44c], eax
mov eax, str._ConEmuBaseDir__tcc.exe
mov dword [ebp - 0x430], eax
mov dword [ebp - 0x42c], str._ConEmuDir__tcc.exe
mov dword [ebp - 0x428], str._ConEmuDir_.._tcc_tcc.exe
mov dword [ebp - 0x424], str._ConEmuDir_...._tcc_tcc.exe
mov dword [ebp - 0x420], ebx
push 0x105
lea ecx, [ebp - 0x210]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4e9aad
cmp eax, 0x105
jae 0x4e9aad
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004e2e74
pop ecx
pop ecx
test al, al
jne 0x4e9abb
mov eax, dword [ebp + ebx*4 - 0x42c]
inc ebx
test eax, eax
jne 0x4e9a7b
jmp 0x4e9adc
lea eax, [ebp - 0x210]
mov ebx, 0x104
push eax
push ebx
push esi
call fcn.00401a0b
lea eax, [ebp - 0x210]
push eax
push ebx
push edi
call fcn.00401a0b
xor edx, edx
mov ecx, 0x200
mov dword [ebp - 0x464], ecx
cmp word [esi], dx
je 0x4e9af7
cmp word [edi], dx
jne 0x4e9d6d
mov ebx, edx
mov dword [ebp - 0x440], edx
test ebx, ebx
je 0x4e9b10
cmp dword [ebp - 0x44c], 0
je 0x4e9d15
test ebx, ebx
mov byte [ebp - 0x431], dl
mov eax, 0x100
cmove eax, ecx
lea ecx, [ebp - 0x43c]
imul eax, dword [ebp - 0x44c]
push ecx
or eax, 0x20019
push eax
push edx
push str.SOFTWAREJP_Software
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x460], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e9d0e
mov bl, byte [ebp - 0x431]
xor ecx, ecx
mov eax, ecx
mov dword [ebp - 0x444], eax
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x45c]
mov dword [ebp - 0x45c], 0x104
push ecx
lea ecx, [ebp - 0x41c]
push ecx
push eax
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4e9cfc
lea eax, [ebp - 0x448]
push eax
push dword [ebp - 0x460]
xor eax, eax
push eax
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e9ce4
mov ebx, eax
mov dword [ebp - 0x46c], eax
mov dword [ebp - 0x468], str.Path
mov dword [ebp - 0x438], ebx
push 0x20a
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004f5a90
add esp, 0xc
mov dword [ebp - 0x450], 0x208
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x210]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + ebx*4 - 0x46c]
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4e9cb7
cmp word [ebp - 0x210], ax
je 0x4e9cb7
lea eax, [ebp - 0x210]
push 1
push eax
call fcn.004e5ac5
mov ebx, eax
push 0x5c
push ebx
call fcn.004f6844
add esp, 0x10
mov dword [ebp - 0x454], eax
test eax, eax
je 0x4e9cb7
push str._tcmd.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4e9cb7
push eax
push ebx
call fcn.004e2e74
pop ecx
pop ecx
test al, al
je 0x4e9cb7
mov eax, dword [ebp - 0x454]
push 8
push str.tcc.exe
add eax, 2
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
xor eax, eax
push eax
push ebx
call fcn.004e2e74
pop ecx
pop ecx
test al, al
je 0x4e9cb7
cmp dword [ebp - 0x440], 0
push ebx
mov byte [ebp - 0x431], 1
push 0x104
jne 0x4e9cb1
push esi
jmp 0x4e9cb2
push edi
call fcn.00401a0b
mov eax, dword [ebp - 0x438]
inc eax
push 0
mov dword [ebp - 0x438], eax
cmp eax, 2
mov ebx, eax
pop eax
jb 0x4e9bd7
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, byte [ebp - 0x431]
mov eax, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x444], eax
push 0
pop ecx
test bl, bl
je 0x4e9b63
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x440]
mov ecx, 0x200
xor edx, edx
inc ebx
mov dword [ebp - 0x440], ebx
cmp ebx, 1
jle 0x4e9aff
mov eax, dword [ebp - 0x458]
movzx ecx, word [eax + 0x21c]
test cx, cx
je 0x4e9d4a
movzx eax, word [edi]
mov edx, eax
test ax, ax
jne 0x4e9d55
push esi
push 0x104
push edi
jmp 0x4e9d66
movzx edx, word [eax + 0x424]
xor eax, eax
mov ecx, eax
test dx, dx
je 0x4e9d6b
test cx, cx
jne 0x4e9d6b
push edi
push 0x104
push esi
call fcn.00401a0b
xor edx, edx
cmp word [esi], dx
je 0x4e9d7b
cmp word [edi], dx
jne 0x4e9fd8
mov ebx, edx
mov dword [ebp - 0x448], edx
mov ecx, dword [ebp - 0x44c]
test ebx, ebx
je 0x4e9d9a
test ecx, ecx
je 0x4e9fc8
movzx eax, word [edi]
jmp 0x4e9d9d
movzx eax, word [esi]
test ax, ax
jne 0x4e9fc8
test ebx, ebx
mov byte [ebp - 0x431], dl
mov eax, 0x100
cmove eax, dword [ebp - 0x464]
imul eax, ecx
lea ecx, [ebp - 0x43c]
push ecx
or eax, 0x20019
push eax
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x450], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e9fc6
mov ebx, eax
mov dword [ebp - 0x438], eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x454]
mov dword [ebp - 0x454], 0x104
push eax
lea eax, [ebp - 0x41c]
push eax
push ebx
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4e9fb4
cmp word [ebp - 0x41c], 0x7b
jne 0x4e9f9d
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0x450]
xor eax, eax
push eax
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4e9f9d
push 0x20a
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.004f5a90
add esp, 0xc
mov dword [ebp - 0x440], 0x208
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x210]
push eax
xor eax, eax
push eax
push eax
push str.Publisher
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4e9f91
push str.JP_Software
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4e9f91
lea eax, [ebp - 0x440]
mov dword [ebp - 0x440], 0x1f2
push eax
lea eax, [ebp - 0x210]
push eax
xor eax, eax
push eax
push eax
push str.InstallLocation
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4e9f91
cmp word [ebp - 0x210], ax
je 0x4e9f91
push 0x22
pop eax
cmp word [ebp - 0x210], ax
jne 0x4e9f29
push eax
lea ebx, [ebp - 0x20e]
mov eax, ebx
push eax
call fcn.004f5617
pop ecx
pop ecx
test eax, eax
je 0x4e9f2f
xor ecx, ecx
mov word [eax], cx
jmp 0x4e9f2f
lea ebx, [ebp - 0x210]
xor eax, eax
cmp word [ebx], ax
je 0x4e9f8b
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x5c
pop ecx
lea eax, [ebx + eax*2]
cmp word [eax - 2], cx
je 0x4e9f4f
mov word [eax], cx
add eax, 2
push 8
push str.tcc.exe
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
xor eax, eax
push eax
push ebx
call fcn.004e2e74
pop ecx
pop ecx
test al, al
je 0x4e9f8b
cmp dword [ebp - 0x448], 0
push ebx
mov byte [ebp - 0x431], 1
push 0x104
jne 0x4e9f85
push esi
jmp 0x4e9f86
push edi
call fcn.00401a0b
mov ebx, dword [ebp - 0x438]
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
cmp byte [ebp - 0x431], 0
push 0
mov dword [ebp - 0x438], ebx
pop eax
je 0x4e9df1
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x448]
xor edx, edx
inc ebx
mov dword [ebp - 0x448], ebx
cmp ebx, 1
jle 0x4e9d83
cmp word [esi], dx
jne 0x4ea000
cmp word [edi], dx
jne 0x4ea000
push edx
mov ebx, str.C:Program_FilesJPSoftTCMD13_tcc.exe
push ebx
call fcn.004e2e74
pop ecx
pop ecx
test al, al
je 0x4ea01d
push ebx
push 0x104
push esi
call fcn.00401a0b
xor ebx, ebx
movzx ecx, word [esi]
test cx, cx
je 0x4ea042
movzx eax, word [edi]
mov edx, eax
test ax, ax
jne 0x4ea04f
push esi
push 0x104
push edi
jmp 0x4ea060
xor ebx, ebx
push ebx
push str.C:Program_FilesJPSoftTCCLE13_tcc.exe
call fcn.004e2e74
pop ecx
pop ecx
test al, al
je 0x4ea002
push str.C:Program_FilesJPSoftTCCLE13_tcc.exe
push 0x104
push esi
call fcn.00401a0b
jmp 0x4ea002
mov eax, dword [ebp - 0x458]
movzx edx, word [eax + 0x424]
test dx, dx
je 0x4ea065
test cx, cx
jne 0x4ea065
push edi
push 0x104
push esi
call fcn.00401a0b
cmp word [esi], bx
jne 0x4ea07a
push 2
push 0x104
push esi
call fcn.004e3275
add esp, 0xc
cmp word [edi], bx
jne 0x4ea08f
push 3
push 0x104
push edi
call fcn.004e3275
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f4166
leave
ret