Function at 0x403b50
Capabilities:
Get common file path
Get installed programs
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x544ece
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x16cc
call fcn.0052e580
mov eax, dword [0x5a8040]
xor eax, esp
mov dword [esp + 0x16c8], eax
push ebx
push esi
push edi
mov eax, dword [0x5a8040]
xor eax, esp
push eax
lea eax, [esp + 0x16e0]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.00416d7d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40403f
lea esi, [ebx + 0x118]
push ecx
mov ecx, esi
call fcn.004065c0
test eax, eax
js 0x4042f1
cmp byte [ebx + 0x200c], 0
je 0x403bd8
mov ecx, esi
call fcn.00407ca0
jmp 0x4042f1
cmp byte [ebx + 0x200d], 0
je 0x403bed
mov ecx, esi
call fcn.00407ec0
jmp 0x4042f1
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
call fcn.0040a2f0
mov ecx, esi
movzx edi, ax
call fcn.0040a240
cmp al, 1
jne 0x403c16
cmp edi, 0x412
je 0x403c16
push 0x409
jmp 0x403c1b
push 0x412
call dword [sym.imp.KERNEL32.dll_SetThreadUILanguage]
call fcn.0040a1d0
test al, al
jne 0x403ce8
lea ecx, [esp + 0x14]
call fcn.00402820
lea ecx, [esp + 0x18]
mov dword [esp + 0x16e8], 0
call fcn.00402820
lea ecx, [esp + 0x1c]
call fcn.00402820
push 0x8a
mov byte [esp + 0x16ec], 2
call fcn.00415ddb
test eax, eax
je 0x403c79
push 0x8a
push eax
lea ecx, [esp + 0x20]
call fcn.004023f0
mov ecx, esi
call fcn.0040a240
lea ecx, [esp + 0x1c]
cmp al, 1
jne 0x403c8f
push 0x90
jmp 0x403c94
push 0x3ff
call fcn.004024c0
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push esi
push dword [esp + 0x1c]
push eax
call fcn.00402b00
add esp, 0xc
cmp edi, 0x401
jne 0x403cbe
push 0x180030
jmp 0x403cc0
push 0x30
push esi
push dword [esp + 0x1c]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x1c]
call fcn.00402850
lea ecx, [esp + 0x18]
call fcn.00402850
lea ecx, [esp + 0x14]
jmp 0x4042ec
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
lea eax, [esp + 0x18]
push eax
call fcn.0040a4b0
test eax, eax
je 0x40426e
cmp dword [esp + 0x18], 0
je 0x40426e
mov ecx, esi
call fcn.0040a770
cmp al, 1
jne 0x403da9
lea ecx, [esp + 0x1c]
call fcn.00402820
lea ecx, [esp + 0x18]
mov dword [esp + 0x16e8], 6
call fcn.00402820
lea ecx, [esp + 0x14]
call fcn.00402820
push 0x40b
lea ecx, [esp + 0x1c]
mov byte [esp + 0x16ec], 8
call fcn.004024c0
mov ecx, esi
call fcn.0040a240
lea ecx, [esp + 0x14]
cmp al, 1
jne 0x403d73
push 0x90
jmp 0x403d78
push 0x3ff
call fcn.004024c0
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push esi
push dword [esp + 0x1c]
push eax
call fcn.00402b00
add esp, 0xc
cmp edi, 0x401
jne 0x4042c7
push 0x180030
jmp 0x4042c9
cmp dword [ebx + 0x2004], 1
mov word [ebx + 0x200a], 0
mov byte [ebx + 0x2009], 0
jne 0x403f22
xor eax, eax
push 0x206
push eax
mov word [esp + 0x494], ax
lea eax, [esp + 0x496]
push eax
call fcn.0052c790
add esp, 0xc
xor eax, eax
mov word [esp + 0x89c], ax
push 0x206
push eax
lea eax, [esp + 0x8a6]
push eax
call fcn.0052c790
add esp, 0xc
xor eax, eax
mov word [esp + 0x694], ax
push 0x206
push eax
lea eax, [esp + 0x69e]
push eax
call fcn.0052c790
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [esp + 0x498]
add esp, 0xc
push eax
push 1
push 0
push 0x1a
push 0
call esi
push str.HNCUserWinHDB130EC.ini
lea eax, [esp + 0x490]
push 0x104
push eax
call fcn.0052b0fb
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [esp + 0x40]
add esp, 0xc
push eax
lea eax, [esp + 0x490]
push eax
call edi
cmp eax, 0xffffffff
je 0x403e82
lea eax, [esp + 0x48c]
push eax
call fcn.0052b167
add esp, 4
lea eax, [esp + 0x89c]
push eax
push 1
push 0
push 0x25
push 0
call esi
push str.WinHDB130.ini
lea eax, [esp + 0x8a0]
push 0x104
push eax
call fcn.0052b0fb
add esp, 0xc
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x8a0]
push eax
call edi
cmp eax, 0xffffffff
je 0x403ed2
lea eax, [esp + 0x89c]
push eax
call fcn.0052b167
add esp, 4
lea eax, [esp + 0x694]
push eax
push 1
push 0
push 0x25
push 0
call esi
push 0x588c9c
lea eax, [esp + 0x698]
push 0x104
push eax
call fcn.0052b0fb
add esp, 0xc
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x698]
push eax
call edi
cmp eax, 0xffffffff
je 0x403f22
lea eax, [esp + 0x694]
push eax
call fcn.0052b167
add esp, 4
mov ecx, 0x1a
lea edi, [esp + 0xeb4]
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea eax, [esp + 0xf1e]
rep movsd dword es:[edi], dword [esi]
push 0x19e
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.0052c790
add esp, 0xc
mov dword [esp + 0x2c], 1
xor eax, eax
mov word [esp + 0x10bc], ax
push 0x206
push eax
lea eax, [esp + 0x10c6]
push eax
call fcn.0052c790
add esp, 0xc
mov dword [esp + 0x24], 0x104
lea eax, [esp + 0x14cc]
lea esi, [ebx + 0x118]
mov ecx, esi
push eax
call fcn.00408490
test eax, eax
jne 0x40405c
lea ecx, [esp + 0x14cc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403fa5
sub ecx, edx
sar ecx, 1
cmp ecx, 0x25
jbe 0x40405c
lea eax, [esp + 0x14cc]
push eax
lea eax, [esp + 0xeb8]
push 0x104
push eax
call fcn.0052b0fb
add esp, 0xc
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0xeb8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x40405c
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x10c0]
push eax
lea eax, [esp + 0x34]
push eax
push 0
push str.DisplayName
push dword [esp + 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40405c
cmp dword [ebx + 0x2000], 1
mov ecx, ebx
jne 0x404046
call fcn.00404320
test eax, eax
jne 0x40403f
mov ecx, ebx
call fcn.00404940
mov ecx, ebx
call fcn.004056a0
xor eax, eax
jmp 0x4042f6
mov dword [ebx + 0xb54], 3
call fcn.00404940
xor eax, eax
jmp 0x4042f6
mov ecx, esi
call fcn.004083b0
test eax, eax
je 0x404031
xor eax, eax
push 0x206
push eax
mov word [esp + 0x12cc], ax
lea eax, [esp + 0x12ce]
push eax
call fcn.0052c790
add esp, 0xc
xor eax, eax
mov word [esp + 0x284], ax
push 0x206
push eax
lea eax, [esp + 0x28e]
push eax
call fcn.0052c790
add esp, 0xc
mov dword [esp + 0x20], 0
xor eax, eax
mov word [esp + 0xaa4], ax
push 0x206
push eax
lea eax, [esp + 0xaae]
push eax
call fcn.0052c790
add esp, 0xc
xor eax, eax
mov word [esp + 0xcac], ax
push 0x206
push eax
lea eax, [esp + 0xcb6]
push eax
call fcn.0052c790
add esp, 0xc
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x18]
call fcn.00402820
mov ecx, esi
mov dword [esp + 0x16e8], 9
xor edi, edi
call fcn.004083b0
test eax, eax
jle 0x404250
lea esp, [esp]
lea eax, [esp + 0x12c4]
mov ecx, esi
push eax
push edi
call fcn.00408430
lea eax, [esp + 0x284]
mov ecx, esi
push eax
push edi
call fcn.004083d0
lea eax, [esp + 0x284]
push str._unchangeable_
push eax
call fcn.0052b195
lea ecx, [esp + 0x28c]
add esp, 8
cmp ecx, eax
jne 0x40417a
lea eax, [esp + 0x2a0]
push eax
mov eax, ecx
push 0x104
push eax
call fcn.0052b09f
add esp, 0xc
jmp 0x40419e
lea eax, [esp + 0x284]
push str._disable_
push eax
call fcn.0052b195
lea ecx, [esp + 0x28c]
add esp, 8
cmp ecx, eax
je 0x404237
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea eax, [esp + 0xaa8]
push 0x104
push eax
call fcn.0052b09f
add esp, 0xc
lea eax, [esp + 0x284]
push eax
lea eax, [esp + 0xaa8]
push 0x104
push eax
call fcn.0052b0fb
add esp, 0xc
lea eax, [esp + 0x20]
push eax
push 0x20019
push 0
lea eax, [esp + 0xab0]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x404237
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0xcb0]
push eax
push 0
push 0
push str.DisplayName
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404237
lea ecx, [esp + 0xcac]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x404226
sub ecx, edx
sar ecx, 1
jne 0x404249
mov ecx, esi
inc edi
call fcn.004083b0
cmp edi, eax
jl 0x404120
jmp 0x404250
mov byte [ebx + 0x200a], 1
mov ecx, ebx
call fcn.00404940
mov ecx, ebx
call fcn.004056a0
lea ecx, [esp + 0x18]
call fcn.00402850
xor eax, eax
jmp 0x4042f6
lea ecx, [esp + 0x1c]
call fcn.00402820
lea ecx, [esp + 0x18]
mov dword [esp + 0x16e8], 3
call fcn.00402820
lea ecx, [esp + 0x14]
call fcn.00402820
push 0x40a
lea ecx, [esp + 0x1c]
mov byte [esp + 0x16ec], 5
call fcn.004024c0
mov ecx, esi
call fcn.0040a240
lea ecx, [esp + 0x14]
cmp al, 1
jne 0x403d73
push 0x90
jmp 0x403d78
push 0x30
push esi
push dword [esp + 0x24]
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [esp + 0x14]
call fcn.00402850
lea ecx, [esp + 0x18]
call fcn.00402850
lea ecx, [esp + 0x1c]
call fcn.00402850
mov eax, 1
mov ecx, dword [esp + 0x16e0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x16c8]
xor ecx, esp
call fcn.00529d59
mov esp, ebp
pop ebp
ret