Function at 0x417630
Capabilities:
Get installed programs

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4f8
mov eax, dword [0x434040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x4f0], eax
xor eax, eax
push eax
mov dword [ebp - 0x4f4], ecx
lea ecx, [ebp - 0x4ec]
push ecx
push eax
push 0x2001f
push eax
push eax
push eax
push 0x404e40
push SysReAllocStringLen
mov dword [ebp - 0x4e8], edx
mov dword [ebp - 0x4ec], eax
mov dword [ebp - 0x4e4], eax
call ebx
test eax, eax
je 0x41769e
mov ebx, 0x8000ffff
jmp 0x41793b
mov eax, dword [ebp - 0x4e8]
mov ecx, dword [ebp - 0x4ec]
push 0
lea edx, [ebp - 0x4e4]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push eax
push ecx
call ebx
test eax, eax
je 0x4176d2
mov ebx, 0x8000ffff
jmp 0x41793b
mov ecx, dword [ebp - 0x4e8]
lea ebx, [ebp - 0x4e0]
call fcn.00415990
mov ebx, eax
test ebx, ebx
js 0x41793b
mov edx, dword [ebp - 0x4e4]
push 0x404ea8
push edx
call fcn.00417ad0
mov ebx, eax
test ebx, ebx
js 0x41793b
mov eax, dword [ebp - 0x4e4]
push 0x404ec0
push eax
mov esi, edi
call fcn.00417ad0
mov ebx, eax
test ebx, ebx
js 0x41793b
mov ecx, dword [ebp - 0x4e4]
mov esi, dword [ebp - 0x4f0]
push 0x404ed4
push ecx
call fcn.00417ad0
mov ebx, eax
test ebx, ebx
js 0x41793b
mov esi, dword [ebp - 0x4f4]
test esi, esi
je 0x41776b
mov edx, dword [ebp - 0x4e4]
push 0x404ee8
push edx
call fcn.00417ad0
mov ebx, eax
test ebx, ebx
js 0x41793b
mov eax, dword [ebp - 0x4e4]
push 0x404f00
push eax
lea esi, [ebp - 0x4e0]
call fcn.00417ad0
mov ebx, eax
test ebx, ebx
js 0x41793b
mov edx, dword [ebp - 0x4e4]
mov ecx, 0x404f20
call fcn.00417b50
mov ebx, eax
test ebx, ebx
js 0x41793b
mov edx, dword [ebp - 0x4e4]
mov ecx, 0x404f34
call fcn.00417b50
mov ebx, eax
test ebx, ebx
js 0x41793b
lea eax, [ebp - 0x2d8]
call fcn.00416e20
mov ebx, eax
test ebx, ebx
js 0x41793b
mov edx, 0x168
lea eax, [ebp - 0x2d8]
xor esi, esi
cmp word [eax], si
je 0x4177ef
add eax, 2
dec edx
jne 0x4177e2
jmp 0x4177f3
test edx, edx
jne 0x41783d
mov esi, 0x80070057
xor ecx, ecx
mov eax, esi
test esi, esi
js 0x417818
mov eax, 0x168
sub eax, ecx
lea ecx, [ebp + ecx*2 - 0x2d8]
mov edx, 0x4038ec
call fcn.00417d20
mov ebx, eax
test eax, eax
js 0x41793b
mov ecx, 0x168
lea eax, [ebp - 0x2d8]
xor esi, esi
nop
cmp word [eax], si
je 0x417846
add eax, 2
dec ecx
jne 0x417830
jmp 0x41784a
mov ecx, 0x168
sub ecx, edx
jmp 0x4177fa
test ecx, ecx
jne 0x417893
mov esi, 0x80070057
xor edx, edx
mov eax, esi
test esi, esi
js 0x41786f
mov eax, 0x168
sub eax, edx
lea ecx, [ebp + edx*2 - 0x2d8]
mov edx, 0x403540
call fcn.00417d20
mov ebx, eax
test eax, eax
js 0x41793b
mov edx, 0x168
lea eax, [ebp - 0x2d8]
xor esi, esi
cmp word [eax], si
je 0x41789c
add eax, 2
dec edx
jne 0x417886
jmp 0x4178a0
mov edx, 0x168
sub edx, ecx
jmp 0x417851
test edx, edx
jne 0x4178e5
mov esi, 0x80070057
xor ecx, ecx
mov eax, esi
test esi, esi
js 0x4178c5
mov eax, 0x168
sub eax, ecx
lea ecx, [ebp + ecx*2 - 0x2d8]
mov edx, 0x4038ec
call fcn.00417d20
mov ebx, eax
test eax, eax
js 0x41793b
mov edx, 0x168
lea eax, [ebp - 0x2d8]
xor esi, esi
cmp word [eax], si
je 0x4178ee
add eax, 2
dec edx
jne 0x4178d8
jmp 0x4178f6
mov ecx, 0x168
sub ecx, edx
jmp 0x4178a7
test edx, edx
jne 0x41797f
mov esi, 0x80070057
xor ecx, ecx
mov eax, esi
test esi, esi
js 0x41791c
mov edx, dword [ebp - 0x4e8]
mov eax, 0x168
sub eax, ecx
lea ecx, [ebp + ecx*2 - 0x2d8]
call fcn.00417d20
mov ebx, eax
test eax, eax
js 0x41793b
mov ecx, dword [ebp - 0x4e4]
push 0x404f48
push ecx
lea esi, [ebp - 0x2d8]
call fcn.00417ad0
mov ebx, eax
mov eax, dword [ebp - 0x4e4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x41794e
push eax
call esi
mov eax, dword [ebp - 0x4ec]
test eax, eax
je 0x41795b
push eax
call esi
test ebx, ebx
jns 0x41796b
mov edx, dword [ebp - 0x4e8]
push edx
call fcn.00417990
mov ecx, dword [ebp - 4]
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00420627
mov esp, ebp
pop ebp
ret 8
mov ecx, 0x168
sub ecx, edx
jmp 0x4178fd