Function at 0x406439
Capabilities:
Get installed programs
Set registry value

Disassembly:
mov eax, 0x420c06
call fcn.004174f8
sub esp, 0x214
push ebx
push esi
push edi
mov ebx, 0x429d5c
push str._t_Registry_
mov ecx, ebx
call fcn.0041f7c1
push eax
call fcn.00404ac7
mov eax, dword [0x429e0c]
xor edi, edi
cmp eax, edi
pop ecx
jne 0x406473
xor ecx, ecx
jmp 0x406475
mov ecx, dword [eax]
cmp ecx, eax
mov dword [ebp - 0x1c], ecx
je 0x40693f
mov esi, dword [ebp - 0x1c]
add esi, 8
lea eax, [ebp - 0x90]
push esi
push eax
call fcn.00404ae0
lea eax, [esi + 0x20]
push eax
lea eax, [ebp - 0x74]
push eax
mov dword [ebp - 4], edi
call fcn.00404ae0
lea eax, [esi + 0x3c]
push eax
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 1
call fcn.00404ae0
add esp, 0x18
mov eax, dword [esi + 0x1c]
push str._t_t_RegValue_
mov ecx, ebx
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], eax
call fcn.0041f7c1
push eax
call fcn.00404ac7
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.00411010
add esp, 0xc
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 3
jb 0x4064f8
mov eax, dword [eax + 4]
jmp 0x4064fb
add eax, 4
push str.__Key_
push eax
push str._t_t_t_Key_
mov ecx, ebx
call fcn.0041f7c1
mov ecx, eax
call fcn.0041f7c1
mov ecx, eax
call fcn.0041f7c1
push eax
call fcn.00404ac7
pop ecx
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x204]
mov byte [ebp - 4], 2
call fcn.004017ef
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x1e8]
push eax
call fcn.00411010
pop ecx
pop ecx
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 4
jb 0x406556
mov eax, dword [eax + 4]
jmp 0x406559
add eax, 4
push str.__Name_
push eax
push str._t_t_t_Name_
mov ecx, ebx
call fcn.0041f7c1
mov ecx, eax
call fcn.0041f7c1
mov ecx, eax
call fcn.0041f7c1
push eax
call fcn.00404ac7
pop ecx
push esi
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], 2
call fcn.004017ef
push str._t_t__RegValue_
mov ecx, ebx
call fcn.0041f7c1
push eax
call fcn.00404ac7
pop ecx
push edi
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x20], 0xf
call fcn.00401980
push 5
push edi
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 5
call fcn.00401662
push str.HKLM_
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.00404977
mov ebx, eax
neg ebx
sbb bl, bl
push esi
lea ecx, [ebp - 0x220]
inc bl
mov byte [ebp - 4], 5
call fcn.004017ef
test bl, bl
lea ecx, [ebp - 0x90]
je 0x40662e
push 0xffffffffffffffff
push 5
lea eax, [ebp - 0x178]
push eax
mov ebx, 0x80000002
call fcn.00401662
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 7
call fcn.004016a8
lea ecx, [ebp - 0x178]
jmp 0x40670c
push 5
push edi
lea eax, [ebp - 0x1cc]
push eax
call fcn.00401662
push str.HKCU_
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.00404977
mov ebx, eax
neg ebx
sbb bl, bl
push esi
lea ecx, [ebp - 0x1cc]
inc bl
mov byte [ebp - 4], 5
call fcn.004017ef
test bl, bl
lea ecx, [ebp - 0x90]
je 0x40669c
push 0xffffffffffffffff
push 5
lea eax, [ebp - 0x194]
push eax
mov ebx, 0x80000001
call fcn.00401662
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 9
call fcn.004016a8
lea ecx, [ebp - 0x194]
jmp 0x40670c
push 5
push edi
lea eax, [ebp - 0x1b0]
push eax
call fcn.00401662
push str.HKCR_
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.00404977
mov ebx, eax
neg ebx
sbb bl, bl
push esi
lea ecx, [ebp - 0x1b0]
inc bl
mov byte [ebp - 4], 5
call fcn.004017ef
test bl, bl
je 0x406b80
push 0xffffffffffffffff
push 5
lea eax, [ebp - 0xc8]
push eax
lea ecx, [ebp - 0x90]
mov ebx, 0x80000000
call fcn.00401662
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0xb
call fcn.004016a8
lea ecx, [ebp - 0xc8]
push esi
mov byte [ebp - 4], 5
call fcn.004017ef
cmp dword [ebp - 0x20], 0x10
mov eax, dword [ebp - 0x34]
jae 0x406722
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0xec]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push edi
push 0xf003f
push edi
push 0x4242f8
push edi
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
jne 0x406ace
cmp dword [ebp - 0x10], edi
jne 0x40677c
cmp dword [ebp - 0x40], 0x10
mov ecx, dword [ebp - 0x54]
jae 0x40675b
lea ecx, [ebp - 0x54]
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
jae 0x406767
lea eax, [ebp - 0x70]
push dword [ebp - 0x44]
push ecx
push esi
push edi
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4068f2
cmp dword [ebp - 0x10], esi
jne 0x4067ad
cmp dword [ebp - 0x40], 0x10
mov eax, dword [ebp - 0x54]
jae 0x40678d
lea eax, [ebp - 0x54]
push eax
call fcn.00415db8
cmp dword [ebp - 0x5c], 0x10
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x70]
pop ecx
jae 0x4067a3
lea eax, [ebp - 0x70]
push 4
lea ecx, [ebp - 0x18]
push ecx
push 4
jmp 0x40676c
cmp dword [ebp - 0x10], 2
jne 0x406b02
push edi
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0xcc], 0xf
call fcn.00401980
xor ebx, ebx
cmp dword [ebp - 0x44], edi
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x10], ebx
jle 0x4068b1
cmp dword [ebp - 0x40], 0x10
mov eax, dword [ebp - 0x54]
jae 0x4067eb
lea eax, [ebp - 0x54]
cmp byte [eax + ebx], 0x20
je 0x4068a4
push 2
push ebx
lea eax, [ebp - 0xac]
push eax
lea ecx, [ebp - 0x58]
call fcn.00401662
push eax
lea eax, [ebp - 0x15c]
push eax
mov byte [ebp - 4], 0x11
call fcn.00410f30
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0xac]
mov byte [ebp - 4], 0x13
call fcn.004017ef
cmp dword [ebp - 0x148], 2
jne 0x406863
lea eax, [ebp - 0x18]
push eax
lea ebx, [ebp - 0x15c]
call fcn.004063fe
test al, al
pop ecx
je 0x40685e
push dword [ebp - 0x18]
lea ecx, [ebp - 0xe4]
push 1
call fcn.00408d06
xor esi, esi
xor edi, edi
inc esi
jmp 0x406890
xor esi, esi
xor edi, edi
inc esi
push str.Binary_formatting_error_in_registry_value
lea ecx, [ebp - 0x124]
call fcn.0040163f
lea eax, [ebp - 0x124]
push eax
mov byte [ebp - 4], 0x14
call fcn.004050a8
pop ecx
push esi
lea ecx, [ebp - 0x124]
call fcn.004017ef
mov ebx, dword [ebp - 0x10]
push esi
lea ecx, [ebp - 0x15c]
inc ebx
mov byte [ebp - 4], 0x10
call fcn.004017ef
inc ebx
cmp ebx, dword [ebp - 0x44]
mov dword [ebp - 0x10], ebx
jl 0x4067df
cmp dword [ebp - 0xcc], 0x10
mov ecx, dword [ebp - 0xe0]
jae 0x4068c6
lea ecx, [ebp - 0xe0]
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
jae 0x4068d2
lea eax, [ebp - 0x70]
push dword [ebp - 0xd0]
push ecx
push 3
push edi
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
lea ecx, [ebp - 0xe4]
call fcn.004017ef
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
push esi
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x1c], ebx
call fcn.004017ef
push esi
lea ecx, [ebp - 0x58]
call fcn.004017ef
push esi
lea ecx, [ebp - 0x74]
call fcn.004017ef
or dword [ebp - 4], 0xffffffff
push esi
lea ecx, [ebp - 0x90]
call fcn.004017ef
cmp ebx, dword [0x429e0c]
mov ebx, 0x429d5c
jne 0x406480
push str.InstallName
lea ecx, [ebp - 0x124]
call fcn.0040163f
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0xac]
push eax
mov ecx, 0x429edc
mov dword [ebp - 4], 0x17
call fcn.0040e230
push eax
lea eax, [ebp - 0x140]
push eax
mov byte [ebp - 4], 0x18
call fcn.00404ae0
pop ecx
pop ecx
push 1
lea ecx, [ebp - 0xac]
call fcn.004017ef
push 1
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 0x1a
call fcn.004017ef
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x108]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push eax
call fcn.00404898
add esp, 0xc
cmp dword [ebp - 0xf0], 0x10
mov eax, dword [ebp - 0x104]
mov byte [ebp - 4], 0x1c
jae 0x4069d3
lea eax, [ebp - 0x104]
lea ecx, [ebp - 0xe8]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
push edi
push 0xf003f
push edi
push 0x4242f8
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x406a90
lea eax, [ebp - 0x140]
push eax
lea ecx, [ebp - 0x38]
call fcn.00401620
cmp dword [ebp - 0x20], 0x10
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 0x1d
jae 0x406a1e
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
push 1
push edi
push str.DisplayName
push dword [ebp - 0x3c]
call esi
lea eax, [ebp - 0xac]
push 0x429e70
push eax
call fcn.00404ae0
pop ecx
pop ecx
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x1e
call fcn.004016a8
push 1
lea ecx, [ebp - 0xac]
call fcn.004017ef
cmp dword [ebp - 0x20], 0x10
mov eax, dword [ebp - 0x34]
jae 0x406a71
lea eax, [ebp - 0x34]
push dword [ebp - 0x24]
push eax
push 1
push edi
push str.UninstallString
push dword [ebp - 0x3c]
call esi
push 1
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 0x1c
call fcn.004017ef
push str._t__Registry_
mov ecx, ebx
call fcn.0041f7c1
push eax
call fcn.00404ac7
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00411010
add esp, 0xc
cmp dword [eax + 0x18], 0x10
mov byte [ebp - 4], 0x1f
jb 0x406bb7
mov eax, dword [eax + 4]
jmp 0x406bba
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xc8]
push str.Failed_to_Create_Key_
push eax
call fcn.00404898
push 0x424320
push eax
lea eax, [ebp - 0xac]
push eax
mov byte [ebp - 4], 0xe
call fcn.0040484c
mov byte [ebp - 4], 0xf
jmp 0x406b31
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xc8]
push str.Invalid_Key_Type_on_
push eax
call fcn.00404898
push 0x424320
push eax
lea eax, [ebp - 0xac]
push eax
mov byte [ebp - 4], 0x15
call fcn.0040484c
mov byte [ebp - 4], 0x16
push eax
call fcn.004050a8
add esp, 0x1c
push esi
lea ecx, [ebp - 0xac]
call fcn.004017ef
push esi
lea ecx, [ebp - 0xc8]
call fcn.004017ef
push esi
lea ecx, [ebp - 0x38]
call fcn.004017ef
push esi
lea ecx, [ebp - 0x58]
call fcn.004017ef
push esi
lea ecx, [ebp - 0x74]
call fcn.004017ef
push esi
lea ecx, [ebp - 0x90]
call fcn.004017ef
xor al, al
jmp 0x406c0a
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xc8]
push str.Invalid_Key_
push eax
call fcn.00404898
push 0x424320
push eax
lea eax, [ebp - 0xac]
push eax
mov byte [ebp - 4], 0xc
call fcn.0040484c
mov byte [ebp - 4], 0xd
jmp 0x406b31
add eax, 4
push str.__UninstallDelRegKey_
push eax
push str._t_UninstallDelRegKey_HKLM_
mov ecx, ebx
call fcn.0041f7c1
mov ecx, eax
call fcn.0041f7c1
mov ecx, eax
call fcn.0041f7c1
push eax
call fcn.00404ac7
pop ecx
push 1
lea ecx, [ebp - 0xc8]
call fcn.004017ef
push 1
lea ecx, [ebp - 0x108]
call fcn.004017ef
push 1
lea ecx, [ebp - 0x140]
call fcn.004017ef
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret