Function at 0x401271
Capabilities:
Get installed programs
Query or enumerate registry value
Write file on windows

Disassembly:
jmp 0x4146f0
mov eax, 0x1c6c
call fcn.0041be90
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x1c68], eax
mov ecx, dword [esp + 0x1c78]
push ebx
push edi
mov edi, dword [esp + 0x1c78]
xor ebx, ebx
cmp edi, ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], ecx
jne 0x41473f
pop edi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x1c68]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x1c6c
ret
mov eax, dword [esp + 0x1c7c]
cmp eax, ebx
je 0x414726
cmp ecx, ebx
je 0x414726
push ebp
push esi
push str.UNInfo
push eax
push edi
mov dword [esp + 0x20], ebx
call fcn.0040120d
mov esi, eax
add esp, 0xc
cmp esi, ebx
je 0x414d91
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x414782
xor ebx, ebx
push 0x208
lea eax, [esp + 0xc4c]
push ebx
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x28], 0x100
call fcn.0041be10
push 0x200
lea ecx, [esp + 0x650]
push ebx
push ecx
call fcn.0041be10
push 0x200
lea edx, [esp + 0x45c]
push ebx
push edx
call fcn.0041be10
push 0x200
lea eax, [esp + 0x68]
push ebx
push eax
call fcn.0041be10
push 0x200
lea ecx, [esp + 0x874]
push ebx
push ecx
call fcn.0041be10
xor eax, eax
push 0x200
lea edx, [esp + 0x18b0]
push ebx
push edx
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
call fcn.0041be10
add esp, 0x48
push 0x208
lea eax, [esp + 0x1a74]
push ebx
push eax
call fcn.0041be10
push 0x200
lea ecx, [esp + 0xe60]
push ebx
push ecx
call fcn.0041be10
push 0x200
lea edx, [esp + 0x25c]
push ebx
push edx
call fcn.0041be10
push 0x410
lea eax, [esp + 0x1488]
push ebx
push eax
call fcn.0041be10
push 0x410
lea ecx, [esp + 0x1084]
push ebx
push ecx
call fcn.0041be10
push 0x208
lea edx, [esp + 0xa80]
push ebx
push edx
call fcn.0041be10
add esp, 0x48
push 0x200
lea eax, [esp + 0x644]
push eax
push esi
call fcn.004011fe
add esp, 0xc
cmp eax, ebx
je 0x414e52
push 0x200
lea ecx, [esp + 0x444]
push ecx
push eax
call fcn.004011fe
add esp, 0xc
cmp eax, ebx
je 0x414daf
push 0x200
lea edx, [esp + 0x44]
push edx
push eax
call fcn.004011fe
add esp, 0xc
cmp eax, ebx
je 0x414dff
push 0x200
lea ecx, [esp + 0x844]
push ecx
push eax
call fcn.004011fe
mov esi, eax
add esp, 0xc
cmp esi, ebx
je 0x414e52
lea edx, [esp + 0x840]
push edx
call fcn.0041bee1
mov dword [esp + 0x1c], eax
mov eax, esi
sub eax, edi
mov ecx, eax
sar ecx, 1
add esp, 4
cmp ecx, dword [esp + 0x1c84]
mov ebx, esi
jae 0x4149f8
mov edi, eax
lea esp, [esp]
movzx eax, word [esi]
cmp ax, 0xd
je 0x4149f8
cmp ax, 0x48
jne 0x4149e1
push 3
push esi
lea edx, [esp + 0x34]
push 0xa
push edx
call fcn.0041c29b
add esp, 0x10
push 0x4352c8
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x414a91
push 0x4352d0
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x414aa2
push 0x4352d8
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x414ab3
push 0x4352e0
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x414ac4
push 0x4352e8
lea ecx, [esp + 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x414ad5
add edi, 2
mov edx, edi
sar edx, 1
add esi, 2
cmp edx, dword [esp + 0x1c84]
jb 0x414940
push 0x200
lea ecx, [esp + 0x244]
push ecx
push ebx
call fcn.004011fe
push 0x200
lea edx, [esp + 0xe60]
push edx
push eax
call fcn.004011fe
push 0x200
push 0x4787f0
push eax
call fcn.004011fe
push 0x200
push 0x479248
push eax
call fcn.004011fe
push 0x200
push 0x450e58
push eax
call fcn.004011fe
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0x3c
cmp dword [esp + 0x14], 2
jl 0x414bc9
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x248]
push edx
lea eax, [esp + 0x44c]
push eax
call fcn.00401186
add esp, 0x10
test eax, eax
je 0x414e9d
jmp 0x414c93
lea eax, [esp + 0x2c]
push eax
call ebp
lea eax, [esi + eax*2]
mov esi, 0x80000000
jmp 0x414ae4
lea ecx, [esp + 0x2c]
push ecx
call ebp
lea eax, [esi + eax*2]
mov esi, 0x80000002
jmp 0x414ae4
lea edx, [esp + 0x2c]
push edx
call ebp
lea eax, [esi + eax*2]
mov esi, 0x80000001
jmp 0x414ae4
lea eax, [esp + 0x2c]
push eax
call ebp
lea eax, [esi + eax*2]
mov esi, 0x80000003
jmp 0x414ae4
lea ecx, [esp + 0x2c]
push ecx
call ebp
lea eax, [esi + eax*2]
mov esi, 0x80000005
push 0x200
lea edx, [esp + 0x1874]
push edx
push eax
mov dword [esp + 0x1c], esi
call fcn.004011fe
add esp, 0xc
test eax, eax
je 0x414e9d
push 0x208
lea ecx, [esp + 0x1a74]
push ecx
push eax
call fcn.004011fe
mov edi, eax
add esp, 0xc
test edi, edi
je 0x414e9d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
lea eax, [esp + 0x187c]
push eax
push esi
call ebx
test eax, eax
jne 0x414b7c
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x244]
push edx
push eax
push eax
lea eax, [esp + 0x1a80]
push eax
push ecx
mov dword [esp + 0x34], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x200
lea eax, [esp + 0xe54]
push eax
push edi
call fcn.004011fe
push 0x200
push 0x4787f0
push eax
call fcn.004011fe
push 0x200
push 0x479248
push eax
call fcn.004011fe
push 0x200
push 0x450e58
push eax
call fcn.004011fe
add esp, 0x30
mov esi, eax
jmp 0x414a57
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [esp + 0xa44]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [esp + 0x440]
push edx
lea eax, [esp + 0xa44]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0xa4c]
push edx
push 0x80000002
mov dword [esp + 0x28], 1
call ebx
test eax, eax
jne 0x414c3d
mov eax, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x248]
push edx
lea eax, [esp + 0x44c]
push eax
lea ecx, [esp + 0x650]
push ecx
jmp 0x414c87
cmp dword [0x44fe24], 5
jl 0x414ca8
lea edx, [esp + 0x10]
push edx
push 0x20119
push 0
lea eax, [esp + 0xa4c]
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x414ca8
mov ecx, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x44]
push edx
lea eax, [esp + 0x248]
push eax
lea ecx, [esp + 0x44c]
push ecx
lea edx, [esp + 0x650]
push edx
call fcn.0040127b
mov dword [esp + 0x28], eax
add esp, 0x14
mov eax, dword [esp + 0x14]
test eax, eax
je 0x414e9d
cmp eax, 4
je 0x414d91
cmp word [esp + 0x2c], 0
push 0xa
push 0xd
push 0x450e58
je 0x414d03
lea eax, [esp + 0xe5c]
push eax
lea ecx, [esp + 0x1a80]
push ecx
lea edx, [esp + 0x1884]
push edx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x85c]
push ecx
lea edx, [esp + 0x60]
push edx
lea eax, [esp + 0x664]
push eax
lea ecx, [esp + 0xc70]
push str.WinInfo__s____s____s___s___s____s____s____s__1c_1c
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x30
jmp 0x414d3e
lea edx, [esp + 0xe5c]
push edx
lea eax, [esp + 0x250]
push eax
lea ecx, [esp + 0x854]
push ecx
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x65c]
push eax
lea ecx, [esp + 0xc68]
push str.WinInfo__s____s____s____s____s____s__1c_1c
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0xc50]
push eax
call ebp
mov edx, dword [esp + 0x28]
add eax, eax
push eax
lea ecx, [esp + 0xc54]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c84]
mov eax, esi
sub eax, edi
sar eax, 1
push str.UNInfo
sub ecx, eax
push ecx
push esi
call fcn.0040120d
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x414780
mov eax, 1
mov ecx, dword [esp + 0x1c78]
pop esi
pop ebp
pop edi
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0x1c6c
ret
mov edx, dword [0x486304]
push 0x100
lea ecx, [esp + 0x1464]
push ecx
push 0x452
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
push str.setup.ini
lea eax, [esp + 0x1464]
push eax
lea ecx, [esp + 0x1058]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
push ebx
lea edx, [esp + 0x1060]
push edx
push ebx
call fcn.004010be
add esp, 0x18
xor eax, eax
jmp 0x414d96
mov ecx, dword [0x486304]
push 0x100
lea eax, [esp + 0x1464]
push eax
push 0x452
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
push str.setup.ini
lea edx, [esp + 0x1464]
push edx
lea eax, [esp + 0x1058]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push ebx
lea ecx, [esp + 0x1060]
push ecx
push ebx
call fcn.004010be
add esp, 0x18
xor eax, eax
jmp 0x414d96
mov eax, dword [0x486304]
push 0x100
lea edx, [esp + 0x1464]
push edx
push 0x452
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push str.setup.ini
lea ecx, [esp + 0x1464]
push ecx
lea edx, [esp + 0x1058]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
push ebx
lea eax, [esp + 0x1060]
push eax
push ebx
call fcn.004010be
add esp, 0x18
xor eax, eax
jmp 0x414d96