Function at 0x40a790
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x630
mov eax, dword [0x42f560]
xor eax, esp
mov dword [esp + 0x62c], eax
mov eax, dword [esp + 0x634]
push ebx
push ebp
push eax
xor ebp, ebp
lea eax, [esp + 0x134]
mov ebx, ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
call fcn.00416c68
push esi
lea ecx, [esp + 0x140]
push ecx
push 0x80000002
call fcn.0040a4e0
push edi
lea edx, [esp + 0x14c]
push str.InstallerProducts_s
push edx
call fcn.00416c68
push esi
lea eax, [esp + 0x158]
push eax
push 0x80000000
call fcn.0040a4e0
push edi
lea ecx, [esp + 0x164]
push str.InstallerFeatures_s
push ecx
call fcn.00416c68
push esi
lea edx, [esp + 0x170]
push edx
push 0x80000000
call fcn.0040a4e0
add esp, 0x48
push ebx
lea eax, [esp + 0x134]
push str.InstallerUpgradeCodes_s
push eax
call fcn.00416c68
push esi
lea ecx, [esp + 0x140]
push ecx
push 0x80000000
call fcn.0040a4e0
push edi
lea edx, [esp + 0x14c]
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerProducts_s
push edx
call fcn.00416c68
push esi
lea eax, [esp + 0x158]
push eax
push 0x80000002
call fcn.0040a4e0
push edi
lea ecx, [esp + 0x164]
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerFeatures_s
push ecx
call fcn.00416c68
push esi
lea edx, [esp + 0x170]
push edx
push 0x80000002
call fcn.0040a4e0
add esp, 0x48
push ebx
lea eax, [esp + 0x134]
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUpgradeCodes_s
push eax
call fcn.00416c68
push esi
lea ecx, [esp + 0x140]
push ecx
push 0x80000002
call fcn.0040a4e0
add esp, 0x18
lea edx, [esp + 0x10]
push edx
push esi
push ebp
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x40aaf6
mov ecx, dword [esp + 0x10]
push 0x104
lea eax, [esp + 0x30]
push eax
xor ebx, ebx
push ebx
push ecx
mov dword [esp + 0x28], ebx
call ebp
test eax, eax
jne 0x40aaeb
lea esp, [esp]
push edi
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x138]
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData_sProducts_s
push eax
call fcn.00416c68
push esi
lea ecx, [esp + 0x144]
push ecx
push 0x80000002
call fcn.0040a4e0
push edi
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x154]
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData_sFeatures_s
push eax
call fcn.00416c68
push esi
lea ecx, [esp + 0x160]
push ecx
push 0x80000002
call fcn.0040a4e0
lea edx, [esp + 0x64]
push edx
lea eax, [esp + 0x16c]
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData_sComponents
push eax
call fcn.00416c68
add esp, 0x44
lea ecx, [esp + 8]
push ecx
push esi
push ebx
lea edx, [esp + 0x13c]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40aac8
mov ecx, dword [esp + 8]
push 0x104
lea eax, [esp + 0x534]
push eax
push ebx
push ecx
mov dword [esp + 0x24], ebx
call ebp
test eax, eax
jne 0x40aab7
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push esi
xor ebx, ebx
push ebx
lea eax, [esp + 0x53c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40aa92
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x10]
mov byte [esp + 0x134], al
lea eax, [esp + 0x134]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebx
push edi
push edx
mov dword [esp + 0x38], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40aa63
mov eax, dword [esp + 0xc]
push edi
push eax
call fcn.00414c60
mov edx, dword [esp + 0xc]
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x2c]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edx
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40aa63
cmp dword [esp + 0x1c], eax
jne 0x40aa63
lea ebx, [eax + 1]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
test ebx, ebx
je 0x40aa92
mov edx, dword [esp + 8]
push esi
lea ecx, [esp + 0x534]
push ecx
push edx
call fcn.0040a4e0
add esp, 0xc
jmp 0x40aa96
inc dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 8]
push 0x104
lea eax, [esp + 0x534]
push eax
push ecx
push edx
call ebp
test eax, eax
je 0x40a9d3
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [esp + 8], ebx
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
push 0x104
lea ecx, [esp + 0x30]
inc eax
push ecx
push eax
push edx
mov dword [esp + 0x28], eax
call ebp
test eax, eax
je 0x40a920
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea ecx, [esp + 0x30]
push ecx
xor ebx, ebx
push ebx
push 0x80000003
call ebp
test eax, eax
jne 0x40abb8
push edi
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x138]
push str._sSOFTWAREMicrosoftInstallerProducts_s
push eax
call fcn.00416c68
push esi
lea ecx, [esp + 0x144]
push ecx
push 0x80000003
call fcn.0040a4e0
push edi
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x154]
push str._sSOFTWAREMicrosoftInstallerFeatures_s
push eax
call fcn.00416c68
push esi
lea ecx, [esp + 0x160]
push ecx
push 0x80000003
call fcn.0040a4e0
mov edx, dword [esp + 0x5c]
push edx
lea eax, [esp + 0x68]
push eax
lea ecx, [esp + 0x170]
push str._sSOFTWAREMicrosoftInstallerUpgradeCodes_s
push ecx
call fcn.00416c68
add esp, 0x48
push esi
lea edx, [esp + 0x134]
push edx
push 0x80000003
call fcn.0040a4e0
add esp, 0xc
push 0x104
lea eax, [esp + 0x30]
push eax
inc ebx
push ebx
push 0x80000003
call ebp
test eax, eax
je 0x40ab12
mov ecx, dword [esp + 0x634]
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00416a72
add esp, 0x630
ret