Function at 0x40422f
Capabilities:
Check if file exists
Get file attributes
Get installed programs
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [ebp + 8]
and byte [0x409080], 0
mov dword [0x40904c], eax
mov eax, dword [ebp + 0xc]
mov dword [0x409064], eax
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [0x409040], eax
mov eax, dword [ebp + 0x18]
mov dword [0x409050], eax
push esi
lea eax, [ebx + 0x30c]
push edi
mov dword [0x409048], ebx
xor edi, edi
cmp byte [eax], 0
mov dword [ebp + 0x14], edi
je 0x4043d5
lea ecx, [ebp + 0xc]
push ecx
push 0x20019
push edi
push eax
push dword [ebx + 0x308]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4043c1
push 1
lea eax, [ebp + 0x18]
pop esi
mov dword [ebp + 0x18], 0x104
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebx + 0x3d4]
push edi
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4043b1
cmp dword [ebp + 8], esi
jne 0x4043b1
mov al, byte [ebp - 0x104]
test al, al
je 0x4043b1
lea edi, [ebp - 0x104]
cmp al, 0x22
je 0x4042fc
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4042f0
cmp byte [edi], 0
je 0x404320
mov cl, byte [edi + 1]
inc edi
mov eax, edi
test cl, cl
je 0x404316
cmp cl, 0x22
je 0x404316
mov cl, byte [eax + 1]
inc eax
jmp 0x404307
cmp byte [eax], 0
je 0x404320
and byte [eax], 0
jmp 0x404326
lea edi, [ebp - 0x104]
cmp byte [edi], 0
mov esi, edi
je 0x404344
inc esi
cmp byte [esi], 0
jne 0x40432d
cmp esi, edi
jbe 0x404344
mov al, byte [esi]
cmp al, 0x2e
je 0x404344
cmp al, 0x5c
je 0x404344
dec esi
jmp 0x404333
cmp byte [esi], 0x2e
jne 0x404399
mov al, byte [esi + 1]
cmp al, 0x65
je 0x404354
cmp al, 0x45
jne 0x404399
mov al, byte [esi + 2]
cmp al, 0x78
je 0x40435f
cmp al, 0x58
jne 0x404399
mov al, byte [esi + 3]
cmp al, 0x65
je 0x40436a
cmp al, 0x45
jne 0x404399
and byte [esi + 4], 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
jne 0x404381
cmp ecx, 0xf
je 0x404385
test al, 0x10
jne 0x404399
cmp esi, edi
jbe 0x404391
cmp byte [esi], 0x5c
je 0x404396
dec esi
jmp 0x404385
cmp byte [esi], 0x5c
jne 0x404399
and byte [esi], 0
lea eax, [ebp - 0x104]
mov esi, 0x409080
push eax
push esi
call fcn.00403f50
pop ecx
xor edi, edi
pop ecx
jmp 0x4043b6
mov esi, 0x409080
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4043c6
mov esi, 0x409080
cmp byte [0x409080], 0
jne 0x4044e5
jmp 0x4043da
mov esi, 0x409080
lea eax, [ebx + 0x204]
push eax
push esi
call fcn.00403f50
push str._PROGRAMFILESWinamp
push esi
call fcn.00403fb0
add esp, 0x10
test eax, eax
jne 0x4044c1
lea eax, [ebp + 0xc]
push eax
push 0x20019
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallWinamp
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4044c1
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], 0x104
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp + 8]
push eax
push edi
push str.UninstallString
mov dword [ebp + 8], 1
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4044b3
cmp dword [ebp + 8], 1
jne 0x4044b3
lea eax, [ebp - 0x104]
push eax
call fcn.00403f3c
pop ecx
lea eax, [ebp + eax - 0x104]
lea ecx, [ebp - 0x104]
cmp eax, ecx
jb 0x4044b3
cmp byte [eax], 0x5c
je 0x404483
dec eax
lea ecx, [ebp - 0x104]
cmp eax, ecx
jae 0x404473
lea ecx, [ebp - 0x104]
cmp eax, ecx
jb 0x4044b3
and byte [eax], 0
lea ecx, [ebp - 0x104]
mov al, byte [ecx]
cmp al, 0x20
je 0x4044a0
cmp al, 0x22
jne 0x4044a3
inc ecx
jmp 0x404496
push ecx
push esi
call fcn.00403f50
pop ecx
mov dword [ebp + 0x14], 1
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], edi
jne 0x4044e5
push edi
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.00405647
add esp, 0xc
test eax, eax
jne 0x4044e5
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.00403f50
pop ecx
pop ecx
push ebx
push str._s_Setup
push str.Nullsoft_Install_System_Error
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
cmp dword [ebx + 0x51c], edi
jne 0x40451e
push edi
push 0x404535
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x69
push dword [0x409074]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x404530
mov eax, dword [0x409040]
push edi
mov dword [eax + 0x40], 0x80000000
call fcn.00405303
pop edi
pop esi
pop ebx
leave
ret