Function at 0x403b11
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x948
mov eax, dword [0x5e2ec0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x607]
push ebx
push eax
mov byte [ebp - 0x608], bl
call fcn.0055bfc0
mov edi, 0xff
push edi
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.0055bfc0
add esp, 0x18
lea eax, [ebp - 0x918]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403d90
push 0xfe
lea eax, [ebp - 0x207]
push ebx
push eax
mov byte [ebp - 0x208], bl
call fcn.0055bfc0
push 0x2ff
lea eax, [ebp - 0x907]
push ebx
push eax
mov byte [ebp - 0x908], bl
call fcn.0055bfc0
add esp, 0x18
lea eax, [ebp - 0x938]
push eax
lea eax, [ebp - 0x92c]
push eax
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x930]
push eax
lea eax, [ebp - 0x93c]
push eax
lea eax, [ebp - 0x944]
push eax
lea eax, [ebp - 0x940]
push eax
lea eax, [ebp - 0x910]
push eax
push ebx
lea eax, [ebp - 0x920]
push eax
lea eax, [ebp - 0x908]
push eax
push dword [ebp - 0x918]
mov dword [ebp - 0x920], 0x300
mov dword [ebp - 0x910], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [ebp - 0x910]
cmp eax, ebx
je 0x403d90
mov dword [esi + 8], eax
shl eax, 2
push eax
push 0x40
mov dword [ebp - 0x90c], ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esi], eax
cmp eax, ebx
je 0x403d87
mov dword [ebp - 0x914], ebx
cmp dword [ebp - 0x910], ebx
jbe 0x403d87
lea eax, [ebp - 0x938]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x91c]
push eax
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x914]
mov dword [ebp - 0x91c], edi
push dword [ebp - 0x918]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x403d6f
lea eax, [ebp - 0x208]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea eax, [ebp - 0x608]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x924]
push eax
push 1
push ebx
lea eax, [ebp - 0x608]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403cf2
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
push str.DisplayName
lea edi, [ebp - 0x924]
call fcn.00403aa5
add esp, 0x10
mov edi, 0xff
jmp 0x403cf4
xor eax, eax
cmp eax, ebx
je 0x403d3a
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [esi]
mov edx, dword [ebp - 0x90c]
mov dword [ecx + edx*4], eax
mov eax, dword [esi]
mov ecx, edx
lea eax, [eax + ecx*4]
cmp dword [eax], ebx
je 0x403d3a
lea ecx, [ebp - 0x108]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
inc dword [ebp - 0x90c]
push 0x100
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.0055bfc0
push edi
lea eax, [ebp - 0x208]
push ebx
push eax
call fcn.0055bfc0
push 0x400
lea eax, [ebp - 0x608]
push ebx
push eax
call fcn.0055bfc0
add esp, 0x24
inc dword [ebp - 0x914]
mov eax, dword [ebp - 0x914]
cmp eax, dword [ebp - 0x910]
jb 0x403c56
mov eax, dword [ebp - 0x90c]
mov dword [esi + 4], eax
push dword [ebp - 0x918]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0055a67a
leave
ret