Function at 0x43ca40
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x6a8a44]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x654], ecx
mov dword [ebp - 0x628], 0
cmp dword [ebp + 8], 0
jne 0x43ca74
mov eax, dword [ebp - 0x628]
jmp 0x43cd7f
mov dword [ebp - 0x624], 0
mov dword [ebp - 0x62c], 0
mov dword [ebp - 0x620], 0
xor eax, eax
mov word [ebp - 0x20c], ax
push 0x206
push 0
lea ecx, [ebp - 0x20a]
push ecx
call fcn.005be3a0
add esp, 0xc
mov dword [ebp - 0x638], 0x104
lea edx, [ebp - 0x624]
push edx
push 0x109
push 0
push 0x5f04f0
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jne 0x43cc15
mov dword [ebp - 0x630], 0
jmp 0x43cb07
mov eax, dword [ebp - 0x630]
add eax, 1
mov dword [ebp - 0x630], eax
mov ecx, dword [ebp - 0x638]
push ecx
lea edx, [ebp - 0x20c]
push edx
mov eax, dword [ebp - 0x630]
push eax
mov ecx, dword [ebp - 0x624]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x43cc08
lea edx, [ebp - 0x62c]
push edx
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x624]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x43cbf8
mov dword [ebp - 0x63c], 0x104
xor edx, edx
mov word [ebp - 0x414], dx
push 0x206
push 0
lea eax, [ebp - 0x412]
push eax
call fcn.005be3a0
add esp, 0xc
mov dword [ebp - 0x640], 1
lea ecx, [ebp - 0x63c]
push ecx
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x640]
push eax
push 0
push 0x5f055c
mov ecx, dword [ebp - 0x62c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jne 0x43cbeb
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x414]
push eax
call fcn.004092d0
add esp, 8
mov dword [ebp - 0x644], eax
cmp dword [ebp - 0x644], 0
je 0x43cbeb
mov dword [ebp - 0x628], 1
mov ecx, dword [ebp - 0x62c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x628], 0
je 0x43cc03
jmp 0x43cc08
jmp 0x43caf8
mov edx, dword [ebp - 0x624]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x628], 0
jne 0x43cd79
lea eax, [ebp - 0x624]
push eax
push 9
push 0
push str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstall_
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jne 0x43cd79
mov dword [ebp - 0x634], 0
jmp 0x43cc6b
mov ecx, dword [ebp - 0x634]
add ecx, 1
mov dword [ebp - 0x634], ecx
mov edx, dword [ebp - 0x638]
push edx
lea eax, [ebp - 0x20c]
push eax
mov ecx, dword [ebp - 0x634]
push ecx
mov edx, dword [ebp - 0x624]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x43cd6c
lea eax, [ebp - 0x62c]
push eax
lea ecx, [ebp - 0x20c]
push ecx
mov edx, dword [ebp - 0x624]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x43cd5c
mov dword [ebp - 0x648], 0x104
xor eax, eax
mov word [ebp - 0x61c], ax
push 0x206
push 0
lea ecx, [ebp - 0x61a]
push ecx
call fcn.005be3a0
add esp, 0xc
mov dword [ebp - 0x64c], 1
lea edx, [ebp - 0x648]
push edx
lea eax, [ebp - 0x61c]
push eax
lea ecx, [ebp - 0x64c]
push ecx
push 0
push str.DisplayName
mov edx, dword [ebp - 0x62c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x620], eax
cmp dword [ebp - 0x620], 0
jne 0x43cd4f
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x61c]
push ecx
call fcn.004092d0
add esp, 8
mov dword [ebp - 0x650], eax
cmp dword [ebp - 0x650], 0
je 0x43cd4f
mov dword [ebp - 0x628], 1
mov edx, dword [ebp - 0x62c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x628], 0
je 0x43cd67
jmp 0x43cd6c
jmp 0x43cc5c
mov eax, dword [ebp - 0x624]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x628]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005ad281
mov esp, ebp
pop ebp
ret 4