Function at 0x4ce860
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x136c
call fcn.004d9280
mov eax, dword [0x4f72bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
xor esi, esi
lea eax, [ebp - 0x10f]
push esi
push eax
mov dword [ebp - 0x1330], 0xffffffff
mov byte [ebp - 0x110], 0
call fcn.004d29c0
add esp, 0xc
mov dword [ebp - 0x1348], 0x104
mov dword [ebp - 0x132c], esi
mov dword [ebp - 0x1334], esi
mov ebx, 0xff
cmp dword [ebp - 0x1334], 1
jne 0x4ce8e9
cmp dword [0x506e0c], 0
je 0x4ceba0
mov ecx, dword [0x4f8b78]
mov dword [ebp - 0x1344], ecx
mov dword [0x4f8b78], 0x20119
mov eax, dword [0x4f8b78]
lea edx, [ebp - 0x1338]
push edx
push eax
xor esi, esi
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push CreateStatusWindowA
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4ceb60
lea ecx, [ebp - 0x610]
push ecx
xor ecx, ecx
call fcn.0047c870
add esp, 4
lea edx, [ebp - 0x1354]
push edx
lea eax, [ebp - 0x1368]
push eax
lea ecx, [ebp - 0x1358]
push ecx
lea edx, [ebp - 0x1360]
push edx
lea eax, [ebp - 0x134c]
push eax
lea ecx, [ebp - 0x1364]
push ecx
lea edx, [ebp - 0x135c]
push edx
lea eax, [ebp - 0x132c]
push eax
mov eax, dword [ebp - 0x1338]
push esi
lea ecx, [ebp - 0x1348]
push ecx
lea edx, [ebp - 0x110]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x132c], esi
je 0x4ceb53
lea ecx, [ebp - 0x1354]
push ecx
lea edx, [ebp - 0x1340]
push edx
lea eax, [ebp - 0x1328]
push eax
mov eax, dword [ebp - 0x1338]
push 0
lea ecx, [ebp - 0x133c]
push ecx
lea edx, [ebp - 0xf28]
push edx
push esi
push eax
mov dword [ebp - 0x1340], ebx
mov dword [ebp - 0x133c], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, edi
inc esi
inc edi
cmp ecx, dword [ebp - 0x132c]
ja 0x4ceb53
cmp eax, 0x103
je 0x4ceb53
test eax, eax
jne 0x4ce984
lea edx, [ebp - 0xf28]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4ceb48
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov edx, 0x7ffffffe
mov eax, ebx
lea ecx, [ebp - 0x510]
call fcn.004010b0
mov eax, ebx
lea ecx, [ebp - 0x510]
cmp byte [ecx], 0
je 0x4cea21
inc ecx
dec eax
jne 0x4cea16
jmp 0x4cea43
test eax, eax
je 0x4cea43
mov ecx, ebx
sub ecx, eax
mov eax, ebx
sub eax, ecx
push 0x4e28bc
lea ecx, [ebp + ecx - 0x510]
mov edx, 0x7fffffff
call fcn.004010b0
mov edx, ebx
lea eax, [ebp - 0x510]
jmp 0x4cea50
cmp byte [eax], 0
je 0x4cea5b
inc eax
dec edx
jne 0x4cea50
jmp 0x4cea7f
test edx, edx
je 0x4cea7f
lea eax, [ebp - 0xf28]
push eax
mov ecx, ebx
sub ecx, edx
mov eax, ebx
sub eax, ecx
lea ecx, [ebp + ecx - 0x510]
mov edx, 0x7fffffff
call fcn.004010b0
push ebx
lea ecx, [ebp - 0x510]
push str.DisplayName
push ecx
lea ecx, [ebp - 0x718]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
mov edx, 0x4ecc10
lea ecx, [ebp - 0x718]
call fcn.0047bb80
test eax, eax
je 0x4ceb48
push ebx
lea edx, [ebp - 0x510]
push str.DisplayVersion
push edx
lea ecx, [ebp - 0x818]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea edx, [ebp - 0x818]
lea ecx, [ebp - 0x610]
call fcn.0047bb80
test eax, eax
jne 0x4ceb48
push ebx
lea eax, [ebp - 0x510]
push str.InstallLocation
push eax
lea ecx, [ebp - 0x920]
mov edx, CreateStatusWindowA
call fcn.004bff10
add esp, 0xc
lea ecx, [ebp - 0x510]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x208
ja 0x4ceb48
lea edx, [ebp - 0x510]
push edx
lea eax, [ebp - 0xb28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0xb28]
push ecx
push CreateStatusWindowA
call fcn.004c1970
add esp, 8
inc dword [ebp - 0x1330]
jmp 0x4ce984
mov edx, dword [ebp - 0x1338]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1334]
inc eax
mov dword [ebp - 0x1334], eax
cmp eax, 2
jl 0x4ce8bd
cmp dword [0x506e0c], 0
je 0x4ceb8a
mov eax, dword [ebp - 0x1344]
mov dword [0x4f8b78], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1330]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret