Function at 0x409eb3
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x664e94]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x28
mov eax, 0x5b885e
call fcn.0058f985
mov eax, dword [ebp + 0x214]
mov esi, dword [ebp + 0x21c]
mov edi, dword [ebp + 0x220]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x218]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x34], edi
call fcn.00496dcd
push eax
lea ecx, [ebp - 0x14]
call fcn.0040141e
mov ecx, dword [ebp - 0x2c]
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.0040116b
mov ecx, esi
call fcn.0040116b
mov ecx, edi
call fcn.0040116b
cmp dword [ebp - 0x20], ebx
je 0x40a11f
push dword [ebp - 0x20]
call fcn.0058f15d
pop ecx
test eax, eax
je 0x40a11f
push dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push eax
call fcn.00401518
add esp, 0xc
call fcn.00446344
test eax, eax
je 0x409f69
mov edi, 0x20119
mov dword [ebp - 0x1c], 0x20219
jmp 0x409f72
or dword [ebp - 0x1c], 0xffffffff
mov edi, 0x20019
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push dword [ebp - 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x409fd7
lea eax, [ebp - 0x18]
push eax
push edi
push ebx
push dword [ebp - 0x14]
mov edi, SysReAllocStringLen
push edi
call esi
test eax, eax
je 0x409fd7
cmp dword [ebp - 0x1c], 0xffffffff
je 0x40a11f
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
push ebx
push dword [ebp - 0x14]
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x409fd7
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1c]
push ebx
push dword [ebp - 0x14]
push edi
call esi
test eax, eax
jne 0x40a11f
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
push ebx
push ebx
push str.DisplayName
push dword [ebp - 0x18]
mov edi, 0x208
mov dword [ebp - 0x10], edi
call esi
test eax, eax
je 0x40a048
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
call sub.msi.dll_MsiPreviewDialogW
test eax, eax
jne 0x40a039
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
push 0x5d831c
push dword [ebp - 0x1c]
mov dword [ebp - 0x10], edi
call sub.msi.dll_MsiGetSourcePathW
push dword [ebp - 0x1c]
mov edi, eax
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov dword [ebp - 0x1c], ebx
cmp edi, ebx
je 0x40a048
push 0x5d45c0
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp]
push eax
call fcn.00401287
push 4
pop edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push str.WindowsInstaller
push dword [ebp - 0x18]
mov dword [ebp - 0x10], edi
call esi
test eax, eax
je 0x40a075
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x10]
push eax
cmp dword [ebp - 0x30], ebx
je 0x40a0fb
lea eax, [ebp - 0x28]
push eax
push ebx
push ebx
push str.NoRemove
push dword [ebp - 0x18]
mov dword [ebp - 0x10], edi
call esi
test eax, eax
je 0x40a098
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
je 0x40a0b2
cmp byte [ebp + 0x224], bl
jne 0x40a0b2
mov ecx, dword [ebp - 0x24]
call fcn.0040116b
jmp 0x40a15b
push 0x208
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp]
push eax
call fcn.0058f15d
cmp word [ebp + eax*2 - 2], 0x5c
pop ecx
je 0x40a0e2
push 0x5d4dc0
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [ebp - 0x20]
lea eax, [ebp]
push eax
push str._sMSIEXEC.EXE__x__s
push dword [ebp - 0x24]
call fcn.00401518
add esp, 0x10
jmp 0x40a15b
lea eax, [ebp]
push eax
push ebx
push ebx
push str.UninstallString
push dword [ebp - 0x18]
mov dword [ebp - 0x10], 0x208
call esi
test eax, eax
je 0x40a14f
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401019
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0058f976
add ebp, 0x20c
leave
ret
mov ecx, dword [ebp - 0x24]
lea eax, [ebp]
push eax
call fcn.00401287
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
push ebx
push ebx
push str.SuiteUninstallString
push dword [ebp - 0x18]
mov dword [ebp - 0x10], 0x104
call esi
test eax, eax
jne 0x40a186
mov ecx, dword [ebp - 0x34]
lea eax, [ebp]
push eax
call fcn.00401287
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00401019
mov al, 1
jmp 0x40a12c