Function at 0x41c588
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4c9389
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x517774]
xor eax, esp
mov dword [esp + 0x160], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x517774]
xor eax, esp
push eax
lea eax, [esp + 0x178]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x188]
mov esi, dword [esp + 0x18c]
push ebp
push str.IsRelPreInstalledAndOrGetList__s__n
push 2
push 0x519518
mov edi, ecx
mov dword [esp + 0x50], ebp
mov dword [esp + 0x38], esi
call fcn.00402450
add esp, 0x10
call fcn.00428020
test eax, eax
je 0x41c458
xor eax, eax
jmp 0x41cd21
xor ebx, ebx
cmp ebp, ebx
jne 0x41c462
cmp esi, ebx
je 0x41c451
mov eax, 0xf
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x3c], 4
mov dword [esp + 0xf0], eax
mov dword [esp + 0xec], ebx
mov byte [esp + 0xdc], bl
mov dword [esp + 0x180], ebx
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd0], ebx
mov byte [esp + 0xc0], 0
push 9
push str.SOFTWARE_
lea ecx, [esp + 0xc4]
mov byte [esp + 0x188], 1
call fcn.00402160
push 0xffffffffffffffff
push ebx
lea eax, [edi + 0x208]
push eax
lea ecx, [esp + 0xc8]
call fcn.00407a90
push 1
push 0x4d5334
lea ecx, [esp + 0xc4]
call fcn.00407b80
push str.PreInstalled_Products
lea ecx, [esp + 0xc0]
push ecx
lea edx, [esp + 0x70]
push edx
call fcn.00407fb0
add esp, 0xc
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xe4]
mov byte [esp + 0x18c], 2
call fcn.00402080
mov esi, 0x10
mov byte [esp + 0x180], 1
cmp dword [esp + 0x80], esi
jb 0x41c546
mov eax, dword [esp + 0x6c]
push eax
call fcn.004462ff
add esp, 4
mov eax, dword [esp + 0xdc]
mov dword [esp + 0x20], ebx
cmp dword [esp + 0xf0], esi
jae 0x41c561
lea eax, [esp + 0xdc]
push ebx
lea ecx, [esp + 0x24]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00429833
add esp, 0x18
test eax, eax
jne 0x41c6df
push str.Found_PreInstalled_Products_key_n
push 0x20
push 0x519518
call fcn.00402450
add esp, 0xc
cmp ebp, ebx
je 0x41c5be
mov eax, dword [esp + 0x20]
push ebx
push ebx
lea edx, [esp + 0x44]
push edx
push ebx
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
cmp eax, ebx
sete cl
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], ecx
cmp dword [esp + 0x28], ebx
je 0x41c6cd
mov eax, dword [esp + 0x20]
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
mov dword [esp + 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x41c6cd
mov eax, dword [esp + 0x14]
inc eax
push eax
mov dword [esp + 0x18], eax
call fcn.0044630a
mov ebp, eax
add esp, 4
cmp ebp, ebx
je 0x41c6cd
mov ecx, dword [esp + 0x14]
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x24]
push edx
push ebp
mov byte [ebp], 0
mov eax, dword [esp + 0x38]
push ebx
push eax
mov dword [esp + 0x4c], ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x41c6bf
push ebp
lea ecx, [esp + 0x6c]
call fcn.00402a30
mov ecx, dword [esp + 0x28]
mov esi, dword [ecx + 0x14]
mov eax, dword [esi + 4]
lea edx, [esp + 0x68]
push edx
push eax
push esi
mov byte [esp + 0x18c], 3
call fcn.00405fe0
mov ecx, dword [esp + 0x28]
push 1
mov edi, eax
call fcn.00405c50
mov dword [esi + 4], edi
mov eax, dword [edi + 4]
mov dword [eax], edi
cmp dword [esp + 0x80], 0x10
mov byte [esp + 0x180], 1
jb 0x41c690
mov ecx, dword [esp + 0x6c]
push ecx
call fcn.004462ff
add esp, 4
mov edx, dword [esp + 0x2c]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
push ebp
mov byte [ebp], 0
mov ecx, dword [esp + 0x38]
inc ebx
push ebx
push ecx
mov dword [esp + 0x34], edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x41c634
push ebp
call fcn.00446315
add esp, 4
xor ebx, ebx
lea esi, [ebx + 0x10]
mov edx, dword [esp + 0x20]
push edx
call fcn.00429cef
add esp, 4
jmp 0x41ccb8
push str.Check_for_preinstall___preshrek_n
push 0x20
push 0x519518
call fcn.00402450
add esp, 0xc
lea ecx, [esp + 0x44]
call fcn.00407e10
mov ecx, dword [edi + 0x104]
push 1
push ebx
lea eax, [esp + 0x4c]
push eax
push ebx
push str.PreInstalls
push ecx
mov ecx, edi
mov byte [esp + 0x198], 4
call fcn.004113b0
cmp dword [esp + 0x5c], ebx
je 0x41cc8c
push str.PreInstalls
push str.Found_list_of_preinstalls_under_section__s_n
push 0x20
push 0x519518
call fcn.00402450
push str.Installed_Products
lea edx, [esp + 0xd0]
push edx
lea eax, [esp + 0x80]
push eax
call fcn.00407fb0
add esp, 0x1c
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0xe4]
mov byte [esp + 0x18c], 5
call fcn.00402080
lea ecx, [esp + 0x68]
mov byte [esp + 0x180], 4
call fcn.00401da0
mov eax, dword [esp + 0xdc]
mov dword [esp + 0x14], ebx
cmp dword [esp + 0xf0], esi
jae 0x41c7a1
lea eax, [esp + 0xdc]
push ebx
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00429833
add esp, 0x18
test eax, eax
jne 0x41cc8c
push str.PreInstalls.
lea ecx, [esp + 0xf8]
call fcn.00402a30
push 0x4d41fc
lea ecx, [esp + 0x88]
mov byte [esp + 0x184], 6
call fcn.00402a30
push str.Install
lea edx, [esp + 0xc0]
push edx
lea eax, [esp + 0x70]
push eax
mov byte [esp + 0x18c], 7
call fcn.00407fb0
add esp, 0xc
push 0x4d5334
lea ecx, [esp + 0x6c]
mov byte [esp + 0x184], 8
call fcn.00407f80
mov ecx, dword [esp + 0x58]
mov eax, dword [ecx]
mov esi, dword [esp + 0x44]
mov ebx, eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebx
lea esp, [esp]
mov ebp, dword [esp + 0x58]
test esi, esi
je 0x41c84e
cmp esi, dword [esp + 0x44]
je 0x41c853
call fcn.00497c49
cmp ebx, ebp
je 0x41ca5d
cmp dword [esp + 0x10c], 0x10
mov edx, dword [esp + 0xf8]
jae 0x41c873
lea edx, [esp + 0xf8]
mov eax, edx
lea ebp, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41c878
sub eax, ebp
push eax
push edx
lea ecx, [esp + 0x8c]
call fcn.00402160
test esi, esi
jne 0x41ca56
call fcn.00497c49
cmp ebx, dword [esi + 0x14]
jne 0x41c8a6
call fcn.00497c49
push 0xffffffffffffffff
lea eax, [ebx + 8]
push 0
push eax
lea ecx, [esp + 0x90]
call fcn.00407a90
mov eax, dword [esp + 0x88]
mov ebx, 0x10
cmp dword [esp + 0x9c], ebx
jae 0x41c8d6
lea eax, [esp + 0x88]
movzx edx, word [edi + 0x128]
push edx
mov edx, dword [edi + 0x104]
push 0x64
lea ecx, [esp + 0x118]
push ecx
push str.CDGuid
push eax
push edx
lea ecx, [edi + 0x320]
call fcn.0042a833
test eax, eax
je 0x41ca39
lea eax, [esp + 0x110]
push eax
push str.About_to_ckeck_for_cdguid__s_under_installed_products_n
push 0x20
push 0x519518
call fcn.00402450
mov eax, dword [esp + 0x24]
add esp, 0x10
push 0
push 0
lea ecx, [esp + 0x44]
push ecx
push 0
lea edx, [esp + 0x120]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov dword [esp + 0x24], esi
test esi, esi
je 0x41c9df
lea ecx, [esp + 0x110]
push ecx
lea edx, [esp + 0x6c]
push edx
lea eax, [esp + 0xa8]
push eax
mov dword [esp + 0x38], 0
call fcn.00407fb0
add esp, 0xc
mov eax, dword [esp + 0xa4]
mov byte [esp + 0x180], 9
cmp dword [esp + 0xb8], ebx
jae 0x41c994
lea eax, [esp + 0xa4]
push 0
lea ecx, [esp + 0x30]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00429833
add esp, 0x18
test eax, eax
jne 0x41c9c7
mov edx, dword [esp + 0x2c]
xor esi, esi
push edx
mov dword [esp + 0x28], esi
call fcn.00429cef
add esp, 4
lea ecx, [esp + 0xa0]
mov byte [esp + 0x180], 8
call fcn.00401da0
test esi, esi
jne 0x41ca39
mov eax, dword [esp + 0x88]
cmp dword [esp + 0x9c], ebx
jae 0x41c9f6
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x114]
push eax
push str.Found_the_cdguid__s_in_section__s_n
push 1
push 0x519518
call fcn.00402450
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x58]
mov dword [esp + 0x4c], ecx
add esp, 0x14
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], edx
call fcn.00413670
mov ecx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
push 0
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x20]
call fcn.00405160
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
jmp 0x41c840
mov esi, dword [esi]
jmp 0x41c89c
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00429cef
add esp, 4
cmp dword [esp + 0x24], 0
jne 0x41cbf6
lea ecx, [esp + 0xa0]
call fcn.00407e10
cmp dword [esp + 0x9c], 0x10
mov eax, dword [esp + 0x88]
mov byte [esp + 0x180], 0xa
jae 0x41caa1
lea eax, [esp + 0x88]
push 1
push 0
lea edx, [esp + 0xa8]
push edx
push 0
push eax
mov eax, dword [edi + 0x104]
push eax
mov ecx, edi
call fcn.004113b0
mov edi, dword [esp + 0x40]
test edi, edi
je 0x41cbc2
mov ecx, dword [esp + 0xb4]
mov ebx, dword [esp + 0xa0]
mov eax, dword [ecx]
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x18], ebx
mov esi, dword [esp + 0xb4]
mov dword [esp + 0x1c], eax
test ebx, ebx
je 0x41cafa
cmp ebx, dword [esp + 0xa0]
je 0x41caff
call fcn.00497c49
cmp dword [esp + 0x1c], esi
je 0x41cbc2
cmp dword [esp + 0x30], 0
jne 0x41cb89
lea ecx, [esp + 0x18]
call fcn.004052a0
mov edx, edi
lea esi, [edx + 1]
mov edi, edi
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x41cb20
sub edx, esi
push edx
mov edx, dword [eax + 0x14]
push edi
push edx
push 0
mov ecx, eax
call fcn.0040c720
test eax, eax
jne 0x41cb89
push edi
push str.This_product__s_was_preinstalled_n
push 1
push 0x519518
call fcn.00402450
add esp, 0x10
test ebp, ebp
jne 0x41cb81
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x38], eax
call fcn.00413670
mov ebx, dword [eax]
mov edx, dword [eax + 4]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x30], 1
test ebp, ebp
je 0x41cb9e
lea ecx, [esp + 0x18]
call fcn.004052a0
push eax
mov ecx, ebp
call fcn.0041b7a0
test ebx, ebx
jne 0x41cbbe
call fcn.00497c49
xor eax, eax
mov esi, dword [esp + 0x1c]
cmp esi, dword [eax + 0x14]
jne 0x41cbb7
call fcn.00497c49
mov eax, dword [esi]
jmp 0x41cae2
mov eax, dword [ebx]
jmp 0x41cba9
lea ecx, [esp + 0xa0]
call fcn.00405f80
mov ecx, dword [esp + 0xb4]
push ecx
call fcn.004462ff
mov edx, dword [esp + 0xa4]
push edx
mov dword [esp + 0xbc], 0
call fcn.004462ff
add esp, 8
cmp dword [esp + 0x80], 0x10
jb 0x41cc0d
mov eax, dword [esp + 0x6c]
push eax
call fcn.004462ff
add esp, 4
xor edi, edi
mov ebx, 0x10
mov esi, 0xf
mov dword [esp + 0x80], esi
mov dword [esp + 0x7c], edi
mov byte [esp + 0x6c], 0
cmp dword [esp + 0x9c], ebx
jb 0x41cc42
mov ecx, dword [esp + 0x88]
push ecx
call fcn.004462ff
add esp, 4
mov dword [esp + 0x9c], esi
mov dword [esp + 0x98], edi
mov byte [esp + 0x88], 0
cmp dword [esp + 0x10c], ebx
jb 0x41cc71
mov edx, dword [esp + 0xf8]
push edx
call fcn.004462ff
add esp, 4
xor ebx, ebx
mov dword [esp + 0x10c], esi
mov dword [esp + 0x108], edi
mov byte [esp + 0xf8], 0
lea esi, [ebx + 0x10]
lea ecx, [esp + 0x44]
mov byte [esp + 0x180], 1
call fcn.00405f80
mov eax, dword [esp + 0x58]
push eax
call fcn.004462ff
mov ecx, dword [esp + 0x48]
push ecx
mov dword [esp + 0x60], ebx
call fcn.004462ff
add esp, 8
mov edx, dword [esp + 0x24]
push edx
push str.IsRelPreInstalledAndOrGetList_____error___d_n
push 4
push 0x519518
call fcn.00402450
add esp, 0x10
cmp dword [esp + 0xd4], esi
jb 0x41ccea
mov eax, dword [esp + 0xc0]
push eax
call fcn.004462ff
add esp, 4
mov dword [esp + 0xd4], 0xf
mov dword [esp + 0xd0], ebx
mov byte [esp + 0xc0], 0
cmp dword [esp + 0xf0], esi
jb 0x41cd1d
mov ecx, dword [esp + 0xdc]
push ecx
call fcn.004462ff
add esp, 4
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x178]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x160]
xor ecx, esp
call fcn.004974ba
add esp, 0x170
ret 8