Function at 0x406394
Capabilities:
Check if file exists
Get file attributes
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 1
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallB2
push reloc.OLEAUT32.dll_SysReAllocString
xor esi, esi
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4065e0
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x2000
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
mov dword [ebp - 0x10], edi
cmp edi, ebx
je 0x4065df
lea eax, [edi + 0xc00]
push 0x104
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov esi, dword [eax]
push edi
mov dword [ebp - 0x14], ebx
push ebx
jmp 0x4065b5
inc dword [ebp - 0x14]
push str.SoftwareRimArtsB2Settings
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 4]
push eax
push 1
push ebx
push edi
push VariantInit
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4065ac
lea ecx, [ebp - 0xc]
push ecx
lea eax, [edi + 0x800]
push eax
mov dword [ebp - 0xc], 0x400
mov byte [eax], bl
lea eax, [ebp - 0x18]
push eax
push ebx
push str.DataDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4065ac
lea eax, [edi + 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax + edi + 0x7ff]
cmp byte [eax], 0x5c
jne 0x406480
mov byte [eax], bl
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
push ecx
push eax
mov dword [ebp - 0xc], 0x400
mov byte [eax], bl
lea eax, [ebp - 0x18]
push eax
push ebx
push str.DataDirBak
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4064d6
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 8]
lea eax, [eax + ecx - 1]
cmp byte [eax], 0x5c
jne 0x4064bf
mov byte [eax], bl
push ecx
lea eax, [edi + 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4064d6
mov eax, dword [ebp - 8]
mov byte [eax], bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [edi + 0x800]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4065ac
test al, 0x10
je 0x4065ac
push 0xfa0
xor eax, eax
lea edi, [esi + 0x10]
push edi
mov word [edi], ax
mov eax, dword [ebp - 0x10]
push 0xffffffffffffffff
add eax, 0x800
push eax
push ebx
push 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp word [edi], bx
je 0x40654c
push edi
call fcn.0046de55
pop ecx
lea ecx, [eax + eax + 0x12]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi], ecx
mov dword [esi + 4], 0x4b374558
mov dword [esi + 8], 0x1000007
add esi, ecx
inc dword [eax]
mov eax, dword [ebp - 8]
cmp byte [eax], bl
je 0x4065a9
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4065a9
test al, 0x10
je 0x4065a9
push 0xfa0
lea edi, [esi + 0x10]
push edi
push 0xffffffffffffffff
push dword [ebp - 8]
xor eax, eax
push ebx
push 1
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp word [edi], bx
je 0x4065a9
push edi
call fcn.0046de55
pop ecx
lea ecx, [eax + eax + 0x12]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esi], ecx
mov dword [esi + 4], 0x4b374558
mov dword [esi + 8], 0x1000007
add esi, ecx
inc dword [eax]
mov edi, dword [ebp - 0x10]
push 0x104
push edi
push dword [ebp - 0x14]
push VariantInit
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x40640c
mov eax, dword [ebp + 8]
mov dword [eax], esi
push edi
xor esi, esi
push ebx
inc esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
cmp dword [ebp - 4], ebx
je 0x4065ee
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret