Function at 0x100019bc
Capabilities:
Get file version info
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x307c0]
mov eax, 0x307c0
call fcn.1001e1c0
push 0xfffffffffffffffe
push 0x10025a48
push 0x100123b0
mov eax, dword fs:[0]
push eax
sub esp, 0x70
mov eax, dword [0x10028500]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x307bc], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [0x10029210]
mov dword [ebp - 0x60], eax
xor ebx, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x2c]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10001a70
mov dword [ebp - 0x3c], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.10001f35
xor eax, eax
cmp dword [ebp - 0x3c], ebx
sete al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x307bc]
xor ecx, ebp
call fcn.1000b28c
add ebp, 0x307c0
leave
ret
mov dword [ebp - 0x44], ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x44]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x44], ebx
je 0x10001a32
mov byte [ebp - 0x80], bl
xor eax, eax
lea edi, [ebp - 0x7c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 0x80], 4
mov byte [ebp], bl
push 0x7f
push ebx
lea eax, [ebp + 1]
push eax
call fcn.10016310
push 8
pop ecx
xor eax, eax
lea edi, [ebp + 0x80]
rep stosd dword es:[edi], eax
mov byte [ebp + 0x200a0], bl
mov esi, 0xfffe
push esi
push ebx
lea eax, [ebp + 0x200a1]
push eax
call fcn.10016310
mov byte [ebp + 0x100a0], bl
push esi
push ebx
lea eax, [ebp + 0x100a1]
push eax
call fcn.10016310
mov dword [ebp - 0x28], ebx
mov byte [ebp + 0xa0], bl
push esi
push ebx
lea eax, [ebp + 0xa1]
push eax
call fcn.10016310
add esp, 0x30
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x44]
jae 0x10001e5c
mov byte [ebp + 0x304b0], bl
mov esi, 0x103
push esi
push ebx
lea eax, [ebp + 0x304b1]
push eax
call fcn.10016310
add esp, 0xc
lea edi, [esi + 1]
mov dword [ebp - 0x5c], edi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp + 0x304b0]
push eax
push dword [ebp - 0x30]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, esi
je 0x10001e5c
cmp byte [ebp + 0x304b0], 0x4b
jne 0x10001b6d
cmp byte [ebp + 0x304b1], 0x42
je 0x10001e54
mov byte [ebp + 0x300a0], bl
push esi
push ebx
lea eax, [ebp + 0x300a1]
push eax
call fcn.10016310
lea eax, [ebp + 0x304b0]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_s
push edi
lea eax, [ebp + 0x300a0]
push eax
call fcn.10001985
add esp, 0x1c
mov dword [ebp - 0x1c], ebx
xor eax, eax
inc eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
push ebx
lea eax, [ebp + 0x300a0]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001e54
mov byte [ebp + 0x302a8], bl
push esi
push ebx
lea eax, [ebp + 0x302a9]
push eax
call fcn.10016310
add esp, 0xc
mov dword [ebp - 0x54], edi
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp + 0x302a8]
push eax
lea eax, [ebp - 0x40]
push eax
push ebx
push str.DisplayName
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10001e4b
mov byte [ebp + 0x305b4], bl
push esi
push ebx
lea eax, [ebp + 0x305b5]
push eax
call fcn.10016310
add esp, 0xc
mov dword [ebp - 0x34], edi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp + 0x305b4]
push eax
lea eax, [ebp - 0x40]
push eax
push ebx
push str.DisplayVersion
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10001ddf
mov byte [ebp + 0x306b8], bl
push esi
push ebx
lea eax, [ebp + 0x306b9]
push eax
call fcn.10016310
add esp, 0xc
mov dword [ebp - 0x50], edi
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x306b8]
push eax
lea eax, [ebp - 0x40]
push eax
push ebx
push str.DisplayIcon
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10001e4b
mov dword [ebp - 0x34], ebx
push str..exe
lea eax, [ebp + 0x306b8]
push eax
call fcn.1000bfd0
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, ebx
jne 0x10001cc1
push str..dll
lea eax, [ebp + 0x306b8]
push eax
call fcn.1000bfd0
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
cmp eax, ebx
je 0x10001e4b
mov byte [ebp + 0x303ac], bl
push esi
push ebx
lea eax, [ebp + 0x303ad]
push eax
call fcn.10016310
lea ecx, [ebp + 0x306b8]
mov eax, dword [ebp - 0x24]
sub eax, ecx
add eax, 4
push eax
mov eax, ecx
push eax
lea eax, [ebp + 0x303ac]
push eax
call fcn.100101c0
add esp, 0x18
mov dword [ebp - 0x68], ebx
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x303ac]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x64], eax
cmp eax, ebx
je 0x10001ddf
push eax
call fcn.1000a74f
pop ecx
mov dword [ebp - 0x24], eax
push eax
push dword [ebp - 0x64]
push ebx
lea eax, [ebp + 0x303ac]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
mov dword [ebp - 0x48], ebx
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x58]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 0x24]
call sub.VERSION.dll_VerQueryValueA
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x48]
shr eax, 2
cmp dword [ebp - 0x38], eax
jae 0x10001dd1
mov byte [ebp + 0x301a4], bl
push esi
push ebx
lea eax, [ebp + 0x301a5]
push eax
call fcn.10016310
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x38]
lea eax, [eax + ecx*4]
movzx ecx, word [eax + 2]
push ecx
movzx eax, word [eax]
push eax
push str.StringFileInfo_04x_04xFileVersion
push edi
lea eax, [ebp + 0x301a4]
push eax
call fcn.10001985
add esp, 0x20
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp + 0x301a4]
push eax
push dword [ebp - 0x24]
call sub.VERSION.dll_VerQueryValueA
push dword [ebp - 0x20]
push dword [ebp - 0x4c]
push edi
lea eax, [ebp + 0x305b4]
push eax
call fcn.1000c056
add esp, 0x10
mov eax, dword [ebp - 0x20]
add dword [ebp - 0x34], eax
inc dword [ebp - 0x38]
jmp 0x10001d4a
cmp dword [ebp - 0x24], ebx
je 0x10001ddf
push dword [ebp - 0x24]
call fcn.1000bcf7
pop ecx
cmp byte [ebp + 0x302a8], bl
je 0x10001e4b
cmp byte [ebp + 0x305b4], bl
je 0x10001e4b
push 0xa0
push ebx
lea eax, [ebp]
push eax
call fcn.10016310
add esp, 0xc
push 0x1f
pop ecx
lea esi, [ebp + 0x302a8]
lea edi, [ebp]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push 7
pop ecx
lea esi, [ebp + 0x305b4]
lea edi, [ebp + 0x80]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp dword [ebp - 0x7c], 0x199
jae 0x10001e5c
mov edi, dword [ebp - 0x28]
lea edi, [ebp + edi + 0x100a0]
push 0x28
pop ecx
lea esi, [ebp]
rep movsd dword es:[edi], dword [esi]
add dword [ebp - 0x28], 0xa0
inc dword [ebp - 0x7c]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x30]
jmp 0x10001b06
cmp dword [ebp - 0x7c], ebx
je 0x10001a39
push dword [ebp - 0x28]
call fcn.1000a432
mov edi, eax
push edi
call fcn.1000b2ea
pop ecx
pop ecx
mov esi, eax
cmp esi, ebx
jne 0x10001e81
xor eax, eax
jmp 0x10001eaf
push edi
push ebx
push esi
call fcn.10016310
push ebx
push ebx
push esi
push dword [ebp - 0x28]
lea eax, [ebp + 0x200a0]
push eax
lea eax, [ebp + 0x100a0]
push eax
call fcn.1000a446
mov edi, eax
push esi
call fcn.1000b3b4
add esp, 0x28
mov eax, edi
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], eax
cmp eax, ebx
jne 0x10001ec1
mov dword [ebp - 0x20], ebx
jmp 0x10001ed0
mov ecx, eax
and ecx, 7
je 0x10001ecd
sub eax, ecx
add eax, 8
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x20]
push esi
lea eax, [ebp + 0x200a0]
push eax
lea eax, [ebp + 0xb8]
push eax
call fcn.10005078
mov dword [ebp - 0x78], esi
push 6
pop ecx
lea esi, [ebp - 0x80]
lea edi, [ebp + 0xa0]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x20]
add eax, 0x18
push eax
lea eax, [ebp + 0xa0]
push eax
push dword [ebp - 0x60]
call fcn.100047c2
add esp, 0x18
test eax, eax
jne 0x10001a39
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x10028500
call fcn.10014efc
add esp, 0xc
xor eax, eax
jmp 0x10001a4d