Function at 0x401960
Capabilities:
Enumerate processes
Get cpu information
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xf60
cmp dword [esi + 0x44], 0
push ebx
push edi
je 0x401c69
inc word [esi + 0x48]
movzx eax, word [esi + 0x48]
push eax
push str.Iteration__d
push esi
call fcn.00401330
add esp, 0xc
push 0x9c
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.004157f0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], 0x9c
call edi
test eax, eax
jne 0x4019d3
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x1c], 0x94
call edi
test eax, eax
je 0x401c69
movzx ecx, byte [esp + 0x132]
movzx edx, word [esp + 0x130]
movzx eax, word [esp + 0x12e]
push ecx
movzx ecx, word [esp + 0x130]
push edx
push eax
mov eax, dword [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x34]
lea edx, [esp + 0x3c]
push edx
mov edx, dword [esp + 0x34]
push eax
mov eax, dword [esp + 0x34]
push ecx
push edx
push eax
push str.Version:_OS:_d._d__BLD:_d__PLTF:_d__SPS:_s__SP:_d._d__STMSK:_d__PROD:_d
push esi
call fcn.00401330
add esp, 0x2c
push 0x400
lea ecx, [esp + 0x36c]
push 0
push ecx
call fcn.004157f0
add esp, 0xc
push 0x400
lea edx, [esp + 0x36c]
push edx
push str.ProcessorNameString
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call fcn.0040dc4b
add esp, 0x14
push 0x400
lea eax, [esp + 0x76c]
push 0
push eax
call fcn.004157f0
add esp, 0xc
push 0x400
lea ecx, [esp + 0x76c]
push ecx
push str.Identifier
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call fcn.0040dc4b
add esp, 0x14
lea edx, [esp + 0x768]
push edx
lea eax, [esp + 0x36c]
push eax
push str.Platform:_s__s_
push esi
call fcn.00401330
push 0x429500
push esi
call fcn.00401330
add esp, 0x18
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x401c69
lea ecx, [esp + 0x138]
push ecx
push edi
mov dword [esp + 0x140], 0x128
call sub.KERNEL32.dll_Process32First
mov edx, dword [esp + 0x140]
push edx
lea eax, [esp + 0x160]
push eax
push str.N:_s_tP:_d
push esi
call fcn.00401330
add esp, 0x10
lea ecx, [esp + 0x138]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x401b50
lea ebx, [ebx]
mov edx, dword [esp + 0x140]
push edx
lea eax, [esp + 0x160]
push eax
push str.N:_s_tP:_d
push esi
call fcn.00401330
add esp, 0x10
lea ecx, [esp + 0x138]
push ecx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401b20
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Dumping_processes_
push esi
call fcn.00401330
push 0x429534
push esi
call fcn.00401330
add esp, 0x10
lea edx, [esp + 8]
push edx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401c5b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
lea esp, [esp]
mov edx, dword [esp + 8]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x274]
push ecx
push edi
push edx
mov byte [esp + 0x280], 0
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov byte [esp + 0xb68], 0
test eax, eax
jne 0x401c54
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
lea ecx, [esp + 0x26c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401c30
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xb6c]
push ecx
push 0
push 0
push str.DisplayName
push edx
mov dword [esp + 0x2c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
push eax
call ebx
lea ecx, [esp + 0xb68]
push ecx
lea edx, [esp + 0x264]
push edx
push str.K:_s_tN:_s
push esi
inc edi
call fcn.00401330
add esp, 0x10
jmp 0x401ba0
mov eax, dword [esp + 8]
push eax
call ebx
push str.Installed_soft_dump_
push esi
call fcn.00401330
add esp, 8
pop edi
pop ebx
mov esp, ebp
pop ebp
ret