Function at 0x4099b5
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20a8
call fcn.00420c00
push ebx
push esi
mov esi, ecx
mov edx, dword [esi + 0x1e4]
mov ecx, dword [edx + 0x4ec]
mov eax, dword [edx + 0x4e8]
test cl, 2
jne 0x409cf0
mov dword [ebp - 0x14], eax
and dword [ebp - 0x14], 1
je 0x4099fa
test al, 6
jne 0x4099fa
test cl, 4
je 0x4099fa
mov byte [esi + 0x3d8], 1
push edi
push 0x18
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0xa7]
mov byte [ebp - 0xa8], bl
add edx, 0x42d
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0x26
mov eax, dword [esi + 0x1e4]
jne 0x409a38
add eax, 0x42d
push eax
push 0x44c7ec
jmp 0x409a43
add eax, 0x42d
push eax
push str._s
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x18a7]
mov byte [ebp - 0x18a8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0xc
mov dword [ebp - 8], ebx
stosb byte es:[edi], al
lea eax, [ebp - 0x18a8]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x18a8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x18a9], bl
lea eax, [ebp - 8]
push eax
push 0x20019
lea eax, [ebp - 0x18a8]
push ebx
push eax
xor eax, eax
cmp byte [0x451b24], bl
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409c25
mov ecx, 0x1ff
lea edi, [ebp - 0x10a7]
mov byte [ebp - 0x10a8], bl
mov dword [ebp - 0x10], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x28]
mov dword [ebp - 0x20], 0x800
push eax
push ebx
push ebx
lea eax, [ebp - 0x20]
push ebx
push eax
lea eax, [ebp - 0x10a8]
push eax
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp dword [ebp - 0x10], ebx
jne 0x409b11
cmp eax, ebx
jne 0x409c25
jmp 0x409b1c
cmp eax, 0x103
je 0x409c25
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x8a7]
mov byte [ebp - 0x8a8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x8a8]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x10a8]
push eax
lea eax, [ebp - 0x8a8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
push 0x20019
lea eax, [ebp - 0x8a8]
push ebx
push eax
xor eax, eax
cmp byte [0x451b24], bl
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409c08
mov ecx, 0x1ff
lea edi, [ebp - 0x20a7]
mov byte [ebp - 0x20a8], bl
mov dword [ebp - 0x1c], 0x800
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20a8]
push eax
push ebx
push ebx
push 0x44c7d8
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409c08
lea eax, [ebp - 0x20a8]
push eax
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x409c08
lea eax, [ebp - 0x10a8]
push 0xffffffffffffffff
push eax
call fcn.004017a1
pop ecx
mov dword [ebp - 0x18], eax
pop ecx
lea eax, [ebp - 0x18]
push eax
lea ecx, [esi + 0x3cc]
call fcn.00409d6d
push dword [ebp - 0x18]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
inc dword [ebp - 0x10]
cmp dword [ebp - 0xc], ebx
je 0x409add
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xc], ebx
jmp 0x409add
mov eax, dword [esi + 0x1e4]
pop edi
add eax, 0x4a4
mov eax, dword [eax]
cmp eax, ebx
je 0x409c46
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
test eax, eax
jne 0x409ce2
cmp dword [ebp - 0x14], ebx
je 0x409ce2
cmp dword [esi + 0x3d0], ebx
jle 0x409c81
push 1
lea ecx, [ebp - 0x44]
push dword [esi + 0x3cc]
call fcn.00409cf6
mov ecx, dword [esi + 0x1e4]
push eax
add ecx, 0x494
call fcn.0040266e
lea ecx, [ebp - 0x44]
call fcn.00402818
mov eax, dword [esi + 0x1e4]
cmp byte [eax + 0x42c], bl
jne 0x409ce2
cmp byte [eax + 0x1f2], bl
jne 0x409ce2
cmp byte [eax + 0x1f3], bl
jne 0x409ce2
cmp byte [esi + 0x3d8], bl
je 0x409cc4
cmp dword [esi + 0x3d0], ebx
setg byte [ebp - 1]
cmp dword [ebp - 8], ebx
je 0x409cbf
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
jmp 0x409cf2
cmp dword [esi + 0x3d0], 1
setg byte [ebp - 1]
cmp dword [ebp - 8], ebx
je 0x409cdd
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
jmp 0x409cf2
cmp dword [ebp - 8], ebx
je 0x409cf0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop esi
pop ebx
leave
ret