Function at 0x101e1be
Capabilities:
Check os version
Get installed programs
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd4
mov ecx, dword [ebp + 0x10]
mov eax, dword [0x102c22c]
mov dword [ebp - 0xc0], ecx
mov ecx, dword [ebp + 0x14]
push ebx
mov dword [ebp - 0xb8], ecx
mov ecx, dword [ebp + 0x18]
push esi
push edi
mov dword [ebp - 0xc4], ecx
mov ecx, dword [ebp + 0x1c]
lea edx, [ebp - 0xd4]
push edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xbc], ecx
xor ecx, ecx
push ecx
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp + 0xc]
push 0x1007f78
push eax
mov dword [ebp - 0xac], 1
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0xa8], ecx
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0xb4], ecx
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindFirstLineA]
test eax, eax
je 0x101e51d
mov ebx, 0xfffa
mov esi, 0x107f8a0
mov edi, 0x106e760
inc dword [ebp - 0x9c]
push 0
push ebx
push esi
push 1
lea eax, [ebp - 0xd4]
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x101e364
push 0
push ebx
push 0x106f8a0
push 2
lea eax, [ebp - 0xd4]
push eax
mov dword [ebp - 0xa0], 1
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldA]
test eax, eax
je 0x101e2ba
push 0x1007f6c
push 0x106f8a0
call sub.ntdll.dll__stricmp
test eax, eax
pop ecx
pop ecx
jne 0x101e2ba
and dword [ebp - 0xa0], eax
inc dword [ebp - 0xb0]
cmp dword [ebp - 0xa0], 0
je 0x101e305
push esi
push dword [ebp - 0xa4]
push 0x10027c8
push 0x1000
push edi
call sub.ntdll.dll__snprintf
add esp, 0x14
push 0
push edi
mov byte [0x106f75f], 0
call fcn.01017367
test eax, eax
jne 0x101e2ff
or dword [ebp - 0xa0], 0xffffffff
inc dword [ebp - 0xb4]
jmp 0x101e305
inc dword [ebp - 0xa8]
cmp dword [ebp + 0x24], 0
je 0x101e385
push dword [ebp - 0x9c]
push 0x1002298
push 0x1000
push edi
call sub.ntdll.dll__snprintf
mov eax, esi
add esp, 0x10
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x101e329
sub eax, ecx
push eax
push esi
push edi
call fcn.0101663e
push dword [ebp - 0x9c]
push 0x10022a4
push 0x1000
push edi
call sub.ntdll.dll__snprintf
add esp, 0x10
push 4
lea eax, [ebp - 0xa0]
push eax
push edi
call fcn.0101663e
jmp 0x101e385
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x9c]
push 0x1007f08
call fcn.01015c5a
add esp, 0xc
and dword [ebp - 0xac], 0
lea eax, [ebp - 0xd4]
push eax
push eax
call dword [sym.imp.UPDSPAPI.dll_UpdSpFindNextLine]
test eax, eax
jne 0x101e253
xor edi, edi
cmp dword [ebp + 0x24], edi
je 0x101e3c8
push 4
lea eax, [ebp - 0x9c]
push eax
push 0x10022b4
call fcn.0101663e
push 4
lea eax, [ebp - 0xa8]
push eax
push 0x1002358
call fcn.0101663e
cmp dword [ebp + 0x20], edi
je 0x101e527
cmp dword [ebp - 0xa8], edi
jne 0x101e527
jmp 0x109e648
push 0x1007d40
call fcn.01015c42
mov eax, dword [ebp - 0xc0]
test eax, eax
pop edi
pop esi
pop ebx
je 0x101e53c
mov ecx, dword [ebp - 0x9c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb8]
test eax, eax
je 0x101e54e
mov ecx, dword [ebp - 0xa8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc4]
test eax, eax
je 0x101e560
mov ecx, dword [ebp - 0xb0]
mov dword [eax], ecx
mov eax, dword [ebp - 0xbc]
test eax, eax
je 0x101e572
mov ecx, dword [ebp - 0xb4]
mov dword [eax], ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xac]
call fcn.0101439a
leave
ret 0x20