Function at 0x401240
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4305a7
push eax
mov dword fs:[0], esp
sub esp, 0x128
lea eax, [esp + 8]
push ebx
push ebp
push esi
push edi
push eax
xor ebx, ebx
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov edi, ecx
push reloc.PPData.dll_Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4014fd
mov eax, dword [esp + 0x18]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x30]
push ebx
lea edx, [esp + 0x48]
push ecx
push edx
push ebx
push eax
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x4014f2
cmp eax, ebx
jne 0x4014b8
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push 0x20019
lea edx, [esp + 0x40]
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4014c9
mov ecx, dword [esp + 0x10]
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DisplayName
call fcn.00428960
lea edx, [esp + 0x24]
mov ecx, edi
push edx
call fcn.00401520
lea ecx, [esp + 0x1c]
mov dword [esp + 0x140], ebx
call fcn.00427bf0
lea ecx, [esp + 0x1c]
call fcn.00427ba4
mov eax, dword [esp + 0x1c]
push 0x441314
push eax
call fcn.0041bda7
add esp, 8
test eax, eax
je 0x401499
push 0x14
call fcn.00428e1c
add esp, 4
cmp eax, ebx
je 0x40136c
mov ecx, dword [0x43db14]
mov esi, eax
mov dword [eax], ecx
mov edx, dword [0x43db14]
mov dword [eax + 4], edx
mov ecx, dword [0x43db14]
mov dword [eax + 8], ecx
mov edx, dword [0x43db14]
mov dword [eax + 0xc], edx
jmp 0x40136e
xor esi, esi
mov eax, dword [esp + 0x10]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DisplayName
call fcn.00428960
lea ecx, [esp + 0x30]
push ecx
mov ecx, edi
call fcn.00401520
push eax
mov ecx, esi
mov byte [esp + 0x144], 1
call fcn.004289df
lea ecx, [esp + 0x28]
mov byte [esp + 0x140], bl
call fcn.004288f2
mov edx, dword [esp + 0x10]
push edx
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.DisplayVersion
call fcn.00428960
lea eax, [esp + 0x38]
mov ecx, edi
push eax
call fcn.00401520
push eax
lea ecx, [esi + 4]
mov byte [esp + 0x144], 2
call fcn.004289df
lea ecx, [esp + 0x30]
mov byte [esp + 0x140], bl
call fcn.004288f2
push ecx
mov ecx, dword [esp + 0x14]
mov ebp, esp
mov dword [esp + 0x18], esp
push ecx
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.InstallDate
call fcn.00428960
push ebp
mov ecx, edi
call fcn.00401520
lea edx, [esp + 0x38]
mov ecx, edi
push edx
call fcn.00401630
push eax
lea ecx, [esi + 8]
mov byte [esp + 0x144], 3
call fcn.004289df
lea ecx, [esp + 0x34]
mov byte [esp + 0x140], bl
call fcn.004288f2
mov eax, dword [esp + 0x10]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x1c], esp
push str.Publisher
call fcn.00428960
lea ecx, [esp + 0x34]
push ecx
mov ecx, edi
call fcn.00401520
push eax
lea ecx, [esi + 0xc]
mov byte [esp + 0x144], 4
call fcn.004289df
mov byte [esp + 0x140], bl
lea ecx, [esp + 0x2c]
call fcn.004288f2
mov ecx, dword [esp + 0x148]
push esi
mov eax, dword [ecx + 8]
push eax
call fcn.00427fd0
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x140], 0xffffffff
call fcn.004288f2
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], 0x100
inc eax
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x20]
push ebx
push ebx
push ebx
lea eax, [esp + 0x30]
push ebx
lea ecx, [esp + 0x48]
push eax
mov eax, dword [esp + 0x2c]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x4012b7
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x138]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x134
ret 4