Function at 0x4020f9
Capabilities:
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffefe0
push esi
push edi
cmp dword [0x4160e9], 0
je 0x402122
push dword [0x4160e9]
call fcn.004018f6
mov dword [0x4160e9], 0
cmp dword [0x4160ed], 0
je 0x402140
push dword [0x4160ed]
call fcn.004018f6
mov dword [0x4160ed], 0
lea eax, [ebp - 0x1010]
push eax
call fcn.00401000
lea eax, [ebp - 0x1014]
push eax
call fcn.00401000
lea eax, [ebp - 4]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
or eax, eax
jne 0x4022ce
mov dword [ebp - 0x100c], 0
mov dword [ebp - 0x1008], 0xfff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1008]
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x100c]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
or eax, eax
jne 0x4022c6
push 0x416141
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
call fcn.00401e36
and eax, eax
je 0x4022bb
mov edx, eax
lea eax, [ebp - 0x1004]
push eax
push edx
call fcn.00401e8a
and eax, eax
je 0x4022bb
mov dword [ebp - 0x1020], eax
lea eax, [ebp - 0x1018]
push eax
push str.UninstallString
push dword [ebp - 0x1020]
push 0x80000002
call fcn.00401daf
and eax, eax
je 0x4022b0
cmp eax, 1
jbe 0x4022b0
push eax
push dword [ebp - 0x1018]
push eax
push dword [ebp - 0x1010]
call fcn.004015bc
lea eax, [ebp - 0x1018]
push eax
push str.DisplayName
push dword [ebp - 0x1020]
push 0x80000002
call fcn.00401daf
and eax, eax
je 0x40228b
cmp dword [ebp - 0x1018], 1
jbe 0x40228b
push eax
push eax
lea eax, [ebp - 0x1004]
push eax
call sub.KERNEL32.DLL_lstrlenA
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x1014]
call fcn.004015bc
pop eax
push dword [ebp - 0x1018]
push eax
push dword [ebp - 0x1014]
call fcn.004015bc
call fcn.004018f6
jmp 0x4022ab
lea eax, [ebp - 0x1004]
push eax
call sub.KERNEL32.DLL_lstrlenA
inc eax
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x1014]
call fcn.004015bc
call fcn.004018f6
push dword [ebp - 0x1020]
call fcn.004018f6
inc dword [ebp - 0x100c]
jmp 0x40217d
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
push 0
push dword [ebp - 0x1010]
call fcn.004015a7
push 0
push dword [ebp - 0x1014]
call fcn.004015a7
lea eax, [ebp - 0x101c]
push eax
push dword [ebp - 0x1010]
call sub.ole32.dll_GetHGlobalFromStream
test eax, eax
js 0x402349
push dword [ebp - 0x1010]
call fcn.00401091
mov dword [ebp - 0x1018], eax
push dword [ebp - 0x1018]
call fcn.0040190d
mov dword [0x4160e9], eax
push dword [ebp - 0x101c]
call sub.KERNEL32.DLL_GlobalLock
and eax, eax
je 0x402349
mov ecx, dword [ebp - 0x1018]
mov esi, eax
mov edi, dword [0x4160e9]
rep movsb byte es:[edi], byte [esi]
push dword [ebp - 0x101c]
call sub.KERNEL32.DLL_GlobalUnlock
lea eax, [ebp - 0x101c]
push eax
push dword [ebp - 0x1014]
call sub.ole32.dll_GetHGlobalFromStream
test eax, eax
js 0x4023aa
push dword [ebp - 0x1014]
call fcn.00401091
mov dword [ebp - 0x1018], eax
push dword [ebp - 0x1018]
call fcn.0040190d
mov dword [0x4160ed], eax
push dword [ebp - 0x101c]
call sub.KERNEL32.DLL_GlobalLock
and eax, eax
je 0x4023aa
mov ecx, dword [ebp - 0x1018]
mov esi, eax
mov edi, dword [0x4160ed]
rep movsb byte es:[edi], byte [esi]
push dword [ebp - 0x101c]
call sub.KERNEL32.DLL_GlobalUnlock
push dword [ebp - 0x1010]
call fcn.00401026
push dword [ebp - 0x1014]
call fcn.00401026
pop edi
pop esi
leave
ret