Function at 0x401180
Capabilities:
Get installed programs
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4808e0
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x4a26b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
xor ebx, ebx
mov dword [ebp - 0x68], esi
cmp eax, ebx
je 0x4011c1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], ebx
push esi
push 0x492d38
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x4011e7
push esi
push 0x492d38
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x60], 0x4a8ed4
mov dword [ebp - 0x64], 6
mov ecx, dword [ebp - 0x60]
push 0xffffffffffffffff
add ecx, 8
push ebx
xor eax, eax
push ecx
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], ax
call fcn.004015e0
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0x3c]
mov edx, esi
cmp esi, 0xc
jb 0x401229
mov edx, 0xc
mov ecx, dword [ebp - 0x4c]
mov edi, 8
cmp dword [ebp - 0x38], edi
jae 0x401239
lea ecx, [ebp - 0x4c]
mov eax, 0x492e10
cmp edx, ebx
jbe 0x401258
mov di, word [ecx]
cmp di, word [eax]
jne 0x401262
add ecx, 2
add eax, 2
dec edx
jne 0x401242
mov edi, 8
cmp esi, 0xc
jae 0x401273
or eax, 0xffffffff
jmp 0x40127b
sbb eax, eax
and eax, 0xfffffffe
inc eax
cmp eax, ebx
je 0x401253
mov edi, 8
jmp 0x40127b
xor eax, eax
cmp esi, 0xc
setne al
cmp eax, ebx
sete al
cmp al, bl
je 0x4012fd
push 0x7e
lea esi, [ebp - 0x2c]
call fcn.00410c60
add esp, 4
mov esi, eax
lea eax, [ebp - 0x4c]
cmp eax, esi
je 0x4012ef
cmp dword [ebp - 0x38], edi
jb 0x4012ab
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.0041bd41
add esp, 4
xor edx, edx
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], dx
cmp dword [esi + 0x14], edi
jae 0x4012d6
mov eax, dword [esi + 0x10]
inc eax
add eax, eax
push eax
lea ecx, [ebp - 0x4c]
push esi
push ecx
call fcn.0041b9e0
add esp, 0xc
jmp 0x4012dd
mov edx, dword [esi]
mov dword [ebp - 0x4c], edx
mov dword [esi], ebx
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x3c], eax
mov ecx, dword [esi + 0x14]
mov dword [ebp - 0x38], ecx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], edi
jb 0x401340
mov edx, dword [ebp - 0x2c]
push edx
jmp 0x401338
push 7
push 0x492e2c
push esi
push ebx
lea ecx, [ebp - 0x4c]
call fcn.00401b80
test eax, eax
jne 0x401340
push 0x7f
lea esi, [ebp - 0x2c]
call fcn.00410c60
add esp, 4
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00401560
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], edi
jb 0x401340
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0041bd41
add esp, 4
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x2c]
call fcn.0040a8b0
add esp, 4
mov esi, eax
lea edx, [ebp - 0x4c]
cmp edx, esi
je 0x4013ae
cmp dword [ebp - 0x38], edi
jb 0x401369
mov eax, dword [ebp - 0x4c]
push eax
call fcn.0041bd41
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x3c], ebx
mov word [ebp - 0x4c], cx
cmp dword [esi + 0x14], edi
jae 0x401395
mov eax, dword [esi + 0x10]
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x4c]
push esi
push eax
call fcn.0041b9e0
add esp, 0xc
jmp 0x40139c
mov ecx, dword [esi]
mov dword [ebp - 0x4c], ecx
mov dword [esi], ebx
mov edx, dword [esi + 0x10]
mov dword [ebp - 0x3c], edx
mov eax, dword [esi + 0x14]
mov dword [ebp - 0x38], eax
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0x18], edi
jb 0x4013c2
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0041bd41
add esp, 4
mov eax, dword [ebp - 0x60]
mov esi, dword [eax - 4]
mov edx, esi
cmp esi, 0xb
jb 0x4013d4
mov edx, 0xb
cmp dword [eax], edi
lea edi, [eax - 0x14]
jb 0x4013df
mov ecx, dword [edi]
jmp 0x4013e1
mov ecx, edi
mov eax, str.InstallDate
cmp edx, ebx
jbe 0x401411
lea ebx, [ebx]
mov bx, word [ecx]
cmp bx, word [eax]
jne 0x401405
add ecx, 2
add eax, 2
dec edx
jne 0x4013f0
xor ebx, ebx
jmp 0x401411
sbb eax, eax
and eax, 0xfffffffe
inc eax
xor ebx, ebx
cmp eax, ebx
jne 0x401425
cmp esi, 0xb
jae 0x40141b
or eax, 0xffffffff
jmp 0x401423
xor eax, eax
cmp esi, 0xb
setne al
cmp eax, ebx
sete al
cmp al, bl
je 0x4014a1
xor eax, eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x56]
movzx edx, word [ebp - 0x5a]
xor eax, eax
push ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
movzx eax, word [ebp - 0x5c]
push edx
push eax
lea ecx, [ebp - 0x30]
push str._d_.2d_.2d
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x30]
add esp, 0x14
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x401485
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x30]
push edx
lea ecx, [ebp - 0x4c]
call fcn.00401740
cmp dword [ebp - 0x38], 8
mov ecx, dword [ebp - 0x4c]
jae 0x4014ad
lea ecx, [ebp - 0x4c]
mov esi, dword [ebp - 0x60]
cmp dword [esi], 8
jb 0x4014b9
mov eax, dword [edi]
jmp 0x4014bb
mov eax, edi
mov edx, dword [ebp - 0x3c]
add edx, edx
push edx
push ecx
push 1
push ebx
push eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4014ea
cmp dword [esi], 8
jb 0x4014dd
mov edi, dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.00404c90
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x38], 8
jb 0x401503
mov edx, dword [ebp - 0x4c]
push edx
call fcn.0041bd41
add esp, 4
add dword [ebp - 0x60], 0x38
dec dword [ebp - 0x64]
jne 0x4011f5
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041b847
mov esp, ebp
pop ebp
ret