Function at 0x402f17
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc8
mov dword [ebp - 0xc], 0
call fcn.008b6430
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], str.installed_apps
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.008b6820
mov dword [ebp - 0x98], str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov dword [ebp - 0x94], 0x80000001
mov dword [ebp - 0x90], str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall
mov dword [ebp - 0x8c], 0x80000002
mov dword [ebp - 0x88], str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov dword [ebp - 0x84], 0x80000002
mov dword [ebp - 0x10], 0
jmp 0x4031c9
mov eax, dword [ebp - 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x99096c
mov dword [esp + 4], 0x64
lea eax, [ebp - 0x80]
mov dword [esp], eax
call fcn.00401619
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*8 - 0x98]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*8 - 0x94]
lea ecx, [ebp - 0x9c]
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
jne 0x4031c5
mov dword [ebp - 0xa0], 0x400
mov dword [ebp - 0x14], 0
jmp 0x40315c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*8 - 0x98]
lea edx, [ebp - 0xca8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x99096f
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x8a8]
mov dword [esp], eax
call fcn.00401619
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*8 - 0x94]
lea edx, [ebp - 0xa4]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
lea edx, [ebp - 0x8a8]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call eax
sub esp, 0x14
test eax, eax
jne 0x40314e
mov dword [ebp - 0xa8], 0x400
mov eax, dword [ebp - 0xa4]
lea edx, [ebp - 0xa8]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x4a8]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.DisplayName
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
sub esp, 0x18
test eax, eax
jne 0x40313b
call fcn.008b6700
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x4a8]
mov dword [esp], eax
call fcn.008b6790
mov dword [esp + 8], eax
mov dword [esp + 4], str.app_name
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.008b6820
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call fcn.008b6630
mov dword [esp + 8], eax
mov dword [esp + 4], str.index
mov eax, dword [ebp - 0x1c]
mov dword [esp], eax
call fcn.008b6820
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call fcn.008b4ba0
add dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xa4]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
add dword [ebp - 0x14], 1
mov dword [ebp - 0xa0], 0x400
mov eax, dword [ebp - 0x9c]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
lea edx, [ebp - 0xa0]
mov dword [esp + 0xc], edx
lea edx, [ebp - 0xca8]
mov dword [esp + 8], edx
mov edx, dword [ebp - 0x14]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
call eax
sub esp, 0x20
test eax, eax
je 0x403010
mov eax, dword [ebp - 0x9c]
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
sub esp, 4
add dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 2
jle 0x402f91
nop
nop
leave
ret