Function at 0x401d8a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push edi
mov edi, eax
call fcn.00404143
test eax, eax
je 0x401e31
mov edi, dword [ebp + 0x10]
lea ebx, [esi + 0x111]
push edi
push ebx
call sub.msvcrt.dll_strcpy
lea eax, [esi + 0x211]
push edi
push eax
call sub.msvcrt.dll_strcpy
push dword [ebp + 8]
lea eax, [esi + 0x191]
push eax
call sub.msvcrt.dll_strcpy
push 3
push 0x40b660
push ebx
call sub.msvcrt.dll_strncmp
add esp, 0x24
test eax, eax
jne 0x401df0
add edi, 3
push edi
push ebx
call sub.msvcrt.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp + 0x10]
push eax
mov eax, esi
call fcn.00401bfb
test eax, eax
je 0x401e22
lea eax, [esi + 0x311]
push eax
push 0x40b407
push dword [ebp + 0x10]
push 0x7f
pop eax
call fcn.004096df
add esp, 0xc
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.00401d0d
xor eax, eax
inc eax
jmp 0x402036
push dword [ebp + 8]
lea eax, [esi + 0x191]
push eax
call sub.msvcrt.dll_strcpy
push dword [ebp + 0xc]
lea eax, [esi + 0x211]
push eax
call sub.msvcrt.dll_strcpy
add esp, 0x10
push dword [ebp + 0x10]
xor ebx, ebx
cmp byte [edi], bl
je 0x401e79
lea eax, [esi + 0x291]
push eax
call sub.msvcrt.dll_strcpy
lea eax, [esi + 0x111]
push edi
push eax
call sub.msvcrt.dll_strcpy
add esp, 0x10
jmp 0x401e87
lea eax, [esi + 0x111]
push eax
call sub.msvcrt.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp + 8]
push eax
mov eax, esi
call fcn.00401bfb
test eax, eax
je 0x402034
lea eax, [esi + 0x820]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
lea edi, [esi + 0x311]
push edi
push str.Description
push dword [ebp + 8]
mov eax, 0x1ff
call fcn.004096df
add esp, 0xc
cmp byte [edi], bl
jne 0x401eea
push edi
push str.PackageName
push dword [ebp + 8]
mov eax, 0x1ff
call fcn.004096df
add esp, 0xc
lea eax, [esi + 0x511]
push eax
push str.InstalledBy
push dword [ebp + 8]
push 0x7f
pop edi
mov eax, edi
call fcn.004096df
lea eax, [esi + 0x591]
push eax
push str.Type
push dword [ebp + 8]
mov eax, edi
call fcn.004096df
lea eax, [esi + 0x611]
push eax
push str.UninstallCommand
push dword [ebp + 8]
mov eax, 0x104
call fcn.004096df
push edi
lea eax, [ebp - 0x93]
push ebx
push eax
mov byte [ebp - 0x94], bl
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x94]
push eax
push str.InstalledDate
push dword [ebp + 8]
mov eax, edi
call fcn.004096df
add esp, 0x3c
cmp byte [ebp - 0x94], bl
je 0x401ff3
xor eax, eax
mov word [ebp - 0x14], bx
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x94]
push eax
call sub.msvcrt.dll_atoi
pop ecx
lea edx, [ebp - 0x94]
mov word [ebp - 0x12], ax
call fcn.004043df
mov edi, eax
cmp edi, ebx
jle 0x401ff3
lea eax, [ebp + edi - 0x93]
push eax
call sub.msvcrt.dll_atoi
pop ecx
lea edx, [ebp + edi - 0x93]
mov word [ebp - 0xe], ax
call fcn.004043df
cmp eax, ebx
jle 0x401ff3
add eax, edi
lea eax, [ebp + eax - 0x92]
push eax
call sub.msvcrt.dll_atoi
cmp ax, bx
pop ecx
mov word [ebp - 0x14], ax
jbe 0x401ff3
cmp word [ebp - 0x12], bx
jbe 0x401ff3
cmp word [ebp - 0xe], bx
jbe 0x401ff3
lea eax, [esi + 0x818]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_SystemTimeToFileTime]
push dword [ebp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
lea eax, [ebp + 0x10]
push eax
push esi
call fcn.00401b9d
test eax, eax
je 0x401e22
lea eax, [esi + 0x796]
push eax
push str.DisplayVersion
push dword [ebp + 0x10]
push 0x7f
pop eax
call fcn.004096df
add esp, 0xc
push dword [ebp + 0x10]
call edi
jmp 0x401e22
xor eax, eax
pop edi
pop ebx
leave
ret 0xc