Function at 0x4099f0
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41d92b
mov eax, dword fs:[0]
push eax
mov eax, 0x342c
call fcn.00414f30
mov eax, dword [0x429460]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x3434], 0
mov dword [ebp - 0x341c], 0xf
mov dword [ebp - 0x3420], 0
mov byte [ebp - 0x3430], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x3414], 0x400
call fcn.0040b4f0
lea eax, [ebp - 0x3434]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x409c0a
xor esi, esi
mov dword [ebp - 0x3418], 0x400
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x3414]
mov dword [ebp - 0x3414], 0x400
push eax
lea eax, [ebp - 0x410]
push eax
push esi
push dword [ebp - 0x3434]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x409c02
jmp 0x409ad0
lea eax, [ebp - 0x3438]
mov dword [ebp - 0x3418], 0x400
push eax
push 0x20119
push 0
lea eax, [ebp - 0x410]
mov dword [ebp - 0x3414], 0x400
push eax
push dword [ebp - 0x3434]
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409bc3
lea eax, [ebp - 0x3418]
mov dword [ebp - 0x3418], 0x1000
push eax
lea eax, [ebp - 0x3410]
push eax
push 0
push 0
push str.DisplayName
push dword [ebp - 0x3438]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409bc3
push eax
push eax
push 0x1000
lea eax, [ebp - 0x1410]
push eax
push 0x1000
lea eax, [ebp - 0x3410]
push eax
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [ebp - 0x1410], 0
jne 0x409b77
xor ecx, ecx
jmp 0x409b89
lea ecx, [ebp - 0x1410]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409b80
sub ecx, edx
push ecx
lea eax, [ebp - 0x1410]
push eax
lea ecx, [ebp - 0x3430]
call fcn.00401a60
lea edx, [ebp - 0x3430]
mov ecx, edi
call fcn.00409680
test al, al
jne 0x409bbb
lea eax, [ebp - 0x3430]
mov ecx, edi
push eax
call fcn.0040b420
push dword [ebp - 0x3438]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x3414]
mov dword [ebp - 0x3418], 0x400
push eax
lea eax, [ebp - 0x410]
mov dword [ebp - 0x3414], 0x400
push eax
push esi
push dword [ebp - 0x3434]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x409ad0
push dword [ebp - 0x3434]
call ebx
lea eax, [ebp - 0x3434]
push eax
push 0x20119
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409daa
xor esi, esi
mov dword [ebp - 0x3418], 0x400
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x3414]
mov dword [ebp - 0x3414], 0x400
push eax
lea eax, [ebp - 0x410]
push eax
push esi
push dword [ebp - 0x3434]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x409da2
lea ecx, [ecx]
lea eax, [ebp - 0x3438]
mov dword [ebp - 0x3418], 0x400
push eax
push 0x20119
push 0
lea eax, [ebp - 0x410]
mov dword [ebp - 0x3414], 0x400
push eax
push dword [ebp - 0x3434]
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409d63
lea eax, [ebp - 0x3418]
mov dword [ebp - 0x3418], 0x1000
push eax
lea eax, [ebp - 0x3410]
push eax
push 0
push 0
push str.DisplayName
push dword [ebp - 0x3438]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409d63
push eax
push eax
push 0x1000
lea eax, [ebp - 0x1410]
push eax
push 0x1000
lea eax, [ebp - 0x3410]
push eax
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [ebp - 0x1410], 0
jne 0x409d17
xor ecx, ecx
jmp 0x409d29
lea ecx, [ebp - 0x1410]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409d20
sub ecx, edx
push ecx
lea eax, [ebp - 0x1410]
push eax
lea ecx, [ebp - 0x3430]
call fcn.00401a60
lea edx, [ebp - 0x3430]
mov ecx, edi
call fcn.00409680
test al, al
jne 0x409d5b
lea eax, [ebp - 0x3430]
mov ecx, edi
push eax
call fcn.0040b420
push dword [ebp - 0x3438]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x3414]
mov dword [ebp - 0x3418], 0x400
push eax
lea eax, [ebp - 0x410]
mov dword [ebp - 0x3414], 0x400
push eax
push esi
push dword [ebp - 0x3434]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x409c70
push dword [ebp - 0x3434]
call ebx
lea eax, [ebp - 0x3434]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409f4a
xor esi, esi
mov dword [ebp - 0x3418], 0x400
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x3414]
mov dword [ebp - 0x3414], 0x400
push eax
lea eax, [ebp - 0x410]
push eax
push esi
push dword [ebp - 0x3434]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x409f42
lea ecx, [ecx]
lea eax, [ebp - 0x3438]
mov dword [ebp - 0x3418], 0x400
push eax
push 0x20219
push 0
lea eax, [ebp - 0x410]
mov dword [ebp - 0x3414], 0x400
push eax
push dword [ebp - 0x3434]
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409f03
lea eax, [ebp - 0x3418]
mov dword [ebp - 0x3418], 0x1000
push eax
lea eax, [ebp - 0x3410]
push eax
push 0
push 0
push str.DisplayName
push dword [ebp - 0x3438]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x409f03
push eax
push eax
push 0x1000
lea eax, [ebp - 0x1410]
push eax
push 0x1000
lea eax, [ebp - 0x3410]
push eax
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [ebp - 0x1410], 0
jne 0x409eb7
xor ecx, ecx
jmp 0x409ec9
lea ecx, [ebp - 0x1410]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x409ec0
sub ecx, edx
push ecx
lea eax, [ebp - 0x1410]
push eax
lea ecx, [ebp - 0x3430]
call fcn.00401a60
lea edx, [ebp - 0x3430]
mov ecx, edi
call fcn.00409680
test al, al
jne 0x409efb
lea eax, [ebp - 0x3430]
mov ecx, edi
push eax
call fcn.0040b420
push dword [ebp - 0x3438]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x3414]
mov dword [ebp - 0x3418], 0x400
push eax
lea eax, [ebp - 0x410]
mov dword [ebp - 0x3414], 0x400
push eax
push esi
push dword [ebp - 0x3434]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x409e10
push dword [ebp - 0x3434]
call ebx
lea eax, [ebp - 0x3434]
push eax
push 0x20219
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a0ea
xor esi, esi
mov dword [ebp - 0x3418], 0x400
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x3414]
mov dword [ebp - 0x3414], 0x400
push eax
lea eax, [ebp - 0x410]
push eax
push esi
push dword [ebp - 0x3434]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40a0e2
lea ecx, [ecx]
lea eax, [ebp - 0x3438]
mov dword [ebp - 0x3418], 0x400
push eax
push 0x20219
push 0
lea eax, [ebp - 0x410]
mov dword [ebp - 0x3414], 0x400
push eax
push dword [ebp - 0x3434]
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a0a3
lea eax, [ebp - 0x3418]
mov dword [ebp - 0x3418], 0x1000
push eax
lea eax, [ebp - 0x3410]
push eax
push 0
push 0
push str.DisplayName
push dword [ebp - 0x3438]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40a0a3
push eax
push eax
push 0x1000
lea eax, [ebp - 0x1410]
push eax
push 0x1000
lea eax, [ebp - 0x3410]
push eax
push 0x200
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp byte [ebp - 0x1410], 0
jne 0x40a057
xor ecx, ecx
jmp 0x40a069
lea ecx, [ebp - 0x1410]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40a060
sub ecx, edx
push ecx
lea eax, [ebp - 0x1410]
push eax
lea ecx, [ebp - 0x3430]
call fcn.00401a60
lea edx, [ebp - 0x3430]
mov ecx, edi
call fcn.00409680
test al, al
jne 0x40a09b
lea eax, [ebp - 0x3430]
mov ecx, edi
push eax
call fcn.0040b420
push dword [ebp - 0x3438]
call ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x3414]
mov dword [ebp - 0x3418], 0x400
push eax
lea eax, [ebp - 0x410]
mov dword [ebp - 0x3414], 0x400
push eax
push esi
push dword [ebp - 0x3434]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x409fb0
push dword [ebp - 0x3434]
call ebx
cmp dword [ebp - 0x341c], 0x10
jb 0x40a101
push dword [ebp - 0x3430]
call fcn.0040dff7
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040dfe8
mov esp, ebp
pop ebp
ret