Function at 0x4494a0
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
cmp dword [0x47667c], 0
jne 0x44993b
jmp 0x4494b8
mov cx, word [0x4757c0]
mov dx, cx
xor dx, 0xffff
and dx, 0xe37a
and cx, 0x1c85
or dx, cx
xor dx, 0xd932
mov word [0x4757e0], dx
mov cx, word [0x4757c2]
mov dx, cx
xor dx, 0xffff
and dx, 0xb2b4
and cx, 0x4d4b
or dx, cx
xor dx, 0x13d1
mov word [0x4757e2], dx
mov cx, word [0x4757c4]
xor cx, 0xf499
mov word [0x4757e4], cx
mov dx, word [0x4757c6]
mov cx, dx
xor cx, 0xffff
mov si, dx
xor si, 0xffff
and cx, si
or cx, 0x35fb
xor cx, 0xffff
xor dx, 0xffff
and dx, 0x35fb
or cx, dx
xor cx, 0xffff
mov word [0x4757e6], cx
mov cx, word [0x4757c8]
mov dx, cx
and dx, 0x15d4
shl dx, 1
add cx, 0x15d4
sub cx, dx
mov word [0x4757e8], cx
mov cx, word [0x4757ca]
mov dx, cx
xor dx, 0x195d
xor dx, 0xffff
and dx, 0x195d
shl dx, 1
sub dx, 0x195d
sub cx, dx
mov word [0x4757ea], cx
mov cx, word [0x4757cc]
xor cx, 0xfd3b
mov word [0x4757ec], cx
mov cx, word [0x4757ce]
xor cx, 0x79ed
mov word [0x4757ee], cx
mov cx, word [0x4757d0]
xor cx, 0xb910
mov word [0x4757f0], cx
mov cx, word [0x4757d2]
xor cx, 0x60fb
mov word [0x4757f2], cx
mov cx, word [0x4757d4]
xor cx, 0xb6ea
mov word [0x4757f4], cx
mov cx, word [0x4757d6]
xor cx, 0x2be8
mov word [0x4757f6], cx
mov cx, word [0x4757d8]
mov dx, cx
xor dx, 0xffff
and dx, 0x85d0
and cx, 0x7a2f
or dx, cx
xor dx, 0x589a
mov word [0x4757f8], dx
mov cx, word [0x475800]
mov dx, cx
and dx, 0xf374
shl dx, 1
add cx, 0xf374
sub cx, dx
mov word [0x475820], cx
mov cx, word [0x475802]
mov dx, cx
xor dx, 0x279b
mov si, dx
xor si, 0xffff
xor si, 0xffff
and si, 0xffff
shl si, 1
sub si, 0xffff
sub dx, si
or dx, dx
xor dx, 0xffff
xor dx, 0xffff
and dx, 0x279b
shl dx, 1
sub dx, 0x279b
add cx, 0x6124
sub cx, dx
sub cx, 0x6124
mov word [0x475822], cx
mov cx, word [0x475804]
mov si, cx
xor si, 0xffff
and si, 0xbbfb
mov dx, cx
and dx, 0x4404
or si, dx
xor si, 0x4404
mov dx, cx
xor dx, 0xffff
or si, si
xor si, 0xffff
mov di, dx
xor di, 0xffff
xor dx, 0xffff
and di, dx
xor si, 0xffff
xor di, 0xffff
and si, di
mov dx, si
xor dx, 0xffff
and dx, 0x6238
and si, 0x9dc7
or dx, si
xor dx, 0x9dc7
or dx, dx
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xeb29
mov si, cx
and si, 0x14d6
mov di, cx
xor di, 0xeb29
add cx, di
sub cx, si
xor cx, 0xffff
mov si, dx
xor si, 0xffff
xor si, 0xffff
and si, 0xffff
shl si, 1
sub si, 0xffff
sub dx, si
mov si, cx
and si, 0xffff
shl si, 1
add cx, 0xffff
sub cx, si
and dx, cx
mov word [0x475824], dx
mov cx, word [0x475806]
mov dx, cx
xor dx, 0xffff
and dx, 0x94de
mov si, cx
xor si, 0x6b21
xor si, 0xffff
or cx, 0x6b21
and cx, si
or dx, cx
mov word [0x475826], dx
mov dx, word [0x475808]
mov cx, dx
xor cx, 0xffff
mov si, dx
xor si, 0xffff
and cx, si
or cx, 0
xor cx, 0xffff
or cx, 0
xor cx, 0xffff
and cx, 0x277c
and dx, 0xd883
mov si, dx
and si, cx
xor si, 0xffff
add cx, dx
add cx, 1
add cx, si
xor cx, 0x4a12
mov word [0x475828], cx
mov cx, word [0x47580a]
xor cx, 0x25e1
mov word [0x47582a], cx
mov cx, word [0x47580c]
xor cx, 0xb2c3
mov word [0x47582c], cx
mov cx, word [0x47580e]
mov dx, cx
xor dx, 0x9751
xor dx, 0xffff
and dx, 0x9751
shl dx, 1
sub dx, 0x9751
sub cx, dx
mov word [0x47582e], cx
mov dx, word [0x475810]
mov si, dx
xor si, 0xffff
mov di, dx
xor di, 0xffff
and di, 0x2dd0
mov cx, dx
and cx, 0xd22f
or di, cx
xor di, 0xd22f
mov cx, si
and cx, di
xor si, di
or cx, si
xor cx, 0xffff
or cx, 0x5e05
and dx, 0x5e05
mov si, dx
xor si, 0xffff
and si, 0x8b9f
and dx, 0x7460
or si, dx
xor si, 0x7460
or cx, cx
xor cx, 0xffff
or cx, 0
xor cx, 0xffff
or cx, 0
xor cx, 0xffff
xor si, 0xffff
or cx, si
mov word [0x475830], cx
mov cx, word [0x475812]
mov dx, cx
xor dx, 0xffff
and dx, 0xeaed
and cx, 0x1512
or dx, cx
xor dx, 0x4a6
mov word [0x475832], dx
mov cx, word [0x475814]
xor cx, 0xe90
mov word [0x475834], cx
mov cx, word [0x475816]
mov dx, cx
xor dx, 0xffff
or dx, 0x2674
add dx, 0xd98c
mov si, cx
add si, 1
xor cx, 0xffff
or cx, 0x2674
add cx, si
or dx, cx
mov word [0x475836], dx
jmp 0x44993b
jmp 0x44993d
mov dword [0x47667c], 1
push eax
mov dword [ebp - 0x1c], esp
push eax
mov ebx, esp
push eax
mov dword [ebp - 0x18], esp
push eax
mov dword [ebp - 0x10], esp
sub esp, 0x800
mov dword [ebp - 0x2c], esp
push eax
sub esp, 0x7fc
mov dword [ebp - 0x48], esp
sub esp, 0x800
mov dword [ebp - 0x44], esp
push eax
mov eax, esp
push eax
mov dword [ebp - 0x28], esp
push eax
mov edx, esp
push eax
mov ecx, esp
push eax
mov esi, esp
push eax
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 0x20], esp
sub esp, 0x18
mov dword [ebp - 0x3c], esp
push eax
mov dword [ebp - 0x4c], esp
sub esp, 0x1c
mov dword [ebp - 0x38], esp
mov dword [ebp - 0x50], ebx
mov edi, dword [ebp + 8]
mov dword [ebx], edi
mov edi, dword [ebp - 0x18]
mov dword [edi], 0
mov edi, dword [ebp - 0x28]
mov ebx, eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
lea eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov dword [ebx], eax
mov dword [edi], 0
mov dword [ebp - 0x40], edx
mov dword [edx], 0xf003f
mov dword [ebp - 0x34], ecx
mov dword [ecx], 0
sub esp, 8
mov dword [esp], 0xc800
mov dword [esp + 4], 2
call fcn.004551e7
add esp, 8
mov dword [esi], eax
mov dword [ebp - 0x30], esi
cmp dword [esi], 0
sete al
test al, 1
jne 0x449a04
jmp 0x449a1b
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], 1
jmp 0x449d0a
mov eax, dword [ebx]
mov ecx, 0x80000002
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x20019
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 0
je 0x449a67
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], 1
jmp 0x449d0a
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
mov ecx, dword [ebp - 0x2c]
jmp 0x449a75
cmp dword [edi], 0
sete al
test al, 1
jne 0x449a92
jmp 0x449a81
mov eax, dword [ebp - 0x14]
mov dword [eax], 2
mov edi, dword [ebp - 0x1c]
jmp 0x449c52
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x34]
mov dword [ebx], 0x800
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
mov eax, ecx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x20
mov dword [esp], ecx
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x24]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [edi], eax
cmp eax, 0
jne 0x449c38
mov eax, dword [ebx]
lea ecx, str._s_s
sub esp, 0x10
mov edi, dword [ebp - 0x48]
mov dword [esp], edi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, 0x80000002
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x20019
mov esi, dword [ebp - 0x10]
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 0
je 0x449b89
jmp 0x449b50
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x18]
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], 1
jmp 0x449c52
mov edi, dword [ebp - 0x34]
mov dword [edi], 0x800
lea eax, [0x475820]
sub esp, 0xc
mov ebx, dword [ebp - 0x3c]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
call fcn.0044fc30
add esp, 0xc
mov eax, dword [esi]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x40]
mov dword [esp + 0xc], eax
mov ebx, dword [ebp - 0x44]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0
jne 0x449c1b
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx]
mov ecx, dword [ecx]
lea edx, str._s_s_n
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
jmp 0x449c2a
jmp 0x449c1d
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x24]
jmp 0x449c25
mov edi, dword [ebp - 0x28]
jmp 0x449c2a
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x449c3a
jmp 0x449c3c
jmp 0x449c3e
jmp 0x449c40
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
sub eax, 0xffffffff
mov dword [ecx], eax
mov ecx, dword [ebp - 0x2c]
jmp 0x449a73
cmp dword [eax], 2
jne 0x449d0a
mov esi, dword [ebp - 0x30]
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.0042f360
add esp, 4
mov ebx, dword [ebp - 0x4c]
mov dword [ebx], eax
lea eax, [0x4757e0]
sub esp, 0xc
mov ecx, dword [ebp - 0x38]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1a
call fcn.0044fc30
add esp, 0xc
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00455be0
add esp, 4
mov ecx, dword [ebx]
mov edx, dword [ebp - 0x50]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov edx, dword [ebp - 0x38]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.0042f570
add esp, 0x10
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455635
add esp, 4
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00455635
add esp, 4
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi], 1
mov eax, dword [ebp - 0x14]
mov dword [eax], 1
mov eax, dword [edi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret