Function at 0x445f87
Capabilities:
Enumerate gui resources
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
push ebx
mov edx, 0xe
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x445f8e
call fcn.005423e0
push dword [esp + 0x4c]
call fcn.004fa4e0
cmp byte [esp + 0x48], 0
je 0x44624a
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
call fcn.0051d880
call fcn.004fa482
add dword [esp], edx
call fcn.00522f23
lea ebp, [0x72ab78]
mov edx, dword [ebp + 8]
push edx
call fcn.00542310
mov edx, 0x62cf68
push edx
call fcn.00542310
lea eax, [esp + 0x30]
push eax
call fcn.00542280
push dword [esp + 0x2c]
push 0xffffffff
call fcn.00523e70
mov dword [esp], eax
cmp dword [esp], 0
je 0x44609c
push dword [esp]
call fcn.00523f30
mov dword [esp + 0x34], eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, 0x6203ec
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x50]
push dword [esp + 0x20]
call fcn.005240a0
call fcn.004fa482
add dword [esp], edx
call fcn.0053fb20
call fcn.004fa482
add dword [esp], edx
call fcn.0053fc10
lea eax, [esp + 0x34]
push eax
call fcn.00542280
push dword [esp]
call fcn.00523a00
lea ebp, [0x72ab78]
mov ebx, dword [ebp + 0x34]
cmp ebx, 0xd
je 0x4460ba
lea ebp, [0x72ab78]
mov ebx, dword [ebp + 0x38]
cmp ebx, 0x10
je 0x4460ba
jmp 0x4460c1
mov eax, 1
jmp 0x4460c3
xor eax, eax
and eax, eax
jne 0x4460d7
lea ebp, [0x72ab78]
mov ebx, dword [ebp + 0x34]
cmp ebx, 0xc
je 0x4460d7
jmp 0x4460de
mov eax, 1
jmp 0x4460e0
xor eax, eax
and eax, eax
je 0x446129
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
lea ebp, [0x72ab78]
push dword [ebp]
call fcn.0053f5c0
call fcn.004fa482
add dword [esp], edx
call fcn.004c9fbe
lea ebp, [0x72a988]
lea eax, [ebp + 0x9c]
push eax
call fcn.00542280
lea ebp, [0x72a860]
mov dword [ebp + 0x88], 0
lea ebp, [0x72ab78]
mov ebx, dword [ebp + 0x34]
cmp ebx, 0xb
je 0x446158
push 0
lea eax, [0x4615ce]
push eax
call sub.USER32.dll_EnumWindows
lea ebp, [0x72ab78]
mov ebx, dword [ebp + 0x34]
cmp ebx, 0xb
je 0x446175
mov ebx, dword [ebp + 0x34]
cmp ebx, 0xe
je 0x446175
mov eax, 1
jmp 0x446177
xor eax, eax
and eax, eax
je 0x446211
lea ebp, [0x72a988]
mov edx, dword [ebp + 0x9c]
xor ecx, ecx
call fcn.004fa4a0
jne 0x4461ad
push dword [esp + 0x30]
mov edx, dword [ebp + 0x9c]
pop ecx
call fcn.004fa4a0
jne 0x4461ad
mov eax, 1
jmp 0x4461af
xor eax, eax
and eax, eax
je 0x446211
lea ebp, [0x72a988]
mov edx, dword [ebp + 0x9c]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
lea eax, [esp + 0x34]
push eax
call fcn.00542280
push dword [esp + 0x2c]
call fcn.00482484
mov dword [esp], eax
cmp dword [esp], 0
je 0x446211
push 2
push dword [esp + 4]
call fcn.00524270
push 2
push dword [esp + 0x34]
push dword [esp + 8]
call fcn.005244d0
push dword [esp]
call fcn.00523a00
cmp byte [esp + 0x44], 0
je 0x446245
mov edx, dword [esp + 0x30]
xor ecx, ecx
call fcn.004fa4a0
jne 0x446245
lea ebp, [0x72ad90]
cmp dword [ebp + 0x24], 0
je 0x446245
push 0
push 0x7d
push 0
call fcn.0051f5f9
jmp 0x44653f
lea ebp, [0x72ab78]
cmp dword [ebp + 0x6c], 0
jne 0x446265
lea ebp, [0x72ab78]
mov ebx, dword [ebp + 0x34]
and ebx, ebx
je 0x446265
jmp 0x44626c
mov eax, 1
jmp 0x44626e
xor eax, eax
and eax, eax
je 0x44653f
push 0x8000
call fcn.005410b0
mov dword [esp + 0xc], eax
push 0x8000
call fcn.005410b0
mov dword [esp + 0x14], eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call sub.ADVAPI32.dll_RegOpenKeyExW
mov ebx, eax
and ebx, ebx
jne 0x44652d
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ebx, dword [esp + 0x24]
and ebx, ebx
jne 0x446524
mov dword [esp + 8], 0x8000
push 0
push dword [esp + 0x10]
pop eax
call fcn.004fa410
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x20]
push dword [esp + 0x38]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegEnumKeyExW
mov dword [esp + 0x24], eax
mov ebx, dword [esp + 0x24]
and ebx, ebx
jne 0x446516
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x14]
call fcn.005410d0
lea eax, [esp + 0x2c]
push eax
call fcn.00542280
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x30]
call fcn.0053fc10
call fcn.004fa4f0
cmp word [eax], 0
je 0x446516
push edx
call fcn.00542240
pop edx
push eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push edx
call fcn.00542240
pop edx
push eax
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push edx
call fcn.00542310
mov edx, dword [esp + 0x3c]
push edx
call fcn.00542310
call fcn.00542370
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004fa482
add dword [esp + 4], edx
call sub.ADVAPI32.dll_RegOpenKeyExW
call fcn.004fa4e0
mov ebx, eax
and ebx, ebx
jne 0x446516
push edx
call fcn.00542240
pop edx
push eax
push 0x8000
push dword [esp + 0x1c]
mov eax, str.DisplayIcon
push eax
push dword [esp + 0x20]
call fcn.004e42e4
lea eax, [esp + 0x34]
push eax
call fcn.00542280
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x30]
xor ecx, ecx
call fcn.004fa4a0
jne 0x446516
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov edx, 0x622674
push edx
call fcn.00542310
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
lea ebp, [0x72ab78]
push dword [ebp]
call fcn.0053f5c0
pop eax
call fcn.00542370
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x40]
call fcn.0053f5c0
call fcn.004fa482
add dword [esp], edx
call fcn.004fa482
add dword [esp + 4], edx
call fcn.0053f8e0
call fcn.004fa4e0
and eax, eax
je 0x446516
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, 0x6203ec
push eax
push dword [esp + 0x3c]
call fcn.0053fb20
lea eax, [esp + 0x34]
push eax
call fcn.00542280
mov eax, 0x6208c0
push eax
push dword [esp + 0x34]
call fcn.0053f8e0
and eax, eax
je 0x446514
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, 0x6208c0
push eax
push 1
push dword [esp + 0x48]
call fcn.0053f490
call fcn.004fa482
add dword [esp], edx
call fcn.0053fc10
lea eax, [esp + 0x34]
push eax
call fcn.00542280
jmp 0x446524
mov ebx, dword [esp + 0x20]
inc ebx
mov dword [esp + 0x20], ebx
jmp 0x4462cb
push dword [esp + 4]
call sub.ADVAPI32.dll_RegCloseKey
push dword [esp + 0xc]
call fcn.00541120
push dword [esp + 0x14]
call fcn.00541120
mov edx, dword [esp + 0x30]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
pop eax
push eax
call fcn.004fa470
pop edx
add eax, edx
jmp 0x446567
push dword [esp + 0x2c]
call fcn.00542440
push dword [esp + 0x30]
call fcn.00542440
push dword [esp + 0x28]
call fcn.00542440
add esp, 0x38
pop ebx
pop ebp
ret 8