Function at 0x44a6a0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Link many functions at runtime
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ccb42
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x6f0
mov eax, dword [0x505034]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x700], 0
movups xmmword [ebp - 0x6c8], xmm0
mov dword [ebp - 0x6b0], 0
movq qword [ebp - 0x6b8], xmm0
mov dword [ebp - 4], 0
xor eax, eax
mov dword [ebp - 0x6b8], 0
mov dword [ebp - 0x6b4], 0
mov dword [ebp - 0x6b8], 0
mov dword [ebp - 0x6b4], 7
mov word [ebp - 0x6c8], ax
mov dword [ebp - 4], 1
mov dword [ebp - 0x6b0], eax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x6dc]
cmp dword [0x50bae4], 0xf
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 0x6dc], eax
setge byte [ebp - 0x664]
cmp word [0x50ba8c], 0
mov dword [ebp - 0x6e0], eax
mov dword [ebp - 0x6e4], eax
setne byte [ebp - 0x6e9]
mov dword [ebp - 0x6e8], eax
mov eax, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x680], eax
lea eax, [ebp - 0x6dc]
mov dword [ebp - 0x67c], eax
mov dword [ebp - 0x6a0], ecx
lea ecx, [ebp - 0x6e0]
mov eax, ecx
mov dword [ebp - 0x6a8], 0x4eb8b8
mov dword [ebp - 0x678], eax
mov eax, dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x65c], eax
lea eax, [ebp - 0x6e4]
mov dword [ebp - 0x658], eax
lea eax, [ebp - 0x6e8]
push 0xfa0
push 0x50b5cc
mov dword [ebp - 0x69c], ecx
mov dword [ebp - 0x698], str.user32.dll
mov dword [ebp - 0x694], 0x44a160
mov dword [ebp - 0x690], str.kernel32.dll
mov dword [ebp - 0x68c], str.api_ms_win_core_libraryloader_.dll
mov byte [ebp - 0x688], 1
mov dword [ebp - 0x684], 0x4eb8b8
mov dword [ebp - 0x674], str.ws2_32.dll
mov dword [ebp - 0x670], 0x449fc0
mov dword [ebp - 0x66c], str.kernel32.dll
mov dword [ebp - 0x668], str.api_ms_win_core_libraryloader_.dll
mov dword [ebp - 0x660], 0x4eb92c
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x650], str.shell32.dll
mov dword [ebp - 0x64c], 0x44a380
mov dword [ebp - 0x648], 0x4eb958
mov dword [ebp - 0x644], str.api_ms_win_core_com_.dll
mov byte [ebp - 0x640], 1
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor eax, eax
mov word [ebp - 0x20], ax
mov word [ebp - 0x228], ax
lea eax, [ebp - 0x228]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x44b1e6
lea eax, [ebp - 0x228]
push eax
call fcn.004a56ea
add esp, 4
push 0x4e64d4
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x44a910
push 0x4eb980
push esi
call edi
test eax, eax
je 0x44a902
push 0x4e5e14
call eax
push 0x4eb8b8
push esi
call edi
mov dword [ebp - 0x6dc], eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.kernelbase.dll
call esi
test eax, eax
je 0x44a92f
push 0x4eb8b8
push eax
call edi
mov dword [ebp - 0x6e0], eax
push str.ole32.dll
call esi
test eax, eax
je 0x44a948
push 0x4eb92c
push eax
call edi
mov dword [ebp - 0x6e4], eax
push str.combase.dll
call esi
test eax, eax
je 0x44a961
push 0x4eb92c
push eax
call edi
mov dword [ebp - 0x6e8], eax
lea ecx, [ebp - 0x228]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44a970
sub ecx, edx
lea eax, [ebp - 0x228]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6c8]
call fcn.00415170
push 6
push str..DLL
lea ecx, [ebp - 0x6c8]
call fcn.00414dc0
cmp dword [0x50b704], 0x71c71c7
mov eax, dword [0x50b700]
mov dword [ebp - 0x6f0], eax
je 0x44b21c
mov dword [ebp - 0x6fc], 0x50b700
mov dword [ebp - 0x6f8], 0
mov byte [ebp - 4], 3
push 0x24
mov dword [ebp - 0x6f8], 0
call fcn.00479ea3
mov edi, eax
add esp, 4
lea eax, [ebp - 0x6c8]
mov dword [ebp - 0x6f8], edi
lea esi, [edi + 8]
push eax
mov ecx, esi
mov dword [ebp - 0x6cc], esi
call fcn.00417d60
mov byte [ebp - 4], 4
mov dword [esi + 0x18], 0
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x6f0]
inc dword [0x50b704]
mov dword [ebp - 0x6f8], 0
mov eax, dword [ecx + 4]
mov dword [edi], ecx
mov dword [edi + 4], eax
mov dword [ecx + 4], edi
mov dword [eax], edi
mov byte [ebp - 4], 2
lea eax, [ebp - 0x6c8]
push eax
mov ecx, 0x50b708
call fcn.0044b280
lea ecx, [ebp - 0x228]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44aa60
sub ecx, edx
lea eax, [ebp - 0x228]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6c8]
call fcn.00415170
push 0xa
push str.IMM32.DLL
lea ecx, [ebp - 0x6c8]
call fcn.00414dc0
lea eax, [ebp - 0x6c8]
mov ecx, 0x50b6f8
push eax
call fcn.0044b280
lea ecx, [ebp - 0x228]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44aab0
sub ecx, edx
lea eax, [ebp - 0x228]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6c8]
call fcn.00415170
push 0xc
push str.UXTHEME.DLL
lea ecx, [ebp - 0x6c8]
call fcn.00414dc0
lea eax, [ebp - 0x6c8]
push eax
call fcn.0044b390
lea ecx, [ebp - 0x228]
lea edx, [ecx + 2]
mov byte [eax], 1
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44ab00
sub ecx, edx
lea eax, [ebp - 0x228]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6c8]
call fcn.00415170
push 0xa
push str.MSCTF.DLL
lea ecx, [ebp - 0x6c8]
call fcn.00414dc0
lea eax, [ebp - 0x6c8]
push eax
call fcn.0044b390
lea ecx, [ebp - 0x6d8]
xor esi, esi
push ecx
mov byte [eax], 1
movzx eax, byte [ebp - 0x6e9]
shl eax, 8
add eax, 0x20019
push eax
push esi
push str.SOFTWAREFreedom_ScientificJAWS
push 0x80000002
mov dword [ebp - 0x6f0], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x44ae2b
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x6d4], esi
nop dword [eax]
push 0
push 0
push 0
push 0
xor eax, eax
mov dword [ebp - 0x6ac], 0x100
lea ecx, [ebp - 0x6ac]
mov word [ebp - 0x43a], ax
push ecx
lea ecx, [ebp - 0x638]
mov word [ebp - 0x638], ax
mov eax, esi
inc esi
push ecx
push eax
push dword [ebp - 0x6d8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x44ae25
lea eax, [ebp - 0x6d4]
push eax
push dword [ebp - 0x6f0]
lea eax, [ebp - 0x638]
push 0
push eax
push dword [ebp - 0x6d8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44ae16
mov word [ebp - 0x230], ax
mov word [ebp - 0x438], ax
lea eax, [ebp - 0x6ac]
push eax
lea eax, [ebp - 0x438]
mov dword [ebp - 0x6ac], 0x208
push eax
push 0
push 0
push str.Target
push dword [ebp - 0x6d4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44ae05
lea eax, [ebp - 0x438]
push eax
call fcn.004a56ea
lea ecx, [ebp - 0x438]
add esp, 4
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44ac60
sub ecx, edx
lea eax, [ebp - 0x438]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6c8]
call fcn.00415170
push ecx
push str.JHOOK.DLL
lea ecx, [ebp - 0x6c8]
call fcn.00452d30
cmp dword [ebp - 0x6b4], 8
lea eax, [ebp - 0x6c8]
cmovae eax, dword [ebp - 0x6c8]
push eax
call edi
cmp eax, 0xffffffff
je 0x44acbe
lea eax, [ebp - 0x6c8]
push eax
call fcn.0044b390
mov byte [eax], 1
lea ecx, [ebp - 0x438]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44acc7
sub ecx, edx
lea eax, [ebp - 0x438]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6c8]
call fcn.00415170
push ecx
push str.JHOOKSATELLITE.DLL
lea ecx, [ebp - 0x6c8]
call fcn.00452d30
cmp dword [ebp - 0x6b4], 8
lea eax, [ebp - 0x6c8]
cmovae eax, dword [ebp - 0x6c8]
push eax
call edi
cmp eax, 0xffffffff
je 0x44ad25
lea eax, [ebp - 0x6c8]
push eax
call fcn.0044b390
mov byte [eax], 1
cmp byte [ebp - 0x6e9], 0
je 0x44ae05
lea ecx, [ebp - 0x438]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44ad40
sub ecx, edx
lea eax, [ebp - 0x438]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6c8]
call fcn.00415170
push ecx
push str.X86JHOOK.DLL
lea ecx, [ebp - 0x6c8]
call fcn.00452d30
cmp dword [ebp - 0x6b4], 8
lea eax, [ebp - 0x6c8]
cmovae eax, dword [ebp - 0x6c8]
push eax
call edi
cmp eax, 0xffffffff
je 0x44ad9e
lea eax, [ebp - 0x6c8]
push eax
call fcn.0044b390
mov byte [eax], 1
lea ecx, [ebp - 0x438]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44ada7
sub ecx, edx
lea eax, [ebp - 0x438]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6c8]
call fcn.00415170
push ecx
push str.X86JHOOKSATELLITE.DLL
lea ecx, [ebp - 0x6c8]
call fcn.00452d30
cmp dword [ebp - 0x6b4], 8
lea eax, [ebp - 0x6c8]
cmovae eax, dword [ebp - 0x6c8]
push eax
call edi
cmp eax, 0xffffffff
je 0x44ae05
lea eax, [ebp - 0x6c8]
push eax
call fcn.0044b390
mov byte [eax], 1
mov eax, dword [ebp - 0x6d4]
test eax, eax
je 0x44ae16
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6d4], 0
jmp 0x44ab90
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x6d8]
test eax, eax
je 0x44ae42
push eax
call edi
mov dword [ebp - 0x6d8], 0
lea eax, [ebp - 0x6d8]
push eax
push 0x20019
push 0
push str.SOFTWARENVDA
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44ae87
push 0x16
push str.NVDAHELPERREMOTE.DLL
lea ecx, [ebp - 0x6c8]
call fcn.00415170
lea eax, [ebp - 0x6c8]
mov ecx, 0x50b6f8
push eax
call fcn.0044b280
mov eax, dword [ebp - 0x6d8]
test eax, eax
je 0x44ae9e
push eax
call edi
mov dword [ebp - 0x6d8], 0
push 0x4ebb68
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44b1e6
push str.RtlImageDirectoryEntryToData
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x6f8], eax
test eax, eax
je 0x44b1e6
mov esi, 3
lea edi, [ebp - 0x698]
mov dword [ebp - 0x6ac], esi
nop dword [eax]
cmp byte [edi + 0x10], 0
je 0x44b1d4
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x6d4], eax
test eax, eax
jne 0x44af9b
lea ecx, [ebp - 0x228]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44af10
sub ecx, edx
lea eax, [ebp - 0x228]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6c8]
call fcn.00415170
push 0x5c
push 1
lea ecx, [ebp - 0x6c8]
call fcn.00419430
mov edx, dword [edi]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44af50
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x6c8]
call fcn.00414dc0
cmp dword [ebp - 0x6b4], 8
lea eax, [ebp - 0x6c8]
cmovae eax, dword [ebp - 0x6c8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [ebp - 0x6ac]
mov dword [ebp - 0x6d4], eax
test eax, eax
je 0x44b1d4
lea ecx, [ebp - 0x6d0]
push ecx
push 1
push 1
push eax
call dword [ebp - 0x6f8]
mov ecx, eax
mov dword [ebp - 0x6f0], ecx
test ecx, ecx
je 0x44b1d4
mov eax, dword [ecx + 0xc]
mov esi, ecx
test eax, eax
je 0x44afea
push dword [edi + 8]
add eax, dword [ebp - 0x6d4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecA]
test eax, eax
jne 0x44afe4
mov eax, dword [esi + 0x20]
add esi, 0x14
test eax, eax
jne 0x44afc6
mov ecx, dword [ebp - 0x6f0]
cmp dword [esi + 0xc], 0
jne 0x44b01f
cmp dword [ecx + 0xc], 0
mov esi, ecx
je 0x44b01f
nop dword [eax + eax]
mov eax, dword [esi + 0xc]
push dword [edi + 0xc]
add eax, dword [ebp - 0x6d4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecA]
test eax, eax
jne 0x44b01f
add esi, 0x14
cmp dword [esi + 0xc], eax
jne 0x44b000
xor ecx, ecx
mov dword [ebp - 0x6f4], ecx
cmp dword [esi + 0xc], ecx
jne 0x44b0d1
lea eax, [ebp - 0x6d0]
push eax
push 0xd
push 1
push dword [ebp - 0x6d4]
call dword [ebp - 0x6f8]
mov ecx, eax
mov dword [ebp - 0x6f0], ecx
test ecx, ecx
je 0x44b1ce
mov eax, dword [ecx + 4]
mov esi, ecx
test eax, eax
je 0x44b084
push dword [edi + 8]
add eax, dword [ebp - 0x6d4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecA]
test eax, eax
jne 0x44b07e
mov eax, dword [esi + 0x24]
add esi, 0x20
test eax, eax
jne 0x44b060
mov ecx, dword [ebp - 0x6f0]
cmp dword [esi + 4], 0
jne 0x44b0bb
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x44b0b1
mov eax, dword [esi + 4]
push dword [edi + 0xc]
add eax, dword [ebp - 0x6d4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathMatchSpecA]
test eax, eax
jne 0x44b0b1
add esi, 0x20
cmp dword [esi + 4], eax
jne 0x44b092
cmp dword [esi + 4], 0
je 0x44b1ce
mov ecx, dword [esi + 0x10]
mov edx, dword [ebp - 0x6d4]
add ecx, edx
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x6f4], ecx
jmp 0x44b0da
mov eax, dword [esi + 0x10]
mov edx, dword [ebp - 0x6d4]
cmp dword [eax + edx], 0
lea esi, [eax + edx]
mov dword [ebp - 0x6f0], esi
je 0x44b1ce
nop dword [eax]
test ecx, ecx
je 0x44b11f
mov eax, dword [ecx]
add edx, 2
push dword [edi - 0x10]
add eax, edx
add ecx, 4
push eax
mov dword [ebp - 0x6f4], ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
sete al
test al, al
jne 0x44b150
mov edx, dword [ebp - 0x6d4]
jmp 0x44b136
mov eax, dword [edi - 0xc]
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x44b150
mov eax, dword [edi - 8]
cmp ecx, dword [eax]
je 0x44b150
mov eax, dword [edi - 4]
cmp ecx, dword [eax]
je 0x44b150
add esi, 4
mov dword [ebp - 0x6f0], esi
cmp dword [esi], 0
je 0x44b1ce
mov ecx, dword [ebp - 0x6f4]
jmp 0x44b0f0
push 0
push 4
lea eax, [edi + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x44b1ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e6
jne 0x44b1ce
lea eax, [ebp - 0x6cc]
push eax
push 8
push 4
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x44b1c4
push 0
push 4
lea eax, [edi + 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov esi, eax
lea eax, [ebp - 0x6cc]
push eax
push dword [ebp - 0x6cc]
push 4
push dword [ebp - 0x6f0]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test esi, esi
jne 0x44b1ce
mov dword [ebp - 0x700], 0x3e6
mov esi, dword [ebp - 0x6ac]
add edi, 0x24
sub esi, 1
mov dword [ebp - 0x6ac], esi
jne 0x44aee0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c8]
call fcn.004484f0
mov eax, dword [ebp - 0x700]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00479e61
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
push str.list_too_long
call fcn.004764e2
int3