Function at 0x4487a0
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
cmp dword [0x47467c], 0
jne 0x448c08
mov cx, word [0x4737e0]
xor cx, 0xce98
mov word [0x473800], cx
mov cx, word [0x4737e2]
xor cx, 0xe45e
mov word [0x473802], cx
mov cx, word [0x4737e4]
xor cx, 0xf81c
mov word [0x473804], cx
mov cx, word [0x4737e6]
xor cx, 0xc1ec
mov word [0x473806], cx
mov cx, word [0x4737e8]
mov dx, cx
xor dx, 0xffff
mov si, cx
xor si, 0xffff
and dx, si
xor dx, 0xffff
and dx, 0xe6aa
xor cx, 0xffff
and cx, 0x1955
xor dx, 0xffff
xor cx, 0xffff
and dx, cx
mov word [0x473808], dx
mov cx, word [0x4737ea]
xor cx, 0x1591
mov word [0x47380a], cx
mov dx, word [str.wWE_v]
mov cx, dx
xor cx, 0xffff
mov si, dx
xor si, 0xffff
or cx, si
xor cx, 0xffff
or cx, 0xa8f1
and dx, 0xa8f1
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
mov word [0x47380c], cx
mov cx, word [0x4737ee]
xor cx, 0xb0b
mov word [0x47380e], cx
mov dx, word [0x4737f0]
mov cx, dx
and cx, cx
xor cx, 0xffff
mov si, cx
and si, 0xffff
shl si, 1
add cx, 0xffff
sub cx, si
or cx, 0x1787
and dx, 0x1787
mov si, dx
xor si, 0xffff
and si, 0x65d
and dx, 0xf9a2
or si, dx
xor si, 0xf9a2
xor cx, 0xffff
xor si, 0xffff
or cx, si
xor cx, 0xffff
and cx, 0xffff
xor cx, 0xffff
mov word [0x473810], cx
mov cx, word [0x4737f2]
xor cx, 0xaba6
mov word [0x473812], cx
mov si, word [0x4737f4]
mov cx, si
xor cx, 0xffff
and cx, 0x9861
and si, 0x679e
mov dx, cx
or dx, si
xor dx, 0xffff
or cx, si
xor cx, 0xffff
or dx, cx
xor dx, 0xffff
xor dx, 0xc9ab
mov word [0x473814], dx
mov cx, word [0x4737f6]
xor cx, 0x5b95
mov word [0x473816], cx
mov cx, word [0x4737a0]
xor cx, 0xebc2
mov word [0x4737c0], cx
mov cx, word [0x4737a2]
xor cx, 0x7f3c
mov word [str.kcr.V__v], cx
mov cx, word [0x4737a4]
mov dx, cx
and dx, dx
xor dx, 0xffff
xor dx, 0xffff
or dx, 0x15c2
mov si, cx
and si, 0x15c2
xor si, 0xffff
and dx, si
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xea3d
mov si, dx
xor si, 0xffff
mov di, si
and di, 2
or si, 2
xor si, 0xffff
imul si, di
mov di, dx
and di, 2
or dx, 2
imul dx, di
add dx, si
mov si, dx
xor si, 0xea3d
and dx, 0x15c2
shl dx, 1
sub dx, si
sub cx, dx
mov word [0x4737c4], cx
mov cx, word [0x4737a6]
mov dx, cx
xor dx, 0xffff
and dx, 0xe454
and cx, 0x1bab
or dx, cx
mov word [0x4737c6], dx
mov cx, word [0x4737a8]
mov dx, cx
xor dx, 0xffff
and dx, 0x6e55
and cx, 0x91aa
or dx, cx
xor dx, 0xf19c
mov word [0x4737c8], dx
mov cx, word [0x4737aa]
mov si, cx
xor si, 0xffff
and si, 0x29cc
and cx, 0xd633
mov dx, si
xor dx, 0xffff
xor si, 0xffff
or dx, si
and cx, cx
xor cx, 0xffff
and dx, cx
xor dx, 0xffff
xor dx, 0xe815
mov word [0x4737ca], dx
mov cx, word [0x4737ac]
mov dx, cx
xor dx, 0xffff
and dx, 0xd7b1
and cx, 0x284e
or dx, cx
mov word [0x4737cc], dx
mov cx, word [0x4737ae]
xor cx, 0x23d6
mov word [0x4737ce], cx
mov cx, word [0x4737b0]
xor cx, 0xbf4d
mov word [0x4737d0], cx
mov cx, word [0x4737b2]
mov dx, cx
and dx, 0xd08b
mov di, dx
and di, 0xfffd
mov si, dx
xor si, 0xffff
and si, 2
imul si, di
mov di, dx
and di, 2
or dx, 2
imul dx, di
add dx, si
add cx, 0xd08b
sub cx, dx
mov word [0x4737d2], cx
mov dx, word [0x4737b4]
mov cx, dx
or cx, cx
xor cx, 0xffff
or cx, 0x20a3
mov si, cx
xor si, 0xffff
xor si, 0xffff
and si, 0xffff
shl si, 1
sub si, 0xffff
sub cx, si
xor dx, 0xffff
mov si, dx
xor si, 0xdf5c
and si, dx
xor cx, 0xffff
and cx, 0xffff
or cx, 0
xor si, 0xffff
and cx, si
mov word [0x4737d4], cx
mov cx, word [0x4737b6]
xor cx, 0x2251
mov word [0x4737d6], cx
mov dx, word [0x4737b8]
mov cx, dx
xor cx, 0xffff
mov si, dx
xor si, 0xffff
xor cx, 0xffff
xor si, 0xffff
or cx, si
xor cx, 0xffff
and cx, 0xffff
xor cx, 0xffff
mov si, cx
add si, 1
xor cx, 0xffff
or cx, 0x68e8
add cx, si
mov si, dx
and si, 0x68e8
xor si, 0xffff
add dx, 0x68e8
add dx, 1
add dx, si
xor dx, 0xffff
and dx, 0xffff
or dx, 0
mov si, cx
and si, dx
xor cx, dx
or si, cx
xor si, 0xffff
mov word [0x4737d8], si
jmp 0x448c0a
mov dword [0x47467c], 1
push eax
mov dword [ebp - 0x18], esp
push eax
mov edi, esp
push eax
mov dword [ebp - 0x14], esp
push eax
mov eax, esp
sub esp, 0x800
mov dword [ebp - 0x2c], esp
push eax
sub esp, 0x7fc
mov dword [ebp - 0x40], esp
sub esp, 0x800
mov dword [ebp - 0x44], esp
push eax
mov dword [ebp - 0x28], esp
push eax
mov dword [ebp - 0x34], esp
push eax
mov edx, esp
push eax
mov ecx, esp
push eax
mov ebx, esp
push eax
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0x1c], esp
sub esp, 0x18
mov dword [ebp - 0x38], esp
push eax
mov dword [ebp - 0x4c], esp
sub esp, 0x1c
mov dword [ebp - 0x48], esp
mov dword [ebp - 0x50], edi
mov esi, dword [ebp + 8]
mov dword [edi], esi
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ebp - 0x30], eax
mov dword [eax], 0
lea eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov dword [edi], eax
mov eax, dword [ebp - 0x34]
mov esi, eax
mov dword [eax], 0
mov dword [ebp - 0x3c], edx
mov dword [edx], 0xf003f
mov dword [ebp - 0x20], ecx
mov dword [ecx], 0
sub esp, 8
mov dword [esp], 0xc800
mov dword [esp + 4], 2
call fcn.00453287
add esp, 8
mov dword [ebx], eax
mov dword [ebp - 0x24], ebx
cmp dword [ebx], 0
sete al
test al, 1
jne 0x448cd4
jmp 0x448ceb
mov esi, dword [ebp - 0x18]
mov dword [esi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x448fde
jmp 0x448ced
mov eax, dword [edi]
mov ecx, 0x80000002
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x20019
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 0
setne al
test al, 1
mov edi, esi
jne 0x448d2b
jmp 0x448d42
mov esi, dword [ebp - 0x18]
mov dword [esi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x448fde
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
jmp 0x448d4d
cmp dword [edi], 0
je 0x448d63
mov eax, dword [ebp - 0x10]
mov dword [eax], 2
mov esi, dword [ebp - 0x18]
jmp 0x448f24
jmp 0x448d65
mov ebx, dword [ebp - 0x20]
mov dword [ebx], 0x800
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x20
mov dword [esp], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [edi], eax
cmp eax, 0
sete al
test al, 1
jne 0x448dc6
jmp 0x448efe
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
lea ecx, str._s_s
sub esp, 0x10
mov edi, dword [ebp - 0x40]
mov dword [esp], edi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, 0x80000002
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x20019
mov edi, dword [ebp - 0x30]
mov dword [esp + 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 0
je 0x448e5b
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x18]
mov dword [esi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x448f24
mov eax, dword [ebp - 0x20]
mov dword [eax], 0x800
lea eax, [0x473800]
sub esp, 0xc
mov ebx, dword [ebp - 0x38]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
call fcn.0044dcd0
add esp, 0xc
mov eax, dword [edi]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x3c]
mov dword [esp + 0xc], eax
mov edi, dword [ebp - 0x44]
mov dword [esp + 0x10], edi
mov eax, dword [ebp - 0x20]
mov dword [esp + 0x14], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0
jne 0x448ee9
mov ecx, dword [ebp - 0x24]
mov eax, dword [ecx]
mov ecx, dword [ecx]
lea edx, str._s_s_n
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov edi, esi
jmp 0x448eed
mov edi, esi
jmp 0x448eed
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x448f00
jmp 0x448f02
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ecx, eax
and ecx, 1
or eax, 1
xor edx, edx
sub edx, ecx
xor ecx, ecx
sub ecx, eax
add edx, ecx
xor eax, eax
sub eax, edx
mov dword [ebx], eax
jmp 0x448d4d
cmp dword [eax], 2
jne 0x448fde
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.0042d340
add esp, 4
mov edi, dword [ebp - 0x4c]
mov dword [edi], eax
lea eax, [0x4737c0]
sub esp, 0xc
mov ebx, dword [ebp - 0x48]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1a
call fcn.0044dcd0
add esp, 0xc
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.00453c80
add esp, 4
mov ecx, dword [edi]
mov edx, dword [ebp - 0x50]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.0042d530
add esp, 0x10
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.004536d5
add esp, 4
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call fcn.004536d5
add esp, 4
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], 1
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x448fde
mov eax, dword [esi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret