Function at 0x44a9e0
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
cmp dword [0x47661c], 0
jne 0x44af14
mov cx, word [0x4757a0]
mov dx, cx
xor dx, 0xffff
and dx, 0x13a1
and cx, 0xec5e
mov si, dx
and si, cx
xor dx, cx
or si, dx
xor si, 0x79ea
mov word [str.e_pu_], si
mov cx, word [0x4757a2]
xor cx, 0xd75e
mov word [0x4757c2], cx
mov dx, word [0x4757a4]
mov cx, dx
xor cx, 0xffff
xor cx, 0xffff
or cx, 0xb834
xor cx, 0xffff
and cx, 0xffff
and dx, 0xb834
or cx, dx
xor cx, 0xbc8b
mov word [0x4757c4], cx
mov cx, word [0x4757a6]
mov si, cx
and si, 0xffff
shl si, 1
mov dx, cx
add dx, 0xffff
sub dx, si
xor dx, 0xffff
xor dx, 0xf741
and dx, 0xf741
and cx, 0x8be
or dx, cx
mov word [0x4757c6], dx
mov cx, word [0x4757a8]
mov dx, cx
and dx, 0xb5e0
shl dx, 1
add cx, 0xb5e0
add cx, 0x65ed
sub cx, dx
sub cx, 0x65ed
mov word [0x4757c8], cx
mov cx, word [0x4757aa]
xor cx, 0xebb1
mov word [0x4757ca], cx
mov cx, word [0x4757ac]
xor cx, 0xb4c
mov word [0x4757cc], cx
mov cx, word [0x4757ae]
mov di, cx
xor di, 0xffff
mov si, cx
xor si, 0xffff
and si, 0xeb2e
mov dx, cx
and dx, 0x14d1
or si, dx
xor si, 0x14d1
mov dx, di
xor dx, 0xffff
xor di, 0xffff
and dx, di
or si, si
xor si, 0xffff
xor dx, 0xffff
xor si, 0xffff
and dx, si
xor dx, 0xffff
and dx, 0x2fa9
xor cx, 0xffff
and cx, 0xd056
mov si, cx
xor si, 0xffff
mov di, dx
and di, si
mov si, dx
xor si, cx
add dx, si
sub dx, di
xor dx, 0xffff
mov word [0x4757ce], dx
mov cx, word [0x4757b0]
xor cx, 0xb516
mov word [0x4757d0], cx
mov cx, word [0x4757b2]
xor cx, 0xe803
mov word [0x4757d2], cx
mov cx, word [0x4757b4]
mov dx, cx
xor dx, 0xffff
and dx, 0xa69
and cx, 0xf596
or dx, cx
mov word [0x4757d4], dx
mov dx, word [0x4757b6]
mov cx, dx
xor cx, 0xffff
xor cx, 0xffff
xor cx, 0x788c
and cx, 0x788c
mov si, dx
xor si, 0x8773
xor si, 0xffff
or dx, 0x8773
and dx, si
mov si, cx
xor si, 0xffff
mov di, dx
xor di, 0xffff
and si, di
xor cx, 0xffff
xor dx, 0xffff
and cx, dx
xor si, 0xffff
xor cx, 0xffff
and si, cx
mov word [0x4757d6], si
mov cx, word [0x4757b8]
mov dx, cx
xor dx, 0xffff
mov si, cx
xor si, 0xffff
and dx, si
xor dx, 0xffff
and dx, 0xb401
or cx, 0xb401
xor cx, 0xffff
xor dx, 0xffff
xor cx, 0xffff
and dx, cx
mov word [0x4757d8], dx
mov cx, word [0x4757e0]
xor cx, 0x1500
mov word [0x475800], cx
mov cx, word [0x4757e2]
xor cx, 0xc7a8
mov word [0x475802], cx
mov cx, word [0x4757e4]
mov si, cx
xor si, 0xffff
mov dx, cx
xor dx, 0xffff
and dx, 0xffff
or dx, 0
or si, dx
xor si, 0xffff
mov dx, si
and dx, 0xbd1c
xor si, 0xbd1c
or dx, si
or cx, cx
xor cx, 0xffff
xor cx, 0xffff
and cx, 0xbd1c
xor cx, 0xffff
mov si, dx
xor si, cx
xor si, 0xffff
or dx, cx
and dx, si
mov cx, dx
xor cx, 0xffff
and cx, 0x2cd
and dx, 0xfd32
or cx, dx
xor cx, 0xfd32
mov word [0x475804], cx
mov dx, word [0x4757e6]
mov cx, dx
xor cx, 0xffff
mov si, dx
xor si, 0xffff
and cx, si
xor cx, 0xffff
and cx, 0xea2b
or dx, 0xea2b
xor dx, 0xffff
mov si, cx
xor si, 0xffff
xor si, 0xffff
and si, 0xffff
shl si, 1
sub si, 0xffff
sub cx, si
xor dx, 0xffff
xor cx, 0xffff
xor dx, 0xffff
or cx, dx
xor cx, 0xffff
and cx, 0xffff
mov word [str._f87_l], cx
mov cx, word [0x4757e8]
mov dx, cx
xor dx, 0x2b2a
xor dx, 0xffff
and dx, 0x2b2a
shl dx, 1
sub dx, 0x2b2a
sub cx, dx
mov word [0x475808], cx
mov cx, word [0x4757ea]
mov dx, cx
and dx, 0xcc98
shl dx, 1
add cx, 0xcc98
sub cx, dx
mov word [0x47580a], cx
mov dx, word [0x4757ec]
mov cx, dx
or cx, cx
xor cx, 0xffff
or cx, 0x97c3
xor cx, 0xffff
or dx, 0x683c
xor dx, 0xffff
or cx, dx
xor cx, 0xffff
mov word [0x47580c], cx
mov dx, word [0x4757ee]
mov cx, dx
and cx, cx
xor cx, 0xffff
and cx, 0xffff
xor cx, 0xffff
and cx, 0xffff
xor cx, 0xffff
mov si, dx
xor si, 0xffff
or cx, si
and cx, 0xabb5
xor cx, 0xffff
xor dx, 0xffff
mov si, dx
xor si, 0xffff
mov di, si
and di, 0x4554
and dx, 0xbaab
or di, dx
xor di, 0xeee1
or si, 0x544a
xor si, 0xffff
and si, 0xffff
or di, si
and cx, di
mov dx, cx
xor dx, 0xffff
xor dx, 0xffff
and dx, 0xffff
shl dx, 1
sub dx, 0xffff
sub cx, dx
mov word [0x47580e], cx
mov cx, word [0x4757f0]
xor cx, 0xa3eb
mov word [0x475810], cx
mov cx, word [0x4757f2]
mov dx, cx
and dx, 0x3f56
mov di, dx
and di, 0xfffd
mov si, dx
xor si, 0xffff
and si, 2
imul si, di
mov di, dx
and di, 2
or dx, 2
imul dx, di
add dx, si
add cx, 0x3f56
mov si, cx
xor si, 0xffff
and si, dx
xor dx, 0xffff
and cx, dx
sub cx, si
mov word [0x475812], cx
mov cx, word [0x4757f4]
xor cx, 0xe392
mov word [0x475814], cx
mov cx, word [0x4757f6]
mov dx, cx
or dx, dx
xor dx, 0xffff
xor dx, 0xffff
and dx, 0x5de1
xor cx, 0xffff
and cx, 0xa21e
xor dx, 0xffff
xor cx, 0xffff
and dx, cx
mov word [0x475816], dx
jmp 0x44af16
mov dword [0x47661c], 1
push eax
mov dword [ebp - 0x1c], esp
push eax
mov ebx, esp
push eax
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 0x18], esp
sub esp, 0x800
mov dword [ebp - 0x2c], esp
push eax
sub esp, 0x7fc
mov dword [ebp - 0x48], esp
sub esp, 0x800
mov dword [ebp - 0x44], esp
push eax
mov eax, esp
push eax
mov dword [ebp - 0x28], esp
push eax
mov edx, esp
push eax
mov ecx, esp
push eax
mov esi, esp
push eax
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0x20], esp
sub esp, 0x18
mov dword [ebp - 0x3c], esp
push eax
mov dword [ebp - 0x4c], esp
sub esp, 0x1c
mov dword [ebp - 0x38], esp
mov dword [ebp - 0x50], ebx
mov edi, dword [ebp + 8]
mov dword [ebx], edi
mov edi, dword [ebp - 0x14]
mov dword [edi], 0
mov edi, dword [ebp - 0x28]
mov ebx, eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
lea eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov dword [ebx], eax
mov dword [edi], 0
mov dword [ebp - 0x40], edx
mov dword [edx], 0xf003f
mov dword [ebp - 0x34], ecx
mov dword [ecx], 0
sub esp, 8
mov dword [esp], 0xc800
mov dword [esp + 4], 2
call fcn.004556b7
add esp, 8
mov dword [esi], eax
mov dword [ebp - 0x30], esi
cmp dword [esi], 0
sete al
test al, 1
jne 0x44afdd
jmp 0x44aff6
jmp 0x44afdf
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x44b2e4
mov eax, dword [ebx]
mov ecx, 0x80000002
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x20019
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 0
je 0x44b044
jmp 0x44b02d
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x44b2e4
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
mov ecx, dword [ebp - 0x2c]
jmp 0x44b052
cmp dword [edi], 0
sete al
test al, 1
jne 0x44b06f
jmp 0x44b05e
mov eax, dword [ebp - 0x10]
mov dword [eax], 2
mov edi, dword [ebp - 0x1c]
jmp 0x44b22a
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x34]
mov dword [ebx], 0x800
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
mov eax, ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
xor edx, edx
sub esp, 0x20
mov dword [esp], ecx
mov dword [esp + 4], esi
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
mov ebx, dword [ebp - 0x24]
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edx, dword [ebp - 0x48]
mov dword [edi], eax
cmp eax, 0
jne 0x44b212
mov eax, dword [ebx]
lea ecx, str._s_s
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [esp + 0xc], eax
mov edi, edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, 0x80000002
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], edi
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x20019
mov esi, dword [ebp - 0x18]
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 0
je 0x44b163
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x44b22a
mov edi, dword [ebp - 0x34]
mov dword [edi], 0x800
lea eax, [0x475800]
sub esp, 0xc
mov ebx, dword [ebp - 0x3c]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
call fcn.00450100
add esp, 0xc
mov eax, dword [esi]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x40]
mov dword [esp + 0xc], eax
mov ebx, dword [ebp - 0x44]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0
jne 0x44b1f5
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx]
mov ecx, dword [ecx]
lea edx, str._s_s_n
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
jmp 0x44b200
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
jmp 0x44b200
jmp 0x44b202
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44b212
jmp 0x44b214
jmp 0x44b216
jmp 0x44b218
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx]
add eax, 1
mov dword [ecx], eax
mov ecx, dword [ebp - 0x2c]
jmp 0x44b050
cmp dword [eax], 2
jne 0x44b2e4
mov esi, dword [ebp - 0x30]
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.004309e0
add esp, 4
mov ebx, dword [ebp - 0x4c]
mov dword [ebx], eax
lea eax, str.e_pu_
sub esp, 0xc
mov ecx, dword [ebp - 0x38]
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1a
call fcn.00450100
add esp, 0xc
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.004560b0
add esp, 4
mov ecx, dword [ebx]
mov edx, dword [ebp - 0x50]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov edx, dword [ebp - 0x38]
mov dword [esp + 4], edx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.00430bd0
add esp, 0x10
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00455b05
add esp, 4
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00455b05
add esp, 4
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi], 1
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x44b2e4
mov eax, dword [edi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret