Function at 0x44a840
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
jmp 0x44a84b
cmp dword [0x47660c], 0
sete cl
test cl, 1
jne 0x44a85f
jmp 0x44ac6a
jmp 0x44a861
mov cx, word [0x4757a0]
xor cx, 0xd15
mov word [0x4757c0], cx
mov cx, word [0x4757a2]
xor cx, 0xdcf9
mov word [0x4757c2], cx
mov dx, word [0x4757a4]
mov cx, dx
and cx, cx
xor cx, 0xffff
and cx, 0x1563
xor cx, 0xffff
xor dx, 0xffff
or dx, 0x1563
and cx, dx
xor cx, 0xffff
mov word [0x4757c4], cx
mov cx, word [0x4757a6]
xor cx, 0x35c8
mov word [0x4757c6], cx
mov cx, word [0x4757a8]
mov dx, cx
xor dx, 0xffff
mov si, cx
xor si, 0xffff
and dx, si
xor dx, 0xffff
and dx, 0xfb2a
xor cx, 0xffff
and cx, 0x4d5
xor dx, 0xffff
xor cx, 0xffff
and dx, cx
mov word [0x4757c8], dx
mov cx, word [0x4757aa]
xor cx, 0x4ebf
mov word [0x4757ca], cx
mov cx, word [0x4757ac]
mov dx, cx
and dx, 0x9520
shl dx, 1
add cx, 0x9520
sub cx, dx
mov word [0x4757cc], cx
mov cx, word [0x4757ae]
mov dx, cx
and dx, 0xb858
shl dx, 1
add cx, 0xb858
sub cx, dx
mov word [0x4757ce], cx
mov cx, word [0x4757b0]
xor cx, 0x23a8
mov word [0x4757d0], cx
mov cx, word [0x4757b2]
mov dx, cx
and dx, 0x4832
shl dx, 1
add cx, 0x4832
sub cx, dx
mov word [0x4757d2], cx
mov dx, word [0x4757b4]
mov cx, dx
xor cx, 0xffff
xor cx, 0xffff
xor cx, 0x828e
and cx, 0x828e
mov si, dx
xor si, 0xffff
or si, 0x828e
xor dx, 0xffff
or dx, 0x828e
xor si, 0xffff
xor dx, 0xffff
or si, dx
or cx, si
mov dx, cx
xor dx, 0xffff
mov si, cx
xor si, 0xffff
or dx, si
and dx, 0x29c5
xor dx, 0xffff
xor cx, 0xffff
or cx, 0x29c5
xor dx, 0xffff
xor cx, 0xffff
or dx, cx
mov word [0x4757d4], dx
mov dx, word [0x4757b6]
mov cx, dx
xor cx, 0xffff
mov si, dx
xor si, 0xffff
and cx, si
xor cx, 0xffff
and cx, 0x9529
or dx, 0x9529
xor dx, 0xffff
or cx, dx
xor cx, 0xffff
mov word [0x4757d6], cx
mov cx, word [0x4757b8]
mov dx, cx
xor dx, 0xffff
and dx, 0x21b7
and cx, 0xde48
or dx, cx
xor dx, 0x3f58
mov word [0x4757d8], dx
mov cx, word [0x4757e0]
xor cx, 0xe989
mov word [0x475800], cx
mov cx, word [0x4757e2]
xor cx, 0x1a9d
mov word [0x475802], cx
mov dx, word [0x4757e4]
mov cx, dx
xor cx, 0xffff
mov si, dx
xor si, 0xffff
or cx, si
and cx, 0xfdba
xor cx, 0xffff
and dx, 0x245
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
mov word [0x475804], cx
mov dx, word [0x4757e6]
mov cx, dx
xor cx, 0xffff
and cx, 0xffff
or cx, 0
and cx, 0x98e2
mov si, dx
xor si, 0x98e2
and si, dx
or cx, si
xor cx, 0xc21
mov word [0x475806], cx
mov cx, word [0x4757e8]
xor cx, 0xd9fe
mov word [0x475808], cx
mov cx, word [0x4757ea]
mov dx, cx
xor dx, 0xffff
and dx, 0x2825
and cx, 0xd7da
or dx, cx
xor dx, 0x2c4b
mov word [0x47580a], dx
mov dx, word [0x4757ec]
mov cx, dx
xor cx, 0xffff
and cx, 0xffff
or cx, 0
and cx, 0x9fc
xor dx, 0xffff
or dx, 0x9fc
xor dx, 0xffff
and dx, 0xffff
mov si, dx
xor si, 0xffff
mov di, cx
and di, si
mov si, cx
xor si, dx
add cx, si
sub cx, di
xor cx, 0x8640
mov word [0x47580c], cx
mov cx, word [0x4757ee]
xor cx, 0x4d5a
mov word [0x47580e], cx
mov cx, word [0x4757f0]
xor cx, 0x7630
mov word [0x475810], cx
mov cx, word [0x4757f2]
mov dx, cx
xor dx, 0xffff
mov si, cx
xor si, 0xffff
and si, 0xa20e
mov di, cx
and di, 0x5df1
or si, di
xor si, 0x5df1
or dx, si
xor dx, 0xffff
or dx, 0xb98d
mov si, cx
xor si, 0xffff
xor si, 0xffff
and si, 0xffff
shl si, 1
sub si, 0xffff
sub cx, si
or cx, 0x4672
mov si, dx
xor si, 0xffff
xor dx, 0xffff
or si, dx
xor si, 0xffff
or si, 0
xor si, 0xffff
or si, 0
xor cx, 0xffff
or si, cx
mov word [0x475812], si
mov cx, word [0x4757f4]
mov dx, cx
xor dx, 0xffff
and dx, 0x2721
and cx, 0xd8de
or dx, cx
xor dx, 0xfb93
mov word [0x475814], dx
mov cx, word [0x4757f6]
xor cx, 0x4765
mov word [0x475816], cx
jmp 0x44ac6a
mov dword [0x47660c], 1
push eax
mov dword [ebp - 0x1c], esp
push eax
mov eax, esp
push eax
mov dword [ebp - 0x24], esp
push eax
mov dword [ebp - 0x14], esp
sub esp, 0x800
mov dword [ebp - 0x38], esp
push eax
sub esp, 0x7fc
mov dword [ebp - 0x48], esp
sub esp, 0x800
mov dword [ebp - 0x44], esp
push eax
mov ecx, esp
push eax
mov ebx, esp
push eax
mov dword [ebp - 0x30], esp
push eax
mov edi, esp
push eax
mov esi, esp
push eax
mov dword [ebp - 0x10], esp
push eax
mov dword [ebp - 0x2c], esp
sub esp, 0x18
mov dword [ebp - 0x3c], esp
push eax
mov dword [ebp - 0x4c], esp
sub esp, 0x1c
mov dword [ebp - 0x40], esp
mov dword [ebp - 0x50], eax
mov edx, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [ebp - 0x24]
mov dword [eax], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
lea eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov dword [ebp - 0x34], ecx
mov dword [ecx], eax
mov dword [ebp - 0x20], ebx
mov dword [ebx], 0
mov eax, dword [ebp - 0x30]
mov dword [eax], 0xf003f
mov dword [ebp - 0x18], edi
mov dword [edi], 0
sub esp, 8
mov dword [esp], 0xc800
mov dword [esp + 4], 2
call fcn.004552e7
add esp, 8
mov dword [esi], eax
cmp dword [esi], 0
jne 0x44ad3f
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x44b026
mov dword [ebp - 0x28], esi
mov ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov ecx, 0x80000002
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x20019
mov edi, dword [ebp - 0x24]
mov dword [esp + 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 0
je 0x44ad91
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0
mov dword [ebx], 1
jmp 0x44b026
mov edx, dword [ebp - 0x2c]
mov dword [edx], 0
mov esi, dword [ebp - 0x18]
mov eax, ebx
mov ebx, dword [ebp - 0x20]
jmp 0x44ada4
cmp dword [ebx], 0
je 0x44adb7
mov dword [eax], 2
mov edi, dword [ebp - 0x1c]
jmp 0x44af6e
mov dword [esi], 0x800
mov eax, dword [edx]
mov ecx, dword [edi]
xor edx, edx
sub esp, 0x20
mov dword [esp], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebx], eax
cmp eax, 0
jne 0x44af51
mov ebx, dword [ebp - 0x48]
jmp 0x44ae0e
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
lea ecx, str._s_s
sub esp, 0x10
mov dword [esp], ebx
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 0xc], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, 0x80000002
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x20019
mov eax, dword [ebp - 0x14]
mov dword [esp + 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 0
setne al
test al, 1
mov ebx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x3c]
jne 0x44ae7a
jmp 0x44aeb0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [edi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1c]
mov dword [edi], 0
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x44af6e
mov dword [ecx], 0x800
lea eax, [0x475800]
sub esp, 0xc
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
call fcn.0044fd30
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x30]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], ebx
mov eax, dword [ebp - 0x18]
mov dword [esp + 0x14], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0
jne 0x44af3b
jmp 0x44af0e
mov ecx, dword [ebp - 0x28]
mov eax, dword [ecx]
mov ecx, dword [ecx]
lea edx, str._s_s_n
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov dword [esp + 0xc], ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov ebx, dword [ebp - 0x20]
jmp 0x44af40
mov ebx, dword [ebp - 0x20]
jmp 0x44af40
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44af53
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
jmp 0x44af5b
jmp 0x44af5d
jmp 0x44af5f
mov eax, dword [edx]
add eax, 1
mov dword [edx], eax
mov eax, dword [ebp - 0x10]
jmp 0x44ada4
cmp dword [eax], 2
jne 0x44b026
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00430460
add esp, 4
mov ebx, dword [ebp - 0x4c]
mov dword [ebx], eax
lea eax, [0x4757c0]
sub esp, 0xc
mov esi, dword [ebp - 0x40]
mov dword [esp], esi
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1a
call fcn.0044fd30
add esp, 0xc
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00455ce0
add esp, 4
mov ecx, dword [ebx]
mov edx, dword [ebp - 0x50]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.00430610
add esp, 0x10
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00455735
add esp, 4
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], eax
call fcn.00455735
add esp, 4
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi], 1
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
mov eax, dword [edi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret