Function at 0x44a600
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
jmp 0x44a60b
cmp dword [0x478850], 0
sete cl
test cl, 1
jne 0x44a61f
jmp 0x44a9c0
jmp 0x44a621
mov cx, word [0x477820]
xor cx, 0xc7bb
mov word [0x477840], cx
mov cx, word [0x477822]
mov dx, cx
and dx, 0xe8ff
shl dx, 1
add cx, 0xe8ff
sub cx, 0xdbe3
sub cx, dx
add cx, 0xdbe3
mov word [0x477842], cx
mov dx, word [0x477824]
mov cx, dx
xor cx, 0xffff
mov si, dx
xor si, 0xffff
or cx, si
and cx, 0x6b53
xor cx, 0xffff
xor dx, 0xffff
or dx, 0x6b53
and cx, dx
xor cx, 0xffff
mov word [0x477844], cx
mov cx, word [0x477826]
mov dx, cx
and dx, 0xda18
shl dx, 1
add cx, 0xda18
sub cx, dx
mov word [0x477846], cx
mov cx, word [0x477828]
xor cx, 0x6688
mov word [0x477848], cx
mov cx, word [0x47782a]
mov dx, cx
xor dx, 0xfcab
xor dx, 0xffff
and dx, 0xfcab
shl dx, 1
sub dx, 0xad23
sub dx, 0xfcab
add dx, 0xad23
sub cx, dx
mov word [0x47784a], cx
mov cx, word [0x47782c]
mov dx, cx
xor dx, 0xffff
mov si, cx
xor si, 0xffff
and dx, si
or dx, 0xa3d1
xor dx, 0xffff
or cx, 0x5c2e
xor cx, 0xffff
xor dx, 0xffff
xor cx, 0xffff
and dx, cx
mov word [0x47784c], dx
mov dx, word [0x47782e]
mov cx, dx
xor cx, 0xffff
mov si, dx
xor si, 0xffff
or cx, si
and cx, 0x6ab9
xor cx, 0xffff
xor dx, 0xffff
or dx, 0x6ab9
and cx, dx
xor cx, 0xffff
mov word [0x47784e], cx
mov cx, word [0x477830]
xor cx, 0x939f
mov word [0x477850], cx
mov cx, word [0x477832]
xor cx, 0x3aa7
mov word [0x477852], cx
mov cx, word [0x477834]
xor cx, 0x6050
mov word [0x477854], cx
mov cx, word [0x477836]
xor cx, 0xfe81
mov word [0x477856], cx
mov cx, word [0x477838]
xor cx, 0x2917
mov word [0x477858], cx
mov cx, word [0x4777e0]
xor cx, 0xaea9
mov word [0x477800], cx
mov dx, word [0x4777e2]
mov cx, dx
xor cx, 0xffff
mov si, dx
xor si, 0xffff
or cx, si
xor cx, 0xffff
or cx, 0x4483
and dx, 0x4483
xor dx, 0xffff
and cx, dx
xor cx, 0xffff
mov word [0x477802], cx
mov cx, word [0x4777e4]
mov dx, cx
xor dx, 0x5203
xor dx, 0xffff
and dx, 0x5203
shl dx, 1
sub dx, 0x5203
mov si, cx
xor si, dx
xor dx, 0xffff
and cx, dx
shl cx, 1
sub cx, si
mov word [0x477804], cx
mov cx, word [0x4777e6]
xor cx, 0x4ae3
mov word [0x477806], cx
mov dx, word [0x4777e8]
mov cx, dx
xor cx, 0xffff
and cx, 0xd9b3
mov si, dx
xor si, 0xffff
or si, 0xd9b3
and dx, 0x264c
xor dx, 0xffff
xor si, 0xffff
xor dx, 0xffff
or si, dx
or cx, si
xor cx, 0xc8d0
mov word [0x477808], cx
mov dx, word [str.k_vcM]
mov si, dx
xor si, 0xffff
xor si, 0xffff
and si, 0xffff
shl si, 1
sub si, 0xffff
mov cx, dx
sub cx, si
mov si, dx
xor si, 0xffff
and cx, si
or cx, 0xf4f5
xor cx, 0xffff
or dx, 0xb0a
mov si, dx
xor si, 0xffff
and si, 0xde6a
and dx, 0x2195
or si, dx
xor si, 0x2195
xor cx, 0xffff
xor si, 0xffff
and si, 0xffff
or si, 0
and cx, si
mov word [0x47780a], cx
mov cx, word [0x4777ec]
xor cx, 0x4d1a
mov word [0x47780c], cx
mov cx, word [0x4777ee]
xor cx, 0xcda6
mov word [0x47780e], cx
mov cx, word [0x4777f0]
xor cx, 0x5c03
mov word [0x477810], cx
mov cx, word [0x4777f2]
mov dx, cx
xor dx, 0xffff
xor dx, 0xffff
or dx, 0xd16
xor dx, 0xffff
and dx, 0xffff
mov si, cx
xor si, 0xd16
xor si, 0xffff
or cx, 0xd16
and cx, si
or dx, cx
mov word [0x477812], dx
mov cx, word [0x4777f4]
xor cx, 0x9bb5
mov word [0x477814], cx
mov cx, word [0x4777f6]
xor cx, 0xa6ba
mov word [0x477816], cx
jmp 0x44a9c0
mov dword [0x478850], 1
push eax
mov dword [ebp - 0x20], esp
push eax
mov eax, esp
push eax
mov dword [ebp - 0x1c], esp
push eax
mov dword [ebp - 0x14], esp
sub esp, 0x800
mov dword [ebp - 0x40], esp
push eax
sub esp, 0x7fc
mov dword [ebp - 0x3c], esp
sub esp, 0x800
mov dword [ebp - 0x38], esp
push eax
mov edi, esp
push eax
mov esi, esp
push eax
mov dword [ebp - 0x30], esp
push eax
mov edx, esp
push eax
mov ebx, esp
push eax
mov dword [ebp - 0x18], esp
push eax
mov dword [ebp - 0x28], esp
sub esp, 0x18
mov dword [ebp - 0x44], esp
push eax
mov dword [ebp - 0x4c], esp
sub esp, 0x1c
mov dword [ebp - 0x48], esp
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
lea eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
mov dword [ebp - 0x34], edi
mov dword [edi], eax
mov dword [ebp - 0x24], esi
mov dword [esi], 0
mov eax, dword [ebp - 0x30]
mov dword [eax], 0xf003f
mov edi, edx
mov dword [edx], 0
sub esp, 8
mov dword [esp], 0xc800
mov dword [esp + 4], 2
call fcn.00457787
add esp, 8
mov dword [ebx], eax
cmp dword [ebx], 0
jne 0x44aa96
jmp 0x44aa7f
mov edi, dword [ebp - 0x20]
mov dword [edi], 0
mov eax, dword [ebp - 0x18]
mov dword [eax], 1
jmp 0x44ada7
mov dword [ebp - 0x2c], edi
mov esi, dword [ebp - 0x40]
mov dword [ebp - 0x10], ebx
jmp 0x44aaa1
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
mov ecx, 0x80000002
xor edx, edx
sub esp, 0x14
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x20019
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0x10], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 0
setne al
mov ecx, dword [ebp - 0x10]
mov edi, esi
mov ebx, dword [ebp - 0x28]
test al, 1
mov esi, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x24]
jne 0x44aaee
jmp 0x44ab05
mov edi, dword [ebp - 0x20]
mov dword [edi], 0
mov eax, dword [ebp - 0x18]
mov dword [eax], 1
jmp 0x44ada7
mov dword [ebx], 0
jmp 0x44ab0d
cmp dword [edx], 0
sete al
test al, 1
mov edx, dword [ebp - 0x2c]
jne 0x44ab2d
jmp 0x44ab1c
mov eax, dword [ebp - 0x18]
mov dword [eax], 2
mov edi, dword [ebp - 0x20]
jmp 0x44acf0
mov dword [edx], 0x800
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov ebx, edx
xor edx, edx
sub esp, 0x20
mov dword [esp], ecx
mov dword [esp + 4], eax
mov dword [esp + 8], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x34]
mov dword [edx], eax
cmp eax, 0
jne 0x44acd2
mov eax, dword [ecx]
lea ecx, str._s_s
sub esp, 0x10
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], eax
mov dword [esp + 0xc], edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, 0x80000002
xor ecx, ecx
sub esp, 0x14
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x20019
mov esi, dword [ebp - 0x14]
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 0
je 0x44ac16
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x1c]
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x20]
mov dword [edi], 0
mov eax, dword [ebp - 0x18]
mov dword [eax], 1
mov ecx, dword [ebp - 0x10]
jmp 0x44acf0
jmp 0x44ac18
mov esi, dword [ebp - 0x2c]
mov dword [esi], 0x800
lea eax, [0x477800]
sub esp, 0xc
mov ebx, dword [ebp - 0x44]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x18
call fcn.004521d0
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
xor ecx, ecx
sub esp, 0x18
mov dword [esp], eax
mov dword [esp + 4], ebx
mov dword [esp + 8], 0
mov eax, dword [ebp - 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0
sete al
mov esi, dword [ebp - 0x3c]
test al, 1
mov ecx, dword [ebp - 0x10]
jne 0x44ac87
jmp 0x44acb4
mov eax, dword [ecx]
mov ecx, dword [ecx]
lea edx, str._s_s_n
sub esp, 0x10
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x38]
mov dword [esp + 0xc], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
mov eax, dword [ebp - 0x14]
jmp 0x44acbd
jmp 0x44acb6
mov eax, dword [ebp - 0x14]
jmp 0x44acbb
jmp 0x44acbd
jmp 0x44acbf
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x24]
jmp 0x44acd2
jmp 0x44acd4
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebx]
mov ecx, eax
and ecx, 1
shl ecx, 1
xor eax, 1
add eax, ecx
mov dword [ebx], eax
mov ecx, dword [ebp - 0x10]
jmp 0x44ab0b
cmp dword [eax], 2
jne 0x44ada7
mov eax, dword [ecx]
sub esp, 4
mov dword [esp], eax
call fcn.0042fa60
add esp, 4
mov esi, dword [ebp - 0x4c]
mov dword [esi], eax
lea eax, [0x477840]
sub esp, 0xc
mov ebx, dword [ebp - 0x48]
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 8], 0x1a
call fcn.004521d0
add esp, 0xc
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00458180
add esp, 4
mov ecx, dword [esi]
mov edx, dword [ebp - 0x50]
mov edx, dword [edx]
sub esp, 0x10
mov dword [esp], edx
mov dword [esp + 4], ebx
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
call fcn.0042fc10
add esp, 0x10
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call fcn.00457bd5
add esp, 4
mov eax, dword [esi]
sub esp, 4
mov dword [esp], eax
call fcn.00457bd5
add esp, 4
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi], 1
mov eax, dword [ebp - 0x18]
mov dword [eax], 1
jmp 0x44ada7
mov eax, dword [edi]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret