Function at 0x44a970
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b25b7
mov eax, dword fs:[0]
push eax
sub esp, 0x4c0
mov eax, dword [0x6670c8]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x498], ecx
mov al, byte [ebp + 8]
lea ecx, [ebp - 0x490]
mov byte [ebp - 0x491], al
movzx eax, al
inc eax
mov dword [ebp - 0x490], 0
push ecx
shl eax, 8
or eax, 0x20019
push eax
push 0
push str.SOFTWAREMICROSOFTWINDOWSCURRENTVERSIONUNINSTALL
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x44b01b
push 0x200
xor ebx, ebx
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.0057fee0
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
add esp, 0xc
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x200
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x44b001
mov dword [ebp - 0x48c], eax
lea eax, [ebp - 0x48c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x44af5f
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x488]
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x488], 0x200
push eax
lea eax, [ebp - 0x418]
push eax
push 2
push str.DisplayName
push esi
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x44af4d
lea eax, [ebp - 0x214]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44aab1
sub eax, edx
sar eax, 1
cmp eax, 0xc
jb 0x44aae2
push 0xc
mov edx, 0x644ad4
lea ecx, [ebp - 0x214]
call fcn.004375a0
add esp, 4
test eax, eax
jne 0x44aae2
mov al, 1
jmp 0x44aae4
xor al, al
test al, al
je 0x44af4d
xor eax, eax
mov dword [ebp - method.InstalledProducts::InstalledProduct.virtual_0], vtable.InstalledProducts::InstalledProduct.0
push eax
push 0x644264
lea ecx, [ebp - 0x480]
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 7
mov word [ebp - 0x480], ax
call fcn.004181e0
xor eax, eax
mov dword [ebp - 4], 0
push eax
push 0x644264
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 7
mov word [ebp - 0x468], ax
call fcn.004181e0
xor eax, eax
mov byte [ebp - 4], 1
push eax
push 0x644264
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 7
mov word [ebp - 0x450], ax
call fcn.004181e0
xor eax, eax
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 7
mov word [ebp - 0x438], ax
mov byte [ebp - 0x420], al
lea ecx, [ebp - 0x214]
mov dword [ebp - 4], 2
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44abc0
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x468]
call fcn.004181e0
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44abf0
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x480]
call fcn.004181e0
mov al, byte [ebp - 0x491]
lea ecx, [ebp - 0x4b4]
mov byte [ebp - 0x420], al
call fcn.0044a310
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x44ac38
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x66f280
call fcn.00417550
add esp, 4
mov edx, str.d:jenkinsworkspace_n_sucommon_src_sucommoninstalledproducts.cpp
mov ecx, eax
call fcn.00416700
mov edx, 0x643b2c
mov ecx, eax
call fcn.00416700
cmp byte [ebp - 0x491], 0
mov ecx, str.__64_
mov esi, str.__32_
cmove esi, ecx
mov ecx, eax
push 0x3a
call fcn.00414f30
mov edx, str.:_Found
mov ecx, eax
call fcn.00416700
lea edx, [ebp - 0x214]
mov ecx, eax
call fcn.00419cf0
mov edx, str._installed_as
mov ecx, eax
call fcn.00416700
lea edx, [ebp - 0x414]
mov ecx, eax
call fcn.00419cf0
mov edx, esi
mov ecx, eax
call fcn.00416700
push eax
call fcn.00416a70
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4b4]
call fcn.00418110
lea eax, [ebp - 0x488]
mov dword [ebp - 0x488], 0x200
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x418]
push eax
push 2
push str.DisplayVersion
push 0
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x44ad32
lea ecx, [ebp - 0x214]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44ad10
sub ecx, edx
lea eax, [ebp - 0x214]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x450]
call fcn.004181e0
lea eax, [ebp - 0x488]
push eax
push 0
lea eax, [ebp - 0x418]
push eax
push 2
push str.InstallLocation
push 0
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x44adc6
mov eax, dword [ebp - 0x488]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0057ce9e
add esp, 4
mov esi, eax
lea eax, [ebp - 0x488]
push eax
push esi
lea eax, [ebp - 0x418]
push eax
push 2
push str.InstallLocation
push 0
push dword [ebp - 0x48c]
call edi
test eax, eax
jne 0x44adbd
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x44ada1
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x438]
call fcn.004181e0
push esi
call fcn.0057cb5b
add esp, 4
lea ecx, [ebp - 0x4b4]
call fcn.0044a310
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x44ade0
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x66f280
call fcn.00417550
add esp, 4
mov edx, str.d:jenkinsworkspace_n_sucommon_src_sucommoninstalledproducts.cpp
mov ecx, eax
call fcn.00416700
mov edx, 0x643b2c
mov ecx, eax
call fcn.00416700
push 0x49
mov ecx, eax
call fcn.00414f30
mov edx, str.:_DisplayVersion
mov ecx, eax
call fcn.00416700
cmp dword [ebp - 0x43c], 8
lea edx, [ebp - 0x450]
push dword [ebp - 0x440]
cmovae edx, dword [ebp - 0x450]
mov ecx, eax
call fcn.00417550
add esp, 4
mov edx, str.__InstallLocation
mov ecx, eax
call fcn.00416700
cmp dword [ebp - 0x424], 8
lea edx, [ebp - 0x438]
push dword [ebp - 0x428]
cmovae edx, dword [ebp - 0x438]
mov ecx, eax
call fcn.00417550
add esp, 4
push eax
call fcn.00416a70
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x4b4]
call fcn.00418110
mov edi, dword [ebp - 0x498]
mov esi, dword [edi + 8]
cmp dword [edi + 0xc], esi
je 0x44aefa
lea eax, [ebp - 0x480]
mov dword [ebp - 0x49c], esi
lea ecx, [esi + 4]
mov dword [esi], vtable.InstalledProducts::InstalledProduct.0
push eax
call fcn.00437600
lea eax, [ebp - 0x468]
mov byte [ebp - 4], 5
lea ecx, [esi + 0x1c]
push eax
call fcn.00437600
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 6
lea ecx, [esi + 0x34]
push eax
call fcn.00437600
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 7
lea ecx, [esi + 0x4c]
push eax
call fcn.00437600
mov al, byte [ebp - 0x420]
mov byte [esi + 0x64], al
add dword [edi + 8], 0x68
jmp 0x44af0a
lea eax, [ebp - 0x484]
push eax
push esi
lea ecx, [edi + 4]
call fcn.0044b880
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x438]
mov dword [ebp - method.InstalledProducts::InstalledProduct.virtual_0], vtable.InstalledProducts::InstalledProduct.0
call fcn.00418110
lea ecx, [ebp - 0x450]
call fcn.00418110
lea ecx, [ebp - 0x468]
call fcn.00418110
lea ecx, [ebp - 0x480]
call fcn.00418110
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
push dword [ebp - 0x48c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
jmp 0x44aa04
lea ecx, [ebp - 0x4b4]
call fcn.0044a310
mov dword [ebp - 4], 8
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x44af7c
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x66f280
call fcn.00417550
add esp, 4
mov edx, str.d:jenkinsworkspace_n_sucommon_src_sucommoninstalledproducts.cpp
mov ecx, eax
call fcn.00416700
mov edx, 0x643b2c
mov ecx, eax
call fcn.00416700
push 0x50
mov ecx, eax
call fcn.00414f30
mov edx, str.:_Error_opening_uninstall_key__
mov ecx, eax
call fcn.00416700
lea edx, [ebp - 0x414]
mov ecx, eax
call fcn.00419cf0
mov edx, 0x649c48
mov ecx, eax
call fcn.00416700
push esi
mov ecx, eax
call fcn.00414d80
mov edx, 0x649c44
mov ecx, eax
call fcn.00416700
push eax
call fcn.00416a70
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4b4]
call fcn.00418110
inc ebx
test esi, esi
je 0x44aa04
push dword [ebp - 0x490]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x44b09d
lea ecx, [ebp - 0x4cc]
call fcn.0044a310
mov dword [ebp - 4], 9
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x44b038
mov eax, dword [eax]
push ecx
mov edx, eax
mov ecx, 0x66f280
call fcn.00417550
add esp, 4
mov edx, str.d:jenkinsworkspace_n_sucommon_src_sucommoninstalledproducts.cpp
mov ecx, eax
call fcn.00416700
mov edx, 0x643b2c
mov ecx, eax
call fcn.00416700
push 0x58
mov ecx, eax
call fcn.00414f30
mov edx, str.:_Error_opening_root_uninstall_key__
mov ecx, eax
call fcn.00416700
push esi
mov ecx, eax
call fcn.00414d80
mov edx, 0x649c44
mov ecx, eax
call fcn.00416700
push eax
call fcn.00416a70
add esp, 4
lea ecx, [ebp - 0x4cc]
call fcn.00418110
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0057c5eb
mov esp, ebp
pop ebp
ret 4