Function at 0x445f3c
Capabilities:
Enumerate gui resources
Get installed programs
Query or enumerate registry key

Disassembly:
push ebp
push ebx
mov edx, 0xe
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x445f43
call fcn.005423e0
push dword [esp + 0x4c]
call fcn.004fa4e0
cmp byte [esp + 0x48], 0
je 0x4461ff
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
call fcn.0051d880
call fcn.004fa482
add dword [esp], edx
call fcn.00522f23
lea ebp, [0x72ab68]
mov edx, dword [ebp + 8]
push edx
call fcn.00542310
mov edx, str._exepath.txt
push edx
call fcn.00542310
lea eax, [esp + 0x30]
push eax
call fcn.00542280
push dword [esp + 0x2c]
push 0xffffffff
call fcn.00523e70
mov dword [esp], eax
cmp dword [esp], 0
je 0x446051
push dword [esp]
call fcn.00523f30
mov dword [esp + 0x34], eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, 0x6203b6
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x50]
push dword [esp + 0x20]
call fcn.005240a0
call fcn.004fa482
add dword [esp], edx
call fcn.0053fb20
call fcn.004fa482
add dword [esp], edx
call fcn.0053fc10
lea eax, [esp + 0x34]
push eax
call fcn.00542280
push dword [esp]
call fcn.00523a00
lea ebp, [0x72ab68]
mov ebx, dword [ebp + 0x34]
cmp ebx, 0xd
je 0x44606f
lea ebp, [0x72ab68]
mov ebx, dword [ebp + 0x38]
cmp ebx, 0x10
je 0x44606f
jmp 0x446076
mov eax, 1
jmp 0x446078
xor eax, eax
and eax, eax
jne 0x44608c
lea ebp, [0x72ab68]
mov ebx, dword [ebp + 0x34]
cmp ebx, 0xc
je 0x44608c
jmp 0x446093
mov eax, 1
jmp 0x446095
xor eax, eax
and eax, eax
je 0x4460de
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
lea ebp, [0x72ab68]
push dword [ebp]
call fcn.0053f5c0
call fcn.004fa482
add dword [esp], edx
call fcn.004c9f73
lea ebp, [0x72a978]
lea eax, [ebp + 0x9c]
push eax
call fcn.00542280
lea ebp, [0x72a850]
mov dword [ebp + 0x88], 0
lea ebp, [0x72ab68]
mov ebx, dword [ebp + 0x34]
cmp ebx, 0xb
je 0x44610d
push 0
lea eax, [0x461583]
push eax
call sub.USER32.dll_EnumWindows
lea ebp, [0x72ab68]
mov ebx, dword [ebp + 0x34]
cmp ebx, 0xb
je 0x44612a
mov ebx, dword [ebp + 0x34]
cmp ebx, 0xe
je 0x44612a
mov eax, 1
jmp 0x44612c
xor eax, eax
and eax, eax
je 0x4461c6
lea ebp, [0x72a978]
mov edx, dword [ebp + 0x9c]
xor ecx, ecx
call fcn.004fa4a0
jne 0x446162
push dword [esp + 0x30]
mov edx, dword [ebp + 0x9c]
pop ecx
call fcn.004fa4a0
jne 0x446162
mov eax, 1
jmp 0x446164
xor eax, eax
and eax, eax
je 0x4461c6
lea ebp, [0x72a978]
mov edx, dword [ebp + 0x9c]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
lea eax, [esp + 0x34]
push eax
call fcn.00542280
push dword [esp + 0x2c]
call fcn.00482439
mov dword [esp], eax
cmp dword [esp], 0
je 0x4461c6
push 2
push dword [esp + 4]
call fcn.00524270
push 2
push dword [esp + 0x34]
push dword [esp + 8]
call fcn.005244d0
push dword [esp]
call fcn.00523a00
cmp byte [esp + 0x44], 0
je 0x4461fa
mov edx, dword [esp + 0x30]
xor ecx, ecx
call fcn.004fa4a0
jne 0x4461fa
lea ebp, [0x72ad80]
cmp dword [ebp + 0x24], 0
je 0x4461fa
push 0
push 0x7d
push 0
call fcn.0051f5f9
jmp 0x4464f4
lea ebp, [0x72ab68]
cmp dword [ebp + 0x6c], 0
jne 0x44621a
lea ebp, [0x72ab68]
mov ebx, dword [ebp + 0x34]
and ebx, ebx
je 0x44621a
jmp 0x446221
mov eax, 1
jmp 0x446223
xor eax, eax
and eax, eax
je 0x4464f4
push 0x8000
call fcn.005410b0
mov dword [esp + 0xc], eax
push 0x8000
call fcn.005410b0
mov dword [esp + 0x14], eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
mov eax, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call sub.ADVAPI32.dll_RegOpenKeyExW
mov ebx, eax
and ebx, ebx
jne 0x4464e2
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
mov ebx, dword [esp + 0x24]
and ebx, ebx
jne 0x4464d9
mov dword [esp + 8], 0x8000
push 0
push dword [esp + 0x10]
pop eax
call fcn.004fa410
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x20]
push dword [esp + 0x38]
push dword [esp + 0x20]
call sub.ADVAPI32.dll_RegEnumKeyExW
mov dword [esp + 0x24], eax
mov ebx, dword [esp + 0x24]
and ebx, ebx
jne 0x4464cb
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x14]
call fcn.005410d0
lea eax, [esp + 0x2c]
push eax
call fcn.00542280
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x30]
call fcn.0053fc10
call fcn.004fa4f0
cmp word [eax], 0
je 0x4464cb
push edx
call fcn.00542240
pop edx
push eax
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push edx
call fcn.00542240
pop edx
push eax
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
push edx
call fcn.00542310
mov edx, dword [esp + 0x3c]
push edx
call fcn.00542310
call fcn.00542370
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004fa482
add dword [esp + 4], edx
call sub.ADVAPI32.dll_RegOpenKeyExW
call fcn.004fa4e0
mov ebx, eax
and ebx, ebx
jne 0x4464cb
push edx
call fcn.00542240
pop edx
push eax
push 0x8000
push dword [esp + 0x1c]
mov eax, str.DisplayIcon
push eax
push dword [esp + 0x20]
call fcn.004e4299
lea eax, [esp + 0x34]
push eax
call fcn.00542280
push dword [esp + 0x10]
call sub.ADVAPI32.dll_RegCloseKey
mov edx, dword [esp + 0x30]
xor ecx, ecx
call fcn.004fa4a0
jne 0x4464cb
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov edx, 0x62263e
push edx
call fcn.00542310
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
lea ebp, [0x72ab68]
push dword [ebp]
call fcn.0053f5c0
pop eax
call fcn.00542370
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push dword [esp + 0x40]
call fcn.0053f5c0
call fcn.004fa482
add dword [esp], edx
call fcn.004fa482
add dword [esp + 4], edx
call fcn.0053f8e0
call fcn.004fa4e0
and eax, eax
je 0x4464cb
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, 0x6203b6
push eax
push dword [esp + 0x3c]
call fcn.0053fb20
lea eax, [esp + 0x34]
push eax
call fcn.00542280
mov eax, 0x62088a
push eax
push dword [esp + 0x34]
call fcn.0053f8e0
and eax, eax
je 0x4464c9
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, 0x62088a
push eax
push 1
push dword [esp + 0x48]
call fcn.0053f490
call fcn.004fa482
add dword [esp], edx
call fcn.0053fc10
lea eax, [esp + 0x34]
push eax
call fcn.00542280
jmp 0x4464d9
mov ebx, dword [esp + 0x20]
inc ebx
mov dword [esp + 0x20], ebx
jmp 0x446280
push dword [esp + 4]
call sub.ADVAPI32.dll_RegCloseKey
push dword [esp + 0xc]
call fcn.00541120
push dword [esp + 0x14]
call fcn.00541120
mov edx, dword [esp + 0x30]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
pop eax
push eax
call fcn.004fa470
pop edx
add eax, edx
jmp 0x44651c
push dword [esp + 0x2c]
call fcn.00542440
push dword [esp + 0x30]
call fcn.00542440
push dword [esp + 0x28]
call fcn.00542440
add esp, 0x38
pop ebx
pop ebp
ret 8