The benefit of our freeware not being open source is that we retain full control over distribution and packaging. Unlike nmap and others, we actually have a legal right to demand that CNet, et. al. either host the unaltered EXE or pull their listing.

This isn't correct. Having open source software only means that you have to provide a way to get the source (for example, a download link, or an email address to contact; note you don't have to provide the source itself directly). You can control the branding of your application so only the official bundle can be distributed under your applications's name.

If you take a look at Mozilla Firefox, it can only be branded as such if it hasn't been modified. If you do modify it, you have to turn off branding, and you get a generic globe icon with the development name. This only applies to the program itself however, not the installer. For your case you could probably mandate that distribution of a binary installer with your application name must be your official installer.