Function at 0x488be0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x694e92
mov eax, dword fs:[0]
push eax
sub esp, 0x514
mov eax, dword [0x73d6e0]
xor eax, esp
mov dword [esp + 0x510], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x73d6e0]
xor eax, esp
push eax
lea eax, [esp + 0x528]
mov dword fs:[0], eax
push 0x37
xor eax, eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
lea ecx, [esp + 0x4c]
push str.SOFTWAREClasses_shellexContextMenuHandlers_
mov dword [esp + 0x4c], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], 0
mov word [esp + 0x50], ax
call fcn.00409260
mov dword [esp + 0x530], 0
xor eax, eax
push 0x32
mov dword [esp + 0x78], 0
lea ecx, [esp + 0x68]
mov dword [esp + 0x7c], 0
push str.SOFTWAREClasses_shellexDragDropHandlersHaoZip
mov dword [esp + 0x68], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
call fcn.00409260
mov byte [esp + 0x530], 1
xor eax, eax
push 0x37
mov dword [esp + 0x94], 0
lea ecx, [esp + 0x84]
mov dword [esp + 0x98], 0
push str.SOFTWAREClasses_shellexPropertySheetHandlersHaoZip
mov dword [esp + 0x84], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x9c], 7
mov dword [esp + 0x98], 0
mov word [esp + 0x88], ax
call fcn.00409260
mov byte [esp + 0x530], 2
xor eax, eax
push 0x3d
mov dword [esp + 0xb0], 0
lea ecx, [esp + 0xa0]
mov dword [esp + 0xb4], 0
push str.SOFTWAREClassesCLSID5FED836A_C96C_4d88_A91E_F63F07726585
mov dword [esp + 0xa0], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0xb8], 7
mov dword [esp + 0xb4], 0
mov word [esp + 0xa4], ax
call fcn.00409260
mov byte [esp + 0x530], 3
xor eax, eax
push 0x4c
mov dword [esp + 0xcc], 0
lea ecx, [esp + 0xbc]
mov dword [esp + 0xd0], 0
push str.SOFTWAREClassesCLSID5FED836A_C96C_4d88_A91E_F63F07726585InprocServer32
mov dword [esp + 0xbc], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0xd4], 7
mov dword [esp + 0xd0], 0
mov word [esp + 0xc0], ax
call fcn.00409260
mov byte [esp + 0x530], 4
xor eax, eax
push 0x3f
mov dword [esp + 0xe8], 0
lea ecx, [esp + 0xd8]
mov dword [esp + 0xec], 0
push str.SOFTWAREClassesDirectory_shellexContextMenuHandlers_
mov dword [esp + 0xd8], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0xf0], 7
mov dword [esp + 0xec], 0
mov word [esp + 0xdc], ax
call fcn.00409260
mov byte [esp + 0x530], 5
mov dword [esp + 0xec], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x100], 0
mov dword [esp + 0x104], 0
push 0x3a
xor eax, eax
mov dword [esp + 0x108], 7
push str.SOFTWAREClassesDirectory_shellexDragDropHandlersHaoZip
lea ecx, [esp + 0xf8]
mov dword [esp + 0x108], 0
mov word [esp + 0xf8], ax
call fcn.00409260
mov byte [esp + 0x530], 6
xor eax, eax
push 0x3b
mov dword [esp + 0x120], 0
lea ecx, [esp + 0x110]
mov dword [esp + 0x124], 0
push str.SOFTWAREClassesDrive_shellexContextMenuHandlers_
mov dword [esp + 0x110], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x128], 7
mov dword [esp + 0x124], 0
mov word [esp + 0x114], ax
call fcn.00409260
mov byte [esp + 0x530], 7
xor eax, eax
push 0x36
mov dword [esp + 0x13c], 0
lea ecx, [esp + 0x12c]
mov dword [esp + 0x140], 0
push str.SOFTWAREClassesDrive_shellexDragDropHandlersHaoZip
mov dword [esp + 0x12c], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x144], 7
mov dword [esp + 0x140], 0
mov word [esp + 0x130], ax
call fcn.00409260
mov byte [esp + 0x530], 8
xor eax, eax
push 0x3c
mov dword [esp + 0x158], 0
lea ecx, [esp + 0x148]
mov dword [esp + 0x15c], 0
push str.SOFTWAREClassesFolderShellExContextMenuHandlers_
mov dword [esp + 0x148], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x160], 7
mov dword [esp + 0x15c], 0
mov word [esp + 0x14c], ax
call fcn.00409260
mov byte [esp + 0x530], 9
xor eax, eax
push 0x37
mov dword [esp + 0x174], 0
lea ecx, [esp + 0x164]
mov dword [esp + 0x178], 0
push str.SOFTWAREClassesFolderShellExDragDropHandlersHaoZip
mov dword [esp + 0x164], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x17c], 7
mov dword [esp + 0x178], 0
mov word [esp + 0x168], ax
call fcn.00409260
mov byte [esp + 0x530], 0xa
xor eax, eax
push 0x3d
mov dword [esp + 0x190], 0
lea ecx, [esp + 0x180]
mov dword [esp + 0x194], 0
push str.SOFTWAREClasseslnkfile_shellexContextMenuHandlers_
mov dword [esp + 0x180], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x198], 7
mov dword [esp + 0x194], 0
mov word [esp + 0x184], ax
call fcn.00409260
mov byte [esp + 0x530], 0xb
xor eax, eax
mov dword [esp + 0x1a8], 0
mov dword [esp + 0x1ac], 0
mov dword [esp + 0x194], reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1ac], 7
mov dword [esp + 0x1a8], 0
push 0x38
push str.SOFTWAREClasseslnkfile_shellexDragDropHandlersHaoZip
lea ecx, [esp + 0x1a0]
mov word [esp + 0x1a0], ax
call fcn.00409260
mov byte [esp + 0x530], 0xc
xor eax, eax
push 0x26
mov dword [esp + 0x1c8], 0
lea ecx, [esp + 0x1b8]
mov dword [esp + 0x1cc], 0
push str._shellexContextMenuHandlers_
mov dword [esp + 0x1b8], SysReAllocString
mov dword [esp + 0x1d0], 7
mov dword [esp + 0x1cc], 0
mov word [esp + 0x1bc], ax
call fcn.00409260
mov byte [esp + 0x530], 0xd
xor eax, eax
push 0x21
mov dword [esp + 0x1e4], 0
lea ecx, [esp + 0x1d4]
mov dword [esp + 0x1e8], 0
push str._shellexDragDropHandlersHaoZip
mov dword [esp + 0x1d4], SysReAllocString
mov dword [esp + 0x1ec], 7
mov dword [esp + 0x1e8], 0
mov word [esp + 0x1d8], ax
call fcn.00409260
mov byte [esp + 0x530], 0xe
xor eax, eax
push 0x26
mov dword [esp + 0x200], 0
lea ecx, [esp + 0x1f0]
mov dword [esp + 0x204], 0
push str._shellexPropertySheetHandlersHaoZip
mov dword [esp + 0x1f0], SysReAllocString
mov dword [esp + 0x208], 7
mov dword [esp + 0x204], 0
mov word [esp + 0x1f4], ax
call fcn.00409260
mov byte [esp + 0x530], 0xf
xor eax, eax
push 0x2c
mov dword [esp + 0x21c], 0
lea ecx, [esp + 0x20c]
mov dword [esp + 0x220], 0
push str.CLSID5FED836A_C96C_4d88_A91E_F63F07726585
mov dword [esp + 0x20c], SysReAllocString
mov dword [esp + 0x224], 7
mov dword [esp + 0x220], 0
mov word [esp + 0x210], ax
call fcn.00409260
mov byte [esp + 0x530], 0x10
xor eax, eax
push 0x3b
mov dword [esp + 0x238], 0
lea ecx, [esp + 0x228]
mov dword [esp + 0x23c], 0
push str.CLSID5FED836A_C96C_4d88_A91E_F63F07726585InprocServer32
mov dword [esp + 0x228], SysReAllocString
mov dword [esp + 0x240], 7
mov dword [esp + 0x23c], 0
mov word [esp + 0x22c], ax
call fcn.00409260
mov byte [esp + 0x530], 0x11
xor eax, eax
push 0x2e
mov dword [esp + 0x254], 0
mov dword [esp + 0x258], 0
mov dword [esp + 0x240], SysReAllocString
mov dword [esp + 0x258], 7
mov dword [esp + 0x254], 0
mov word [esp + 0x244], ax
push str.Directory_shellexContextMenuHandlers_
lea ecx, [esp + 0x248]
call fcn.00409260
mov byte [esp + 0x530], 0x12
xor eax, eax
push 0x29
mov dword [esp + 0x270], 0
lea ecx, [esp + 0x260]
mov dword [esp + 0x274], 0
push str.Directory_shellexDragDropHandlersHaoZip
mov dword [esp + 0x260], SysReAllocString
mov dword [esp + 0x278], 7
mov dword [esp + 0x274], 0
mov word [esp + 0x264], ax
call fcn.00409260
mov byte [esp + 0x530], 0x13
xor eax, eax
push 0x2a
mov dword [esp + 0x28c], 0
lea ecx, [esp + 0x27c]
mov dword [esp + 0x290], 0
push str.Drive_shellexContextMenuHandlers_
mov dword [esp + 0x27c], SysReAllocString
mov dword [esp + 0x294], 7
mov dword [esp + 0x290], 0
mov word [esp + 0x280], ax
call fcn.00409260
mov byte [esp + 0x530], 0x14
xor eax, eax
push 0x25
mov dword [esp + 0x2a8], 0
lea ecx, [esp + 0x298]
mov dword [esp + 0x2ac], 0
push str.Drive_shellexDragDropHandlersHaoZip
mov dword [esp + 0x298], SysReAllocString
mov dword [esp + 0x2b0], 7
mov dword [esp + 0x2ac], 0
mov word [esp + 0x29c], ax
call fcn.00409260
mov byte [esp + 0x530], 0x15
xor eax, eax
push 0x2b
mov dword [esp + 0x2c4], 0
lea ecx, [esp + 0x2b4]
mov dword [esp + 0x2c8], 0
push str.FolderShellExContextMenuHandlers_
mov dword [esp + 0x2b4], SysReAllocString
mov dword [esp + 0x2cc], 7
mov dword [esp + 0x2c8], 0
mov word [esp + 0x2b8], ax
call fcn.00409260
mov byte [esp + 0x530], 0x16
xor eax, eax
push 0x26
mov dword [esp + 0x2e0], 0
lea ecx, [esp + 0x2d0]
mov dword [esp + 0x2e4], 0
push str.FolderShellExDragDropHandlersHaoZip
mov dword [esp + 0x2d0], SysReAllocString
mov dword [esp + 0x2e8], 7
mov dword [esp + 0x2e4], 0
mov word [esp + 0x2d4], ax
call fcn.00409260
mov byte [esp + 0x530], 0x17
xor eax, eax
push 0x2c
mov dword [esp + 0x2fc], 0
lea ecx, [esp + 0x2ec]
mov dword [esp + 0x300], 0
push str.lnkfile_shellexContextMenuHandlers_
mov dword [esp + 0x2ec], SysReAllocString
mov dword [esp + 0x304], 7
mov dword [esp + 0x300], 0
mov word [esp + 0x2f0], ax
call fcn.00409260
mov byte [esp + 0x530], 0x18
xor eax, eax
push 0x27
mov dword [esp + 0x318], 0
lea ecx, [esp + 0x308]
mov dword [esp + 0x31c], 0
push str.lnkfile_shellexDragDropHandlersHaoZip
mov dword [esp + 0x308], SysReAllocString
mov dword [esp + 0x320], 7
mov dword [esp + 0x31c], 0
mov word [esp + 0x30c], ax
call fcn.00409260
mov dword [esp + 0x530], 0x19
xor eax, eax
push 0xc
mov dword [esp + 0x34], 0
lea ecx, [esp + 0x24]
mov dword [esp + 0x38], 0
push 0x6eb9d0
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
call fcn.00409260
mov byte [esp + 0x530], 0x1a
mov eax, dword [0x74fd44]
test al, 1
jne 0x4895ce
or eax, 1
mov dword [0x74fd44], eax
mov byte [esp + 0x530], 0x1b
mov dword [0x74fd40], 0
call fcn.004375a0
push 0x6b5140
call fcn.00547b44
add esp, 4
mov byte [esp + 0x530], 0x1a
lea eax, [esp + 0x20]
mov ecx, 0x74fd40
push eax
call fcn.00437760
mov ebx, eax
mov byte [esp + 0x530], 0x19
cmp dword [esp + 0x34], 8
jb 0x4895fa
push dword [esp + 0x20]
call fcn.005472b4
add esp, 4
xor eax, eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
test ebx, ebx
je 0x4897ec
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x6ebab8
push ebx
call esi
push str.RegQueryValueExW
mov ebp, eax
push ebx
mov dword [esp + 0x24], ebp
call esi
push 0x6ebacc
mov edi, eax
push ebx
mov dword [esp + 0x20], edi
call esi
mov ebx, eax
test ebp, ebp
je 0x4897ec
test edi, edi
je 0x4897ec
test ebx, ebx
je 0x4897ec
push 0x206
lea eax, [esp + 0x322]
mov byte [esp + 0x1b], 1
push 0
push eax
call fcn.00549c70
add esp, 0xc
lea esi, [esp + 0x48]
xor ebp, ebp
nop
xor eax, eax
mov dword [esp + 0x38], 0
mov word [esp + 0x31c], ax
mov eax, dword [esi - 4]
mov dword [esp + 0x40], 1
mov dword [esp + 0x3c], 0x103
cmp eax, reloc.OLEAUT32.dll_SysReAllocString
jne 0x489708
mov edi, 0x20019
call fcn.00426be0
test al, al
mov eax, 0x20119
cmovne edi, eax
cmp dword [esi + 0x14], 8
jb 0x4896ca
mov eax, dword [esi]
jmp 0x4896cc
mov eax, esi
lea ecx, [esp + 0x38]
push ecx
push edi
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [esp + 0x30]
test eax, eax
jne 0x4897c3
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x320]
push eax
lea eax, [esp + 0x48]
push eax
push 0
push 0
push dword [esp + 0x4c]
call edi
jmp 0x489767
cmp eax, 0x80000000
jne 0x4897a9
mov edi, 0x20019
call fcn.00426be0
test al, al
mov eax, 0x20119
cmovne edi, eax
cmp dword [esi + 0x14], 8
jb 0x489731
mov eax, dword [esi]
jmp 0x489733
mov eax, esi
lea ecx, [esp + 0x38]
push ecx
push edi
push 0
push eax
push SysReAllocString
call dword [esp + 0x30]
test eax, eax
jne 0x4897c3
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x320]
push eax
lea eax, [esp + 0x48]
push eax
push 0
push 0
push dword [esp + 0x4c]
call dword [esp + 0x30]
test eax, eax
jne 0x4897bd
mov eax, dword [esp + 0x3c]
mov ecx, 0x103
cmp eax, 0x103
cmovae eax, ecx
mov dword [esp + 0x3c], eax
add eax, eax
cmp eax, 0x208
jae 0x4897b8
xor ecx, ecx
mov word [esp + eax + 0x31c], cx
lea ecx, [esp + 0x31c]
call fcn.0041ca20
push dword [esp + 0x38]
test eax, eax
je 0x4897c1
call ebx
inc ebp
add esi, 0x1c
cmp ebp, 0x1a
jb 0x489680
jmp 0x4897c8
call fcn.00548193
push dword [esp + 0x38]
call ebx
mov byte [esp + 0x17], 0
mov dword [esp + 0x530], 0xffffffff
lea eax, [esp + 0x44]
push fcn.00489840
push 0x1a
push 0x1c
push eax
call fcn.0054794c
mov al, byte [esp + 0x17]
jmp 0x48980c
mov dword [esp + 0x530], 0xffffffff
lea eax, [esp + 0x44]
push fcn.00489840
push 0x1a
push 0x1c
push eax
call fcn.0054794c
xor al, al
mov ecx, dword [esp + 0x528]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.005472b9
add esp, 0x520
ret