Function at 0x4598b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, 7
xor ebx, ebx
xor ecx, ecx
mov dword [esi + 0x18], eax
push edi
mov edi, dword [ebp + 0xc]
mov dword [esi + 0x14], ebx
mov word [esi + 4], cx
xor edx, edx
mov dword [ebp - 0x214], eax
mov eax, edi
mov word [ebp - 0x228], dx
mov dword [ebp - 0x218], ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x459900
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [ebp - 0x22c]
call fcn.0044fc50
push 0x13
push str._shellopencommand
lea ecx, [ebp - 0x22c]
call fcn.00451500
cmp dword [ebp - 0x214], 8
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x24c], ebx
jae 0x459949
lea eax, [ebp - 0x228]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea ecx, [ebp - 0x24c]
push ecx
push eax
push SysReAllocString
call ebx
test eax, eax
jne 0x4599f8
xor edx, edx
push 0x208
mov dword [ebp - 0x254], eax
push edx
lea eax, [ebp - 0x20e]
push eax
mov word [ebp - 0x210], dx
call fcn.0051d250
add esp, 0xc
lea ecx, [ebp - 0x250]
push ecx
mov ecx, dword [ebp - 0x24c]
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x254]
push eax
push 0
push 0
push ecx
mov dword [ebp - 0x250], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor edx, edx
mov word [ebp - 8], dx
test eax, eax
jne 0x4599eb
cmp dword [ebp - 0x254], 1
jne 0x4599eb
mov eax, dword [ebp - 0x250]
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x4599eb
lea ecx, [ebp - 0x210]
push ecx
mov ecx, esi
call fcn.00459860
mov edx, dword [ebp - 0x24c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004185b0
test al, al
je 0x459b18
cmp dword [esi + 0x18], 8
jb 0x459a10
mov eax, dword [esi + 4]
jmp 0x459a13
lea eax, [esi + 4]
push str.C:Windows_system32LaunchWinApp.exe
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x459b18
lea eax, [ebp - 0x24c]
push eax
push edi
push SysReAllocString
call ebx
test eax, eax
jne 0x459b18
xor ecx, ecx
push 0x208
push ecx
lea edx, [ebp - 0x20e]
push edx
mov dword [ebp - 0x250], eax
mov word [ebp - 0x210], cx
call fcn.0051d250
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
mov eax, dword [ebp - 0x24c]
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x250]
push edx
push 0
push str.FriendlyTypeName
push eax
mov dword [ebp - 0x254], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
mov word [ebp - 8], cx
test eax, eax
jne 0x459b0b
cmp dword [ebp - 0x250], 1
jne 0x459b0b
mov edx, dword [ebp - 0x254]
and edx, 0xfffffffe
cmp edx, 0x208
jae 0x459b0b
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x248]
call fcn.004597f0
cmp dword [ebp - 0x230], 8
mov eax, dword [ebp - 0x244]
jae 0x459ae0
lea eax, [ebp - 0x244]
mov ecx, dword [str.MicrosoftEdge]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x459b00
mov edx, dword [str.MicrosoftEdge]
push edx
mov ecx, esi
call fcn.00459860
lea ecx, [ebp - 0x248]
call fcn.00449950
mov eax, dword [ebp - 0x24c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x214], 8
jb 0x459b30
mov ecx, dword [ebp - 0x228]
push ecx
call fcn.0051d230
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0051d23b
mov esp, ebp
pop ebp
ret