Function at 0x44d4d0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
sub esp, 0x41c
mov eax, dword [0x4e44b4]
xor eax, esp
mov dword [esp + 0x418], eax
push ebx
push esi
push edi
push 0x40e
lea eax, [esp + 0x1a]
push 0
push eax
mov esi, ecx
mov word [esp + 0x20], 0
call fcn.00499a30
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
push str.HTTP_shellopencommand
push closesocket
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44d734
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0x4cadec
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x44d734
mov edx, str.IEXPLORE.EXE
lea ecx, [esp + 0x14]
call fcn.0044d760
test eax, eax
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, 8
jle 0x44d5bc
push esi
lea ecx, [esp + 0x18]
call fcn.0044d900
cmp dword [esi + 0x14], 0
jbe 0x44d5bc
cmp dword [esi + 0x18], ebx
jb 0x44d58d
mov eax, dword [esi + 4]
jmp 0x44d590
lea eax, [esi + 4]
push eax
call edi
test eax, eax
je 0x44d5bc
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00495cb8
add esp, 0x41c
ret
mov edx, str.firefox.exe
lea ecx, [esp + 0x14]
call fcn.0044d760
test eax, eax
jle 0x44d61a
push esi
lea ecx, [esp + 0x18]
call fcn.0044d900
cmp dword [esi + 0x14], 0
jbe 0x44d61a
cmp dword [esi + 0x18], ebx
jb 0x44d5e8
mov eax, dword [esi + 4]
jmp 0x44d5eb
lea eax, [esi + 4]
push eax
call edi
test eax, eax
je 0x44d61a
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00495cb8
add esp, 0x41c
ret
mov edx, str.Maxthon.exe
lea ecx, [esp + 0x14]
call fcn.0044d760
test eax, eax
jle 0x44d678
push esi
lea ecx, [esp + 0x18]
call fcn.0044d900
cmp dword [esi + 0x14], 0
jbe 0x44d678
cmp dword [esi + 0x18], ebx
jb 0x44d646
mov eax, dword [esi + 4]
jmp 0x44d649
lea eax, [esi + 4]
push eax
call edi
test eax, eax
je 0x44d678
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 2
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00495cb8
add esp, 0x41c
ret
mov edx, str.TTraveler.exe
lea ecx, [esp + 0x14]
call fcn.0044d760
test eax, eax
jle 0x44d6d6
push esi
lea ecx, [esp + 0x18]
call fcn.0044d900
cmp dword [esi + 0x14], 0
jbe 0x44d6d6
cmp dword [esi + 0x18], ebx
jb 0x44d6a4
mov eax, dword [esi + 4]
jmp 0x44d6a7
lea eax, [esi + 4]
push eax
call edi
test eax, eax
je 0x44d6d6
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 3
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00495cb8
add esp, 0x41c
ret
mov edx, str.chrome.exe
lea ecx, [esp + 0x14]
call fcn.0044d760
test eax, eax
jle 0x44d734
push esi
lea ecx, [esp + 0x18]
call fcn.0044d900
cmp dword [esi + 0x14], 0
jbe 0x44d734
cmp dword [esi + 0x18], ebx
jb 0x44d702
mov esi, dword [esi + 4]
jmp 0x44d705
add esi, 4
push esi
call edi
test eax, eax
je 0x44d734
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, 4
pop ebx
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00495cb8
add esp, 0x41c
ret
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 5
call fcn.00495cb8
add esp, 0x41c
ret