Function at 0x453a70
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x5d94
call fcn.004fa800
mov eax, dword [0x5954a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x5d90], ecx
mov eax, dword [ebp - 0x5d90]
add eax, 4
mov dword [ebp - 0x5c80], eax
mov ecx, dword [ebp - 0x5c80]
mov edx, dword [ebp - 0x5c80]
mov eax, dword [ecx + 0x10]
sub eax, dword [edx + 0xc]
sar eax, 2
neg eax
sbb eax, eax
add eax, 1
movzx ecx, al
test ecx, ecx
jne 0x453b82
mov edx, dword [ebp - 0x5d90]
add edx, 4
mov dword [ebp - 0x5c84], edx
mov eax, dword [ebp - 0x5c84]
mov ecx, dword [ebp - 0x5c84]
mov edx, dword [eax + 0x10]
sub edx, dword [ecx + 0xc]
sar edx, 2
mov dword [ebp - 0x5848], edx
mov dword [ebp - 0x584c], 0
jmp 0x453b08
mov eax, dword [ebp - 0x584c]
add eax, 1
mov dword [ebp - 0x584c], eax
mov ecx, dword [ebp - 0x584c]
cmp ecx, dword [ebp - 0x5848]
jge 0x453b74
mov edx, dword [ebp - 0x5d90]
add edx, 4
mov dword [ebp - 0x5c88], edx
mov eax, dword [ebp - 0x5c88]
mov ecx, dword [ebp - 0x5c88]
mov edx, dword [eax + 0x10]
sub edx, dword [ecx + 0xc]
sar edx, 2
cmp dword [ebp - 0x584c], edx
jb 0x453b47
call fcn.004fb0ce
xor eax, eax
jne 0x453b47
mov ecx, dword [ebp - 0x5c88]
mov edx, dword [ecx + 0xc]
mov eax, dword [ebp - 0x584c]
mov ecx, dword [edx + eax*4]
mov dword [ebp - 0x5c78], ecx
mov edx, dword [ebp - 0x5c78]
push edx
call fcn.004b3044
add esp, 4
jmp 0x453af9
mov ecx, dword [ebp - 0x5d90]
add ecx, 4
call fcn.00455840
lea eax, [ebp - 0x2018]
push eax
push 0x20019
push 0
push str.Applications
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x583c], eax
cmp dword [ebp - 0x583c], 0
je 0x453bbd
mov eax, dword [ebp - 0x5d90]
add eax, 4
jmp 0x454704
mov dword [ebp - 0x2014], 0
mov dword [ebp - 0x4834], 0
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x4834]
push ecx
lea edx, [ebp - 0x2014]
push edx
push 0
push 0
push 0
mov eax, dword [ebp - 0x2018]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x583c], eax
cmp dword [ebp - 0x583c], 0
je 0x453c28
mov ecx, dword [ebp - 0x2018]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x5d90]
add eax, 4
jmp 0x454704
mov dword [ebp - 0x2010], str.open
mov dword [ebp - 0x200c], str.edit
mov dword [ebp - 0x4028], 0x1000
xor edx, edx
mov word [ebp - 0x2008], dx
push 0x1ffe
push 0
lea eax, [ebp - 0x2006]
push eax
call fcn.004f8090
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x4020], cx
push 0x1ffe
push 0
lea edx, [ebp - 0x401e]
push edx
call fcn.004f8090
add esp, 0xc
mov byte [ebp - 0x5838], 0
push 0xfff
push 0
lea eax, [ebp - 0x5837]
push eax
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x2020], 0x1000
mov dword [ebp - 0x5844], 4
mov dword [ebp - 0x5840], 0
mov dword [ebp - 0x4838], 0
mov dword [ebp - 0x4838], 0
jmp 0x453ce4
mov ecx, dword [ebp - 0x4838]
add ecx, 1
mov dword [ebp - 0x4838], ecx
mov edx, dword [ebp - 0x4838]
cmp edx, dword [ebp - 0x2014]
jae 0x4543de
push 0x2000
push 0
lea eax, [ebp - 0x2008]
push eax
call fcn.004f8090
add esp, 0xc
push 0x2000
push 0
lea ecx, [ebp - 0x4020]
push ecx
call fcn.004f8090
add esp, 0xc
push 0x1000
push 0
lea edx, [ebp - 0x5838]
push edx
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x4028], 0x1000
push 0x608
push 0
lea eax, [ebp - 0x4830]
push eax
call fcn.004f8090
add esp, 0xc
mov ecx, dword [ebp - 0x4028]
push ecx
lea edx, [ebp - 0x2008]
push edx
mov eax, dword [ebp - 0x4838]
push eax
mov ecx, dword [ebp - 0x2018]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov dword [ebp - 0x583c], eax
cmp dword [ebp - 0x583c], 0
je 0x453d9a
cmp dword [ebp - 0x583c], 0xea
je 0x453d9a
jmp 0x4543de
mov dword [ebp - 0x5844], 1
mov dword [ebp - 0x2020], 0x1000
lea edx, [ebp - 0x2008]
push edx
push str.Applications_s
lea eax, [ebp - 0x4020]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x2020]
push ecx
lea edx, [ebp - 0x5838]
push edx
push 1
push str.NoOpenWith
lea eax, [ebp - 0x4020]
push eax
push SysReAllocStringLen
mov ecx, dword [ebp - 0x5d90]
call fcn.004538c0
test eax, eax
jne 0x453dff
jmp 0x453cd5
lea ecx, [ebp - 0x2008]
push ecx
lea edx, [ebp - 0x4830]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1000
push 0
lea eax, [ebp - 0x5838]
push eax
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x2020], 0x1000
mov dword [ebp - 0x5840], 0
jmp 0x453e4e
mov ecx, dword [ebp - 0x5840]
add ecx, 1
mov dword [ebp - 0x5840], ecx
cmp dword [ebp - 0x5840], 2
jae 0x453ecc
mov edx, dword [ebp - 0x5840]
mov eax, dword [ebp + edx*4 - 0x2010]
push eax
lea ecx, [ebp - 0x2008]
push ecx
push str.Applications_s_shell_scommand
lea edx, [ebp - 0x4020]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x2020]
push eax
lea ecx, [ebp - 0x5838]
push ecx
push 1
push 0x567128
lea edx, [ebp - 0x4020]
push edx
push SysReAllocStringLen
mov ecx, dword [ebp - 0x5d90]
call fcn.004538c0
test eax, eax
jne 0x453ec7
lea eax, [ebp - 0x5838]
push eax
lea ecx, [ebp - 0x4630]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x453ecc
jmp 0x453e3f
lea edx, [ebp - 0x4630]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x453ee2
jmp 0x453cd5
mov dword [ebp - 0x5858], 0
mov dword [ebp - 0x5854], 0
mov dword [ebp - 0x5860], 0
push 0x200
lea eax, [ebp - 0x4020]
push eax
lea ecx, [ebp - 0x4630]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x54574c
lea edx, [ebp - 0x4020]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov dword [ebp - 0x585c], eax
cmp dword [ebp - 0x585c], 0
je 0x45435d
push 0x1000
push 0
lea eax, [ebp - 0x5838]
push eax
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x2020], 0x1000
xor ecx, ecx
mov edx, dword [ebp - 0x585c]
mov word [edx + 8], cx
movzx eax, word [ebp - 0x4020]
cmp eax, 0x22
jne 0x453f84
lea ecx, [ebp - 0x401e]
mov dword [ebp - 0x5d94], ecx
jmp 0x453f90
lea edx, [ebp - 0x4020]
mov dword [ebp - 0x5d94], edx
mov eax, dword [ebp - 0x5d94]
mov dword [ebp - 0x5860], eax
push str.Rundll32.exe
mov ecx, dword [ebp - 0x5860]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x453fb7
jmp 0x453cd5
mov dword [ebp - 0x5858], 0
mov edx, dword [ebp - 0x5860]
push edx
mov ecx, dword [ebp - 0x5d90]
call fcn.00453930
mov dword [ebp - 0x5854], eax
cmp dword [ebp - 0x5854], 0
jne 0x4540a7
xor eax, eax
mov word [ebp - 0x5a60], ax
push 0x1fe
push 0
lea ecx, [ebp - 0x5a5e]
push ecx
call fcn.004f8090
add esp, 0xc
xor edx, edx
mov word [ebp - 0x5c60], dx
push 0x1fe
push 0
lea eax, [ebp - 0x5c5e]
push eax
call fcn.004f8090
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x5c60]
push ecx
push 0x100
lea edx, [ebp - 0x5a60]
push edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x5860]
push eax
call fcn.004fad12
add esp, 0x24
push 0x2000
push 0
lea ecx, [ebp - 0x4020]
push ecx
call fcn.004f8090
add esp, 0xc
push 0
lea edx, [ebp - 0x4020]
push edx
push 0x1000
lea eax, [ebp - 0x5c60]
push eax
lea ecx, [ebp - 0x5a60]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x5854], eax
je 0x4540a7
lea edx, [ebp - 0x4020]
mov dword [ebp - 0x5860], edx
cmp dword [ebp - 0x5854], 0
je 0x45435d
mov dword [ebp - 0x5c68], str.SoftwareMicrosoftWindowsShellNoRoamMUICache
mov dword [ebp - 0x5c64], str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov eax, dword [ebp - 0x5860]
push eax
mov ecx, dword [ebp - 0x5d90]
call fcn.00453a00
mov dword [ebp - 0x4230], eax
mov dword [ebp - 0x5c6c], 0
jmp 0x4540fb
mov ecx, dword [ebp - 0x5c6c]
add ecx, 1
mov dword [ebp - 0x5c6c], ecx
cmp dword [ebp - 0x5c6c], 2
jae 0x45415f
lea edx, [ebp - 0x2020]
push edx
lea eax, [ebp - 0x5838]
push eax
push 1
mov ecx, dword [ebp - 0x5860]
push ecx
mov edx, dword [ebp - 0x5c6c]
mov eax, dword [ebp + edx*4 - 0x5c68]
push eax
push SysReAllocStringLen
mov ecx, dword [ebp - 0x5d90]
call fcn.004538c0
test eax, eax
jne 0x45415d
lea ecx, [ebp - 0x5838]
push ecx
lea edx, [ebp - 0x4730]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x5858], 1
jmp 0x45415f
jmp 0x4540ec
cmp dword [ebp - 0x5858], 0
jne 0x45422f
push 0x1000
push 0
lea eax, [ebp - 0x5838]
push eax
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x2020], 0x1000
mov dword [ebp - 0x5840], 0
jmp 0x4541a7
mov ecx, dword [ebp - 0x5840]
add ecx, 1
mov dword [ebp - 0x5840], ecx
cmp dword [ebp - 0x5840], 2
jae 0x45422f
mov edx, dword [ebp - 0x5840]
mov eax, dword [ebp + edx*4 - 0x2010]
push eax
lea ecx, [ebp - 0x2008]
push ecx
push str.Applications_s_shell_s
lea edx, [ebp - 0x4020]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x2020]
push eax
lea ecx, [ebp - 0x5838]
push ecx
push 1
push str.FriendlyAppName
lea edx, [ebp - 0x4020]
push edx
push SysReAllocStringLen
mov ecx, dword [ebp - 0x5d90]
call fcn.004538c0
test eax, eax
jne 0x45422a
lea eax, [ebp - 0x5838]
push eax
lea ecx, [ebp - 0x4730]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x5858], 1
jmp 0x45422f
jmp 0x454198
cmp dword [ebp - 0x5858], 0
jne 0x4542c6
push 0x1000
push 0
lea edx, [ebp - 0x5838]
push edx
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x2020], 0x1000
lea eax, [ebp - 0x2008]
push eax
push str.Applications_s
lea ecx, [ebp - 0x4020]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x2020]
push edx
lea eax, [ebp - 0x5838]
push eax
push 1
push str.FriendlyAppName
lea ecx, [ebp - 0x4020]
push ecx
push SysReAllocStringLen
mov ecx, dword [ebp - 0x5d90]
call fcn.004538c0
test eax, eax
jne 0x4542c6
lea edx, [ebp - 0x5838]
push edx
lea eax, [ebp - 0x4730]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x5858], 1
cmp dword [ebp - 0x5858], 0
jne 0x45435d
push 0x1000
push 0
lea ecx, [ebp - 0x5838]
push ecx
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x2020], 0x1000
lea edx, [ebp - 0x2008]
push edx
push str.Applications_s_shell
lea eax, [ebp - 0x4020]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x2020]
push ecx
lea edx, [ebp - 0x5838]
push edx
push 1
push str.FriendlyCache
lea eax, [ebp - 0x4020]
push eax
push SysReAllocStringLen
mov ecx, dword [ebp - 0x5d90]
call fcn.004538c0
test eax, eax
jne 0x45435d
lea ecx, [ebp - 0x5838]
push ecx
lea edx, [ebp - 0x4730]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x5858], 1
cmp dword [ebp - 0x5854], 0
je 0x45436f
cmp dword [ebp - 0x5858], 0
jne 0x454374
jmp 0x453cd5
push 0x608
call fcn.004b304f
add esp, 4
mov dword [ebp - 0x5c7c], eax
mov eax, dword [ebp - 0x5c7c]
mov dword [ebp - 0x5850], eax
push 0x608
push 0
mov ecx, dword [ebp - 0x5850]
push ecx
call fcn.004f8090
add esp, 0xc
push 0x608
lea edx, [ebp - 0x4830]
push edx
mov eax, dword [ebp - 0x5850]
push eax
call fcn.004f8140
add esp, 0xc
lea ecx, [ebp - 0x5850]
push ecx
mov ecx, dword [ebp - 0x5d90]
add ecx, 4
call fcn.00455700
jmp 0x453cd5
mov edx, dword [ebp - 0x2018]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov word [ebp - 0x4228], ax
push 0x1fe
push 0
lea ecx, [ebp - 0x4226]
push ecx
call fcn.004f8090
add esp, 0xc
push 0x100
lea edx, [ebp - 0x4228]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.004fad12
add esp, 0x24
lea ecx, [ebp - 0x4228]
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_sOpenWithList
lea edx, [ebp - 0x4020]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x2018]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x4020]
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x583c], eax
cmp dword [ebp - 0x583c], 0
je 0x454487
mov eax, dword [ebp - 0x5d90]
add eax, 4
jmp 0x454704
mov dword [ebp - 0x201c], 0
mov dword [ebp - 0x4024], 0
push 0
push 0
push 0
lea edx, [ebp - 0x4024]
push edx
lea eax, [ebp - 0x201c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0x2018]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x583c], eax
cmp dword [ebp - 0x583c], 0
je 0x4544f2
mov edx, dword [ebp - 0x2018]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x5d90]
add eax, 4
jmp 0x454704
mov dword [ebp - 0x4838], 0
jmp 0x45450d
mov eax, dword [ebp - 0x4838]
add eax, 1
mov dword [ebp - 0x4838], eax
mov ecx, dword [ebp - 0x4838]
cmp ecx, dword [ebp - 0x201c]
jae 0x4546ee
push 0x2000
push 0
lea edx, [ebp - 0x2008]
push edx
call fcn.004f8090
add esp, 0xc
push 0x1000
push 0
lea eax, [ebp - 0x5838]
push eax
call fcn.004f8090
add esp, 0xc
mov dword [ebp - 0x4028], 0x1000
mov dword [ebp - 0x2020], 0x1000
lea ecx, [ebp - 0x2020]
push ecx
lea edx, [ebp - 0x5838]
push edx
lea eax, [ebp - 0x5844]
push eax
push 0
lea ecx, [ebp - 0x4028]
push ecx
lea edx, [ebp - 0x2008]
push edx
mov eax, dword [ebp - 0x4838]
push eax
mov ecx, dword [ebp - 0x2018]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x583c], eax
cmp dword [ebp - 0x583c], 0
je 0x4545b8
cmp dword [ebp - 0x583c], 0xea
je 0x4545b8
jmp 0x4546ee
push 0x5454ec
lea edx, [ebp - 0x2008]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4545d3
jmp 0x4544fe
mov eax, dword [ebp - 0x5d90]
add eax, 4
mov dword [ebp - 0x5d80], eax
mov ecx, dword [ebp - 0x5d80]
mov edx, dword [ebp - 0x5d80]
mov eax, dword [ecx + 0x10]
sub eax, dword [edx + 0xc]
sar eax, 2
mov dword [ebp - 0x5c70], eax
mov dword [ebp - 0x5c74], 0
jmp 0x454618
mov ecx, dword [ebp - 0x5c74]
add ecx, 1
mov dword [ebp - 0x5c74], ecx
mov edx, dword [ebp - 0x5c74]
cmp edx, dword [ebp - 0x5c70]
jge 0x4546e9
mov eax, dword [ebp - 0x5d90]
add eax, 4
mov dword [ebp - 0x5d84], eax
mov ecx, dword [ebp - 0x5d84]
mov edx, dword [ebp - 0x5d84]
mov eax, dword [ecx + 0x10]
sub eax, dword [edx + 0xc]
sar eax, 2
cmp dword [ebp - 0x5c74], eax
jb 0x45465b
call fcn.004fb0ce
xor ecx, ecx
jne 0x45465b
mov edx, dword [ebp - 0x5d84]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 0x5c74]
lea edx, [eax + ecx*4]
mov dword [ebp - 0x5d88], edx
mov eax, dword [ebp - 0x5d88]
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x5838]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4546e4
mov eax, dword [ebp - 0x5d90]
add eax, 4
mov dword [ebp - 0x5d8c], eax
mov ecx, dword [ebp - 0x5d8c]
mov edx, dword [ebp - 0x5d8c]
mov eax, dword [ecx + 0x10]
sub eax, dword [edx + 0xc]
sar eax, 2
cmp dword [ebp - 0x5c74], eax
jb 0x4546c2
call fcn.004fb0ce
xor ecx, ecx
jne 0x4546c2
mov edx, dword [ebp - 0x5d8c]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 0x5c74]
mov edx, dword [eax + ecx*4]
mov dword [edx + 0x604], 1
jmp 0x4546e9
jmp 0x454609
jmp 0x4544fe
mov eax, dword [ebp - 0x2018]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x5d90]
add eax, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004f8124
mov esp, ebp
pop ebp
ret 4