Function at 0x452640
Capabilities:
Enumerate files on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104d4
call fcn.0042beb0
mov eax, dword [0x48d800]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x104d4], ecx
lea eax, [ebp - 0x1000c]
push eax
push str.SoftwareNetscapeNetscape_Installer
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4526db
mov dword [ebp - 0x10274], 0x8000
lea ecx, [ebp - 0x10274]
push ecx
lea edx, [ebp - 0x10008]
push edx
lea eax, [ebp - 0x10270]
push eax
push 0
push str.Install_Directory
mov ecx, dword [ebp - 0x1000c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4526cc
mov edx, dword [ebp - 0x1000c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x104d4]
call fcn.00451b90
jmp 0x4528f5
mov eax, dword [ebp - 0x1000c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4526eb
mov ecx, dword [ebp - 0x104d4]
call fcn.00451b90
jmp 0x4528f5
push str.Netscape_Browser
lea ecx, [ebp - 0x10008]
push ecx
call fcn.00403cc0
add esp, 8
mov dword [ebp - 0x1026c], eax
cmp dword [ebp - 0x1026c], 0
jne 0x452713
jmp 0x4528f5
push str.Users_
mov edx, dword [ebp - 0x1026c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x10008]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x10010], eax
push 0x479c1c
mov ecx, dword [ebp - 0x10010]
lea edx, [ebp + ecx*2 - 0x10008]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x10268], 0x35
lea eax, [ebp - 0x10268]
push eax
lea ecx, [ebp - 0x10008]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x10014], eax
cmp dword [ebp - 0x10014], 0xffffffff
jne 0x452783
jmp 0x4528f5
lea edx, [ebp - 0x10268]
push edx
mov eax, dword [ebp - 0x10014]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4528e8
push 0x479c20
lea ecx, [ebp - 0x1023c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x4527b7
jmp 0x452783
xor edx, edx
mov eax, dword [ebp - 0x10010]
mov word [ebp + eax*2 - 0x10008], dx
lea ecx, [ebp - 0x1023c]
push ecx
mov edx, dword [ebp - 0x10010]
lea eax, [ebp + edx*2 - 0x10008]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.Mail_
mov ecx, dword [ebp - 0x10010]
lea edx, [ebp + ecx*2 - 0x10008]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0xffff0002
push 0xffff0000
push 0
push 0
push 0
push 1
push 0
lea eax, [ebp - 0x10008]
push eax
push 0x27
mov ecx, dword [ebp - 0x104d4]
add ecx, 0x78
call fcn.0040c00e
mov dword [ebp - 0x10278], eax
push 0x479c38
mov ecx, dword [ebp - 0x10010]
lea edx, [ebp + ecx*2 - 0x10008]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x104d0]
push eax
lea ecx, [ebp - 0x10008]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x1027c], eax
cmp dword [ebp - 0x1027c], 0xffffffff
jne 0x45286d
jmp 0x452783
push 0x2e
lea edx, [ebp - 0x104a4]
push edx
call fcn.004027d0
add esp, 8
test eax, eax
je 0x452884
jmp 0x4528be
mov eax, dword [ebp - 0x104d0]
and eax, 0x410
jne 0x4528be
push 0xffff0002
mov ecx, dword [ebp - 0x10278]
push ecx
push 1
push 0
push 0
push 4
push 4
lea edx, [ebp - 0x104a4]
push edx
push 0x27
mov ecx, dword [ebp - 0x104d4]
add ecx, 0x78
call fcn.0040c00e
lea eax, [ebp - 0x104d0]
push eax
mov ecx, dword [ebp - 0x1027c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x45286d
mov edx, dword [ebp - 0x1027c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x452783
mov eax, dword [ebp - 0x10014]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00427b2d
mov esp, ebp
pop ebp
ret