Function at 0x4a4962
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 2], 0
mov byte [ebp - 1], 0
push 0x6b344c
mov eax, 0x6b3448
push dword [ebp + 8]
push str.urlmon.dll
call fcn.004a46ed
add esp, 0xc
test eax, eax
je 0x4a49af
mov byte [ebp - 2], 1
call fcn.004a48d8
movzx eax, al
test eax, eax
je 0x4a49af
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 2]
test eax, eax
jne 0x4a49d9
push 0x6b3454
mov eax, 0x6b3450
push dword [ebp + 8]
push str.ieframe.dll
call fcn.004a46ed
add esp, 0xc
test eax, eax
je 0x4a49d9
mov byte [ebp - 2], 1
movzx eax, byte [ebp - 2]
test eax, eax
jne 0x4a4a03
push 0x6b345c
mov eax, 0x6b3458
push dword [ebp + 8]
push str.wininet.dll
call fcn.004a46ed
add esp, 0xc
test eax, eax
je 0x4a4a03
mov byte [ebp - 2], 1
movzx eax, byte [ebp - 2]
test eax, eax
jne 0x4a4a2d
push 0x6b3464
mov eax, 0x6b3460
push dword [ebp + 8]
push str.iertutil.dll
call fcn.004a46ed
add esp, 0xc
test eax, eax
je 0x4a4a2d
mov byte [ebp - 2], 1
movzx eax, byte [ebp - 2]
test eax, eax
je 0x4a4adc
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00402394
add esp, 0xc
push 0x103
lea eax, [ebp - 0x210]
push eax
push 0
call dword [0x6b6704]
push 0x5c
lea eax, [ebp - 0x210]
push eax
call fcn.004a4163
pop ecx
pop ecx
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x4a4adc
xor eax, eax
mov ecx, dword [ebp - 0x214]
mov word [ecx], ax
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4a4abd
lea eax, [ebp - 0x210]
push eax
push str._sMicrosoftEdgeCP.exe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004692b5
add esp, 0x10
jmp 0x4a4cf8
lea eax, [ebp - 0x210]
push eax
push str._siexplore.exe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004692b5
add esp, 0x10
jmp 0x4a4cf8
movzx eax, byte [ebp - 2]
test eax, eax
jne 0x4a4b06
push 0x6b346c
mov eax, 0x6b3468
push dword [ebp + 8]
push str.iedvtool.dll
call fcn.004a46ed
add esp, 0xc
test eax, eax
je 0x4a4b06
mov byte [ebp - 2], 1
movzx eax, byte [ebp - 2]
test eax, eax
jne 0x4a4b30
push 0x6b3474
mov eax, 0x6b3470
push dword [ebp + 8]
push str.mshtml.dll
call fcn.004a46ed
add esp, 0xc
test eax, eax
je 0x4a4b30
mov byte [ebp - 2], 1
movzx eax, byte [ebp - 2]
test eax, eax
je 0x4a4bc6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x63e360
push str.CLSID1a6fe369_f28c_4ad9_a3e6_2bcb50807cf1InProcServer32
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHRegGetPathW]
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.iexplore.exe
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp - 0x62c]
add eax, 2
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x62c]
mov ax, word [eax]
mov word [ebp - 0x632], ax
add dword [ebp - 0x62c], 2
cmp word [ebp - 0x632], 0
jne 0x4a4b86
mov eax, dword [ebp - 0x62c]
sub eax, dword [ebp - 0x630]
sar eax, 1
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x638]
jmp 0x4a4cf8
movzx eax, byte [ebp - 2]
test eax, eax
jne 0x4a4c83
push dword [ebp + 8]
push str.Xbdyy.dll
call fcn.004a4631
pop ecx
pop ecx
test eax, eax
je 0x4a4c83
mov byte [ebp - 2], 1
xor eax, eax
mov word [ebp - 0x420], ax
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.00402394
add esp, 0xc
push 0x103
lea eax, [ebp - 0x420]
push eax
push str.Xbdyy.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [0x6b6704]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.baiduplayerbrowser.exe
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a4c83
lea eax, [ebp - 0x420]
push eax
push 0x64f918
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004692b5
add esp, 0x10
jmp 0x4a4cf8
cmp dword [0x6b6710], 0
je 0x4a4cf5
movzx eax, byte [ebp - 2]
test eax, eax
jne 0x4a4cf5
push 0
mov ecx, dword [ebp + 8]
call fcn.004a4786
pop ecx
test eax, eax
je 0x4a4cf5
push 0x208
push 0
lea eax, [ebp - 0x628]
push eax
call fcn.00402394
add esp, 0xc
lea eax, [ebp - 0x628]
call fcn.004a48a6
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a4cf5
lea eax, [ebp - 0x628]
push eax
push 0x64f918
push 0xffffffffffffffff
mov eax, dword [ebp + 0x10]
dec eax
push eax
push dword [ebp + 0xc]
call fcn.00413801
add esp, 0x14
jmp 0x4a4cf8
or eax, 0xffffffff
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00403fc1
leave
ret