Function at 0x4a0c35
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x638
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 1], 0
push 0x69e44c
mov eax, 0x69e448
push dword [ebp + 8]
push str.urlmon.dll
call fcn.004a0a4a
add esp, 0xc
test eax, eax
je 0x4a0c6e
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
jne 0x4a0c98
push 0x69e454
mov eax, 0x69e450
push dword [ebp + 8]
push str.ieframe.dll
call fcn.004a0a4a
add esp, 0xc
test eax, eax
je 0x4a0c98
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
jne 0x4a0cc2
push 0x69e45c
mov eax, 0x69e458
push dword [ebp + 8]
push str.wininet.dll
call fcn.004a0a4a
add esp, 0xc
test eax, eax
je 0x4a0cc2
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
jne 0x4a0cec
push 0x69e464
mov eax, 0x69e460
push dword [ebp + 8]
push str.iertutil.dll
call fcn.004a0a4a
add esp, 0xc
test eax, eax
je 0x4a0cec
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4a0d70
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00402394
add esp, 0xc
push 0x103
lea eax, [ebp - 0x210]
push eax
push 0
call dword [0x6a16fc]
push 0x5c
lea eax, [ebp - 0x210]
push eax
call fcn.004a04c0
pop ecx
pop ecx
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x4a0d70
xor eax, eax
mov ecx, dword [ebp - 0x214]
mov word [ecx], ax
lea eax, [ebp - 0x210]
push eax
push str._siexplore.exe
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00467cd1
add esp, 0x10
jmp 0x4a0f8c
movzx eax, byte [ebp - 1]
test eax, eax
jne 0x4a0d9a
push 0x69e46c
mov eax, 0x69e468
push dword [ebp + 8]
push str.iedvtool.dll
call fcn.004a0a4a
add esp, 0xc
test eax, eax
je 0x4a0d9a
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
jne 0x4a0dc4
push 0x69e474
mov eax, 0x69e470
push dword [ebp + 8]
push str.mshtml.dll
call fcn.004a0a4a
add esp, 0xc
test eax, eax
je 0x4a0dc4
mov byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
test eax, eax
je 0x4a0e5a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x62b7c0
push str.CLSID1a6fe369_f28c_4ad9_a3e6_2bcb50807cf1InProcServer32
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHRegGetPathW]
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.iexplore.exe
push dword [ebp + 0xc]
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp - 0x62c]
add eax, 2
mov dword [ebp - 0x630], eax
mov eax, dword [ebp - 0x62c]
mov ax, word [eax]
mov word [ebp - 0x632], ax
add dword [ebp - 0x62c], 2
cmp word [ebp - 0x632], 0
jne 0x4a0e1a
mov eax, dword [ebp - 0x62c]
sub eax, dword [ebp - 0x630]
sar eax, 1
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x638]
jmp 0x4a0f8c
movzx eax, byte [ebp - 1]
test eax, eax
jne 0x4a0f17
push dword [ebp + 8]
push str.Xbdyy.dll
call fcn.004a098e
pop ecx
pop ecx
test eax, eax
je 0x4a0f17
mov byte [ebp - 1], 1
xor eax, eax
mov word [ebp - 0x420], ax
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.00402394
add esp, 0xc
push 0x103
lea eax, [ebp - 0x420]
push eax
push str.Xbdyy.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [0x6a16fc]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.baiduplayerbrowser.exe
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a0f17
lea eax, [ebp - 0x420]
push eax
push 0x640018
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00467cd1
add esp, 0x10
jmp 0x4a0f8c
cmp dword [0x6a1708], 0
je 0x4a0f89
movzx eax, byte [ebp - 1]
test eax, eax
jne 0x4a0f89
push 0
mov ecx, dword [ebp + 8]
call fcn.004a0ae3
pop ecx
test eax, eax
je 0x4a0f89
push 0x208
push 0
lea eax, [ebp - 0x628]
push eax
call fcn.00402394
add esp, 0xc
lea eax, [ebp - 0x628]
call fcn.004a0c03
lea eax, [ebp - 0x628]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4a0f89
lea eax, [ebp - 0x628]
push eax
push 0x640018
push 0xffffffffffffffff
mov eax, dword [ebp + 0x10]
dec eax
push eax
push dword [ebp + 0xc]
call fcn.00413268
add esp, 0x14
jmp 0x4a0f8c
or eax, 0xffffffff
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00403fc1
leave
ret