Function at 0x4613d0
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5258a8
push 0x51d85e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x21c
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 4], 1
call fcn.00518df0
test eax, eax
je 0x4615c2
push 0x57b950
push str.InternetConnectA
push str.wininet.dll
call fcn.00461390
push 0x57b980
push str.InternetSetCookieW
push str.wininet.dll
call fcn.00461390
push 0x57b97c
push str.InternetSetCookieExW
push str.wininet.dll
call fcn.00461390
push 0x57b978
push str.InternetSetCookieA
push str.wininet.dll
call fcn.00461390
push 0x57b974
push str.InternetSetCookieExA
push str.wininet.dll
call fcn.00461390
push 0x57b970
push str.InternetGetCookieExA
push str.wininet.dll
call fcn.00461390
add esp, 0x48
push 0x57b8e4
push str.HttpOpenRequestW
push str.wininet.dll
call fcn.00461390
push 0x57b95c
push str.GetUrlCacheEntryInfoA
push str.wininet.dll
call fcn.00461390
push 0x57b960
push str.GetUrlCacheEntryInfoW
push str.wininet.dll
call fcn.00461390
push 0x57b968
push str.InternetSetOptionA
push str.wininet.dll
call fcn.00461390
push 0x57b92c
push str.CoGetClassObject
push str.ole32.dll
call fcn.00461390
push 0x57b920
push str.CommitUrlCacheEntryA
push str.wininet.dll
call fcn.00461390
add esp, 0x48
push 0x57b944
push str.InternetSetStatusCallbackA
push str.wininet.dll
call fcn.00461390
push 0x57b918
push str.CreateUrlCacheEntryA
push str.wininet.dll
call fcn.00461390
push 0x57b914
push str.RetrieveUrlCacheEntryStreamA
push str.wininet.dll
call fcn.00461390
push 0x57b910
push str.UnlockUrlCacheEntryStream
push str.wininet.dll
call fcn.00461390
push 0x57b9a4
push str.ObtainUserAgentString
push str.urlmon.dll
call fcn.00461390
push 0x57b934
push str.InternetOpenA
push str.wininet.dll
call fcn.00461390
add esp, 0x48
push 0x57b930
push str.InternetOpenW
push str.wininet.dll
call fcn.00461390
push 0x57b96c
push str.HttpAddRequestHeadersA
push str.wininet.dll
call fcn.00461390
push 0x57b964
push str.HttpQueryInfoA
push str.wininet.dll
call fcn.00461390
add esp, 0x24
call fcn.0051c8b3
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.0051cc77
push 0x4609a0
push 0x57b900
call fcn.0051cce6
mov word [ebp - 0x224], bx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x222]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push str.SafeCentralSafeCentral.dll
push 0x56e47c
push 0x53ac6c
push 0x103
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
push ebx
lea ecx, [ebp - 0x224]
push ecx
mov ecx, 0x56e210
call fcn.0040cc50
test eax, eax
je 0x461646
lea edx, [ebp - 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x57b990], eax
cmp dword [0x57b94c], ebx
je 0x46165d
push 0x460c20
push 0x57b94c
call fcn.0051cce6
mov eax, dword [0x57b990]
cmp eax, ebx
je 0x461703
push str.SafeCentralLoadLibraryA
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [0x57b9a8], eax
cmp eax, ebx
je 0x461690
push 0x45e730
push 0x57b8fc
call fcn.0051cce6
push str.SafeCentralLoadLibraryW
mov eax, dword [0x57b990]
push eax
call esi
mov dword [0x57b9ac], eax
cmp eax, ebx
je 0x4616b5
push 0x45e7a0
push 0x57b8f8
call fcn.0051cce6
push str.SafeCentralLoadLibraryExA
mov ecx, dword [0x57b990]
push ecx
call esi
mov dword [0x57b9b0], eax
cmp eax, ebx
je 0x4616db
push 0x45e7e0
push 0x57b8f4
call fcn.0051cce6
push str.SafeCentralLoadLibraryExW
mov edx, dword [0x57b990]
push edx
call esi
mov dword [0x57b9b4], eax
cmp eax, ebx
je 0x461709
push 0x45e830
push 0x57b8f0
call fcn.0051cce6
jmp 0x461709
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
mov dword [ebp - 0x22c], edi
cmp edi, ebx
je 0x461760
push str.SHGetFolderPathA
push edi
call esi
mov dword [0x57b99c], eax
cmp eax, ebx
je 0x461740
push 0x460720
push 0x57b99c
call fcn.0051cce6
push str.SHGetFolderPathW
push edi
call esi
mov dword [0x57b9a0], eax
cmp eax, ebx
je 0x461760
push 0x460750
push 0x57b9a0
call fcn.0051cce6
cmp dword [0x57b950], ebx
je 0x461777
push 0x45eaa0
push 0x57b950
call fcn.0051cce6
cmp dword [0x588508], ebx
jne 0x46178f
cmp dword [0x58850c], ebx
jne 0x46178f
cmp dword [0x588510], ebx
je 0x46179e
push 0x4611b0
push 0x57b8ec
call fcn.0051cce6
cmp dword [0x58850c], ebx
je 0x4617b5
push 0x4612a0
push 0x57b8e8
call fcn.0051cce6
mov eax, 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x228]
push eax
push 0x569f9c
lea ecx, [ebp - 0x1c]
push ecx
push str.ExceptionEnable
push str.Software360se
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [0x569f9c], ebx
jne 0x46180f
push 0xffffffffffffffff
lea edx, [ebp - 0x10]
push edx
call sub.MSVCRT.dll__local_unwind2
add esp, 8
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x57b91c], ebx
je 0x461826
push 0x460bb0
push 0x57b91c
call fcn.0051cce6
mov dword [ebp - 4], ebx
call fcn.00461830
jmp 0x461841
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret