Function at 0x4d28e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x574777
mov eax, dword fs:[0]
push eax
mov eax, 0x165c
call fcn.0053f2e0
mov eax, dword [0x5f969c]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1668], ecx
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 0
je 0x4d2945
xor eax, eax
jmp 0x4d2be9
mov dword [ebp - 0x1028], 0x400
lea edx, [ebp - 0x1028]
push edx
lea eax, [ebp - 0x1024]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 0
je 0x4d2989
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4d2be9
mov eax, dword [ebp - 0x1668]
add eax, 4
push eax
push 0x5887e8
lea ecx, [ebp - 0x81c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [ebp - 0x81c]
push edx
lea eax, [ebp - 0x1024]
push eax
call fcn.004426d0
add esp, 8
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x1024]
cmp ecx, edx
jne 0x4d2a94
push 0x5887f0
lea eax, [ebp - 0x1024]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x102c]
push ecx
lea edx, [ebp - 0x1024]
push edx
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4d2a94
mov dword [ebp - 0x1238], 0x208
lea eax, [ebp - 0x1238]
push eax
lea ecx, [ebp - 0x1234]
push ecx
push 0
mov edx, dword [ebp - 0x102c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov eax, dword [ebp - 0x102c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1234]
push ecx
call dword [sym.imp.USER32.dll_CharLowerW]
push 0x104
lea edx, [ebp - 0x1444]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x1444]
push eax
call dword [sym.imp.USER32.dll_CharLowerW]
lea ecx, [ebp - 0x1444]
push ecx
lea edx, [ebp - 0x1234]
push edx
call fcn.004426d0
add esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1234]
cmp eax, ecx
jne 0x4d2a94
mov dword [ebp - 0x14], 1
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
je 0x4d2be6
call fcn.004f2ba0
test eax, eax
je 0x4d2be6
lea ecx, [ebp - 0x165c]
call fcn.0047d8c0
mov dword [ebp - 4], 0
xor eax, eax
mov word [ebp - 0x1654], ax
push 0x206
push 0
lea ecx, [ebp - 0x1652]
push ecx
call fcn.0053c870
add esp, 0xc
mov dword [ebp - 0x1660], 0x104
lea ecx, [ebp - 0x1448]
call fcn.00438030
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerFileExts_sUserChoice
lea eax, [ebp - 0x1448]
push eax
call fcn.004386c0
add esp, 0xc
push 0x20019
lea ecx, [ebp - 0x1448]
call fcn.004dfdf0
push eax
push reloc.WS2_32.dll_accept
lea ecx, [ebp - 0x165c]
call fcn.00443540
test eax, eax
jne 0x4d2bc5
lea ecx, [ebp - 0x1660]
push ecx
lea edx, [ebp - 0x1654]
push edx
push str.ProgId
lea ecx, [ebp - 0x165c]
call fcn.00446900
test eax, eax
jne 0x4d2bc5
lea ecx, [ebp - 0x1664]
call fcn.00438030
mov byte [ebp - 4], 2
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x5fd8fc]
push ecx
push 0x5888bc
lea edx, [ebp - 0x1664]
push edx
call fcn.004386c0
add esp, 0x10
lea eax, [ebp - 0x1654]
push eax
lea ecx, [ebp - 0x1664]
call fcn.0044ab00
push eax
call fcn.0053eb57
add esp, 8
test eax, eax
je 0x4d2bb6
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1664]
call fcn.0044fc20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1448]
call fcn.0044fc20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x165c]
call fcn.004433a0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0053c85d
mov esp, ebp
pop ebp
ret 4