Function at 0x424ed0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x2860
call fcn.004d4ce0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x2870]
test esi, esi
push edi
je 0x425164
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
push esi
call edi
add esp, 4
test eax, eax
je 0x425164
lea eax, [esp + 0x428]
push 0x10000000
push eax
push esi
call fcn.004a39e0
add esp, 0xc
test eax, eax
je 0x425164
lea ecx, [esp + 0x470]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
test esi, esi
je 0x424fad
push esi
call edi
add esp, 4
test eax, eax
jle 0x424f6e
mov cx, word [esi]
cmp cx, 0x2f
je 0x424f6e
cmp cx, 0x5c
je 0x424f6e
mov ax, word [esi + eax*2 - 2]
cmp ax, 0x2f
je 0x424f6e
cmp ax, 0x5c
je 0x424f6e
mov edx, dword [esp + 0x287c]
push esi
dec edx
push 0x4ed128
push edx
jmp 0x424fc0
lea eax, [esp + 0x1470]
push eax
call edi
add esp, 4
cmp eax, 1
jbe 0x424f98
mov edx, dword [esp + 0x287c]
lea ecx, [esp + 0x1472]
push ecx
dec edx
push 0x4ed128
push edx
jmp 0x424fc0
mov eax, dword [esp + 0x287c]
push str.index.htm
dec eax
push 0x4ed128
push eax
jmp 0x424fc0
mov ecx, dword [esp + 0x287c]
push str.index.htm
dec ecx
push 0x4ed128
push ecx
mov esi, dword [esp + 0x2884]
mov ebp, dword [sym.imp.MSVCRT.dll__snwprintf]
push esi
call ebp
mov edi, dword [sym.imp.MSVCRT.dll_wcspbrk]
add esp, 0x10
push 0x4ed114
push esi
call edi
add esp, 8
test eax, eax
je 0x424ffc
push 0x4ed114
push esi
mov word [eax], 0x5f
call edi
add esp, 8
test eax, eax
jne 0x424fe8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov edi, eax
test edi, edi
je 0x42504f
mov ebx, dword [sym.imp.MSVCRT.dll_wcscmp]
push str..php
push edi
call ebx
add esp, 8
test eax, eax
je 0x42504f
push str..asp
push edi
call ebx
add esp, 8
test eax, eax
je 0x42504f
push str..aspx
push edi
call ebx
add esp, 8
test eax, eax
je 0x42504f
push str..jsp
push edi
call ebx
add esp, 8
test eax, eax
jne 0x425164
mov ebx, dword [esp + 0x2880]
test ebx, ebx
je 0x425164
push ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x425164
mov dx, word [0x500df0]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], dx
mov word [esp + 0x220], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x222]
push ebx
rep stosd dword es:[edi], eax
push str.MIMEDatabaseContent_Type_s
lea edx, [esp + 0x228]
push 0x104
push edx
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x206
stosw word es:[edi], ax
call ebp
add esp, 0x10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push eax
push ecx
push edx
lea eax, [esp + 0x22c]
push str.Extension
push eax
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x425164
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
lea ecx, [esp + 0x18]
push ecx
call edi
add esp, 4
test eax, eax
je 0x425164
push 0x2e
push esi
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x425164
push esi
mov word [eax], 0
call edi
mov ebx, dword [esp + 0x14]
lea edx, [esp + 0x1c]
sub ebx, eax
push edx
dec ebx
call edi
add esp, 8
cmp ebx, eax
jae 0x42514a
push esi
call edi
mov ecx, eax
mov eax, dword [esp + 0x14]
sub eax, ecx
add esp, 4
dec eax
jmp 0x425154
lea edx, [esp + 0x18]
push edx
call edi
add esp, 4
push eax
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.MSVCRT.dll_wcsncat]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2860
ret