Function at 0x44a390
Capabilities:
Check if file exists
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5bf219
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1154
call fcn.005a41d0
mov eax, dword [0x61dc40]
xor eax, ebp
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x18]
or dword [ebp - 0x1120], 0xffffffff
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1124], edx
mov edx, dword [ebp + 0x14]
xor ebx, ebx
mov dword [ebp - 0x1110], eax
mov dword [ebp - 0x1128], ecx
mov dword [ebp - 0x1154], edx
mov dword [ebp - 0x1158], esi
cmp dword [ebp + 8], ebx
je 0x44aeef
cmp eax, ebx
je 0x44aeef
cmp word [eax], bx
je 0x44aeef
cmp edi, ebx
je 0x44aeef
cmp word [edi], bx
je 0x44aeef
cmp ecx, ebx
je 0x44aeef
cmp word [ecx], bx
je 0x44aeef
cmp edx, ebx
je 0x44aeef
cmp word [edx], bx
je 0x44aeef
mov eax, dword [0x63696c]
mov esi, 0x63696c
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1140], eax
lea eax, [ebp - 0x1140]
push eax
push ebx
push edi
mov dword [ebp - 4], ebx
call fcn.00426c3c
mov eax, dword [ebp - 0x1140]
add esp, 0xc
cmp dword [eax - 0xc], ebx
je 0x44ae86
push 0x7e
pop edi
xor eax, eax
push edi
mov word [ebp - 0x19c], ax
lea eax, [ebp - 0x19a]
push ebx
push eax
call fcn.00596530
lea eax, [ebp - 0x19c]
add esp, 0xc
push eax
call fcn.00428b69
pop ecx
xor eax, eax
push edi
mov word [ebp - 0x11c], ax
lea eax, [ebp - 0x11a]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x1160]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x115c]
push eax
push 0x5df64c
push str.Softwarehao123JuziBrowser
push 0x80000001
mov dword [ebp - 0x115c], 1
mov dword [ebp - 0x1160], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1118], eax
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x5bc], ebx
lea edi, [ebp - 0x5b8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x5bc]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x44a5a4
push 0x62
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push ebx
push eax
call fcn.00596530
add esp, 0xc
push 0x32
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x5bc]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x1118]
push eax
call fcn.00407af8
push 0x2d
lea eax, [ebp - 0x1118]
push eax
call fcn.0042e721
push 0x7b
lea eax, [ebp - 0x1118]
push eax
call fcn.0042e721
push 0x7d
lea eax, [ebp - 0x1118]
push eax
call fcn.0042e721
mov eax, dword [ebp - 0x1118]
cmp dword [eax - 0xc], ebx
jne 0x44a5c0
push str.B2A133393FFB4370A2744CBE20792DF4
lea eax, [ebp - 0x1118]
push eax
call fcn.00407af8
lea eax, [ebp - 0x1118]
call fcn.004187e2
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1144], eax
xor eax, eax
mov byte [ebp - 4], 2
cmp ax, word [0x63f288]
jne 0x44a5f4
call fcn.00404168
jmp 0x44a5f9
mov eax, 0x63f288
push dword [ebp - 0x1118]
lea ecx, [ebp - 0x19c]
push dword [ebp - 0x1140]
push dword [ebp - 0x1110]
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x11c]
push ecx
push eax
push str.http:__www.hao123.com_juzi_netfavorites_download_appver_smid_scid_stype_dresfrom_suname_svk_s
lea eax, [ebp - 0x1144]
call fcn.00404f66
mov eax, dword [0x63696c]
add esp, 0x20
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1130], eax
lea eax, [ebp - 0x11c]
push eax
mov byte [ebp - 4], 3
push dword [0x6cab30]
lea eax, [ebp - 0x1130]
push str.___________________________7d_08x_04x
call fcn.0040c5ed
mov eax, dword [0x63696c]
add esp, 0xc
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1150], eax
mov byte [ebp - 4], 4
push dword [ebp - 0x1130]
lea ebx, [ebp - 0x1110]
call fcn.0047f402
pop ecx
mov byte [ebp - 4], 5
push dword [eax]
lea eax, [ebp - 0x1150]
push str.multipart_form_data__boundary_s
call fcn.00404f66
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x1110]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1138], eax
mov byte [ebp - 4], 6
push dword [ebp - 0x1130]
lea eax, [ebp - 0x1138]
push str.___s
call fcn.0040c5ed
mov eax, dword [0x63696c]
pop ecx
pop ecx
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1148], eax
mov byte [ebp - 4], 7
push dword [ebp - 0x1130]
lea eax, [ebp - 0x1148]
push str.___s__
call fcn.0040c5ed
mov eax, dword [0x63696c]
pop ecx
pop ecx
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x114c], eax
mov byte [ebp - 4], 8
push dword [ebp - 0x1128]
lea eax, [ebp - 0x1110]
push eax
call fcn.0047f351
mov byte [ebp - 4], 9
push dword [eax]
lea eax, [ebp - 0x114c]
push dword [ebp - 0x1138]
push str._s_r_nContent_Disposition:_form_data__name_BDUSS__r_n_r_n_s
call fcn.0040c5ed
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x1110]
add esp, 0x14
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1128], eax
mov byte [ebp - 4], 0xa
push dword [ebp - 0x1124]
lea eax, [ebp - 0x1110]
push eax
call fcn.0047f351
mov byte [ebp - 4], 0xb
push dword [eax]
lea eax, [ebp - 0x1128]
push dword [ebp - 0x1138]
push str._s_r_nContent_Disposition:_form_data__name_lastservermd5__r_n_r_n_s
call fcn.0040c5ed
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x1110]
add esp, 0x14
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1124], eax
mov byte [ebp - 4], 0xc
push dword [ebp - 0x1128]
lea eax, [ebp - 0x1124]
push dword [ebp - 0x114c]
push 0x5e9368
call fcn.0040c5ed
mov eax, dword [0x63696c]
add esp, 0xc
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1134], eax
mov byte [ebp - 4], 0xd
push dword [ebp - 0x1148]
lea eax, [ebp - 0x1134]
push str._r_n_s_r_n
call fcn.0040c5ed
mov eax, dword [ebp - 0x1124]
mov esi, dword [eax - 0xc]
mov eax, dword [ebp - 0x1134]
mov ebx, dword [eax - 0xc]
lea edi, [ebx + esi]
lea eax, [edi + 2]
push eax
call fcn.0058e040
add esp, 0xc
mov dword [ebp - 0x113c], eax
test eax, eax
je 0x44adf4
lea eax, [edi + 2]
push eax
push 0
push dword [ebp - 0x113c]
call fcn.00596530
add esp, 0xc
push esi
push dword [ebp - 0x1124]
push dword [ebp - 0x113c]
call fcn.005965b0
mov eax, dword [ebp - 0x113c]
add esp, 0xc
push ebx
push dword [ebp - 0x1134]
add eax, esi
push eax
call fcn.005965b0
add esp, 0xc
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x5ac], ax
lea eax, [ebp - 0x5aa]
push eax
call fcn.00596530
add esp, 0xc
xor eax, eax
push esi
push eax
mov word [ebp - 0x3a4], ax
lea eax, [ebp - 0x3a2]
push eax
call fcn.00596530
add esp, 0xc
push 0x62f48
call fcn.0058f82d
pop ecx
mov dword [ebp - 0x1110], eax
mov byte [ebp - 4], 0xe
test eax, eax
je 0x44a8fb
push eax
call fcn.004702c4
mov esi, eax
jmp 0x44a8fd
xor esi, esi
mov byte [ebp - 4], 0xd
test esi, esi
je 0x44a97b
push dword [ebp - 0x1144]
mov eax, esi
call fcn.0040a682
push dword [ebp - 0x1150]
mov ecx, dword [ebp - 0x113c]
push edi
mov eax, esi
call fcn.0040a6e4
lea ebx, [ebp - 0x5ac]
mov dword [esi + 0x2468], 1
mov dword [esi + 0x26b0], 0x4e20
call fcn.0042dfcf
mov eax, ebx
push eax
mov eax, esi
call fcn.0040a6b3
call fcn.00470776
test eax, eax
je 0x44a961
push 0xa
mov eax, esi
call fcn.00470b1b
cmp dword [esi + 0x5d120], 7
je 0x44a973
xor eax, eax
mov word [ebp - 0x5ac], ax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
lea eax, [ebp - 0x68c]
push eax
mov byte [ebp - 4], 0xf
call fcn.00548b11
lea eax, [ebp - 0x5fc]
push eax
xor ebx, ebx
mov byte [ebp - 4], 0x10
call fcn.0054af1d
lea edx, [ebp - 0x5ac]
lea ecx, [ebp - 0x5c8]
mov byte [ebp - 4], 0x11
call fcn.00426b05
lea ecx, [ebp - 0x5fc]
push ecx
push eax
lea ebx, [ebp - 0x68c]
mov byte [ebp - 4], 0x12
call fcn.00548b5a
xor edi, edi
push edi
push 1
lea ecx, [ebp - 0x5c8]
mov bl, al
mov byte [ebp - 4], 0x11
call fcn.00407567
test bl, bl
je 0x44adb8
cmp byte [ebp - 0x5f4], 0
je 0x44adb8
lea eax, [ebp - 0x5fc]
call fcn.0054bd37
test al, al
je 0x44adb8
mov edx, 0x5e8fdc
lea ecx, [ebp - 0x5fc]
call fcn.0054b949
cmp byte [eax + 8], 4
jne 0x44adb8
mov eax, dword [eax]
cmp eax, edi
je 0x44adb8
push eax
lea eax, [ebp - 0x1114]
push eax
call fcn.0047f54f
pop ecx
pop ecx
mov byte [ebp - 4], 0x13
push dword [ebp - 0x1118]
push dword [ebp - 0x1114]
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
je 0x44aa68
mov eax, dword [ebp - 0x1114]
add eax, 0xfffffff0
call fcn.00407b6b
jmp 0x44adb8
mov edx, str.errno
lea ecx, [ebp - 0x5fc]
call fcn.0054b949
cmp byte [eax + 8], 1
jne 0x44aa55
mov ecx, eax
call fcn.0054b340
mov dword [ebp - 0x1120], eax
cmp eax, edi
je 0x44aaa2
mov eax, dword [ebp - 0x1114]
add eax, 0xfffffff0
call fcn.00407b6b
jmp 0x44ada9
mov edx, str.downloadurl
lea ecx, [ebp - 0x5fc]
call fcn.0054b949
cmp byte [eax + 8], 4
jne 0x44ad95
mov eax, dword [eax]
cmp eax, edi
je 0x44ad95
push eax
lea eax, [ebp - 0x111c]
push eax
call fcn.0047f54f
pop ecx
pop ecx
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x111c]
cmp dword [eax - 0xc], edi
jne 0x44aaff
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x1114]
add eax, 0xfffffff0
call fcn.00407b6b
jmp 0x44adb1
push 0x62f48
call fcn.0058f82d
pop ecx
mov dword [ebp - 0x1110], eax
mov byte [ebp - 4], 0x15
cmp eax, edi
je 0x44ab22
push eax
call fcn.004702c4
mov esi, eax
jmp 0x44ab24
xor esi, esi
mov byte [ebp - 4], 0x14
cmp esi, edi
je 0x44ab90
push dword [ebp - 0x111c]
mov eax, esi
call fcn.0040a682
lea ebx, [ebp - 0x3a4]
mov dword [esi + 0x2468], 1
mov dword [esi + 0x26b0], 0x493e0
call fcn.0042dfcf
mov eax, ebx
push eax
mov eax, esi
call fcn.0040a6b3
call fcn.00470776
test eax, eax
je 0x44ab74
push 0xa
mov eax, esi
call fcn.00470b1b
cmp dword [esi + 0x5d120], 7
je 0x44ab86
xor eax, eax
mov word [ebp - 0x3a4], ax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
xor edi, edi
lea eax, [ebp - 0x3a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x44abac
mov eax, dword [ebp - 0x111c]
jmp 0x44aae4
mov edx, str.filemd5
lea ecx, [ebp - 0x5fc]
call fcn.0054b949
cmp byte [eax + 8], 4
jne 0x44aba1
mov eax, dword [eax]
cmp eax, edi
je 0x44aba1
push eax
lea eax, [ebp - 0x112c]
push eax
call fcn.0047f54f
pop ecx
pop ecx
mov eax, dword [ebp - 0x112c]
cmp dword [eax - 0xc], edi
jne 0x44abec
add eax, 0xfffffff0
call fcn.00407b6b
jmp 0x44aba1
xor eax, eax
push 0x7e
mov word [ebp - 0x9c], ax
lea eax, [ebp - 0x9a]
push edi
push eax
call fcn.00596530
add esp, 0xc
lea edx, [ebp - 0x9c]
lea ecx, [ebp - 0x3a4]
call fcn.0046fe2f
test eax, eax
jne 0x44ac24
mov eax, dword [ebp - 0x112c]
jmp 0x44abe2
push dword [ebp - 0x112c]
lea eax, [ebp - 0x9c]
push eax
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x44ac1c
or dword [ebp - 0x1120], 0xffffffff
lea esi, [ebp - 0x110c]
call fcn.0051a0a5
lea eax, [ebp - 0x3a4]
push eax
mov ecx, esi
mov byte [ebp - 4], 0x17
call fcn.0051a1af
cmp eax, edi
je 0x44ad6a
mov eax, esi
push eax
call fcn.0051a210
mov ebx, eax
xor esi, esi
cmp esi, ebx
jge 0x44ad53
push 0x22c
lea eax, [ebp - 0x8b8]
push edi
push eax
mov dword [ebp - 0x8bc], edi
call fcn.00596530
add esp, 0xc
push esi
lea edx, [ebp - 0x8bc]
lea ecx, [ebp - 0x110c]
call fcn.0051a264
cmp eax, edi
je 0x44ad53
test byte [ebp - 0x6b0], 0x10
jne 0x44ae96
lea eax, [ebp - 0x8b8]
push str.file.dat
push eax
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x44ae96
push dword [ebp - 0x8bc]
lea esi, [ebp - 0x110c]
call fcn.0051a351
mov esi, eax
cmp esi, edi
je 0x44ad53
push 5
push dword [ebp - 0x1154]
push edi
push edi
call dword [sym.imp.SHELL32.dll_SHPathPrepareForWriteW]
push 0x5dec60
push dword [ebp - 0x1154]
lea eax, [ebp - 0x1110]
push eax
mov dword [ebp - 0x1110], edi
call fcn.0059308d
add esp, 0xc
test eax, eax
jne 0x44ad4c
push dword [ebp - 0x1110]
push dword [ebp - 0x690]
push 1
push esi
call fcn.00593819
push dword [ebp - 0x1110]
call fcn.00593912
add esp, 0x14
mov dword [ebp - 0x1120], edi
push esi
call fcn.0058f807
pop ecx
lea ecx, [ebp - 0x110c]
call fcn.0051a1f0
cmp dword [ebp - 0x1120], edi
je 0x44ae9c
lea ecx, [ebp - 0x110c]
mov byte [ebp - 4], 0x16
call fcn.0051a124
mov eax, dword [ebp - 0x112c]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x111c]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x1114]
add eax, 0xfffffff0
call fcn.00407b6b
xor eax, eax
cmp eax, edi
jne 0x44adb8
cmp dword [ebp - 0x1120], edi
jne 0x44adb8
or dword [ebp - 0x1120], 0xffffffff
lea ecx, [ebp - 0x5fc]
mov byte [ebp - 4], 0x10
call fcn.0054b1a0
lea eax, [ebp - 0x68c]
call fcn.0040b0d5
lea ecx, [ebp - 0x3a4]
call fcn.0047611f
lea ecx, [ebp - 0x5ac]
call fcn.0047611f
push dword [ebp - 0x113c]
call fcn.0058f807
pop ecx
mov eax, dword [ebp - 0x1134]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x1124]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x1128]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x114c]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x1148]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x1138]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x1150]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x1130]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x1144]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x1118]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x1140]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x1120]
jmp 0x44aef2
inc esi
jmp 0x44ac74
lea eax, [ebp - 0x9c]
push eax
push dword [ebp - 0x1158]
call fcn.00407af8
mov eax, dword [ebp - 0x1158]
call fcn.004187e2
lea ecx, [ebp - 0x110c]
mov byte [ebp - 4], 0x16
call fcn.0051a124
mov eax, dword [ebp - 0x112c]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x111c]
add eax, 0xfffffff0
call fcn.00407b6b
jmp 0x44aa55
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.0058f3cf
leave
ret 0x14