Function at 0x4c1640
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x558900
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xfac
mov edx, dword [0x5ba8bc]
push ebx
push esi
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x7e4]
push eax
push ecx
push 0
push 0
mov esi, 0x7d0
push str.Extensions
push edx
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4c1695
xor eax, eax
jmp 0x4c18e3
mov ebx, dword [esp + 0xfc8]
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jae 0x4c18e3
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov ebp, dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
and ecx, 3
push 0x30000000
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
call ebp
lea ecx, [esp + 0x18]
push 0x5ad354
push ecx
call fcn.0051cb70
add esp, 8
test eax, eax
je 0x4c1744
lea edi, [eax + 1]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5ad354
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call fcn.0051cb70
add esp, 8
test eax, eax
jne 0x4c170a
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x7e8]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], 0
mov edi, ecx
lea edx, [esp + 0x18]
push edi
push edx
push esi
call fcn.0052bf90
add esp, 0xc
test eax, eax
jne 0x4c1789
mov al, byte [edi + esi]
cmp al, 0x20
je 0x4c18d6
test al, al
je 0x4c18d6
push 0x598000
push esi
call fcn.0051cb70
lea ecx, [edi + esi]
add esp, 8
cmp ecx, eax
jbe 0x4c17c2
push 0x598000
push esi
call fcn.0051cb70
sub eax, esi
lea edx, [esp + 0x20]
push eax
push edx
push esi
call fcn.0052bf90
add esp, 0x14
test eax, eax
je 0x4c18d6
push 0x597d04
push esi
call fcn.0051cb70
mov esi, eax
add esp, 8
test esi, esi
je 0x4c17d9
inc esi
jne 0x4c1763
push 0x3f
push ebx
call fcn.0051c7f0
add esp, 8
test eax, eax
je 0x4c18de
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x30000000
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x1c]
and ecx, 3
mov dword [esp + 0x18], 0x7d0
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call ebp
lea ecx, [esp + 0x18]
push 0x3f
push ecx
call fcn.0051c7f0
lea edx, [esp + 0x20]
push 0x2e
push edx
mov byte [eax], 0
lea esi, [esp + 0x7f8]
call fcn.0051c7b0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x4c18de
mov al, byte [ebx + 1]
inc ebx
test al, al
je 0x4c18de
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
push edi
push ebx
push esi
call fcn.0052bf90
add esp, 0xc
test eax, eax
jne 0x4c188c
mov al, byte [edi + esi]
cmp al, 0x20
je 0x4c18d6
test al, al
je 0x4c18d6
push 0x598000
push esi
call fcn.0051cb70
lea ecx, [edi + esi]
add esp, 8
cmp ecx, eax
jbe 0x4c18bd
push 0x598000
push esi
call fcn.0051cb70
sub eax, esi
push eax
push ebx
push esi
call fcn.0052bf90
add esp, 0x14
test eax, eax
je 0x4c18d6
push 0x597d04
push esi
call fcn.0051cb70
mov esi, eax
add esp, 8
test esi, esi
je 0x4c18de
inc esi
je 0x4c18de
jmp 0x4c1872
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop ebp
mov ecx, dword [esp + 0xfb8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0xfb8
ret 4