Function at 0x416df0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x459a88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2fc
mov eax, dword [0x4bfbe4]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x308], eax
call fcn.00416b40
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.ApplicationsWanMP3.exe_shellopencommand
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ebp, 0x105
jne 0x417403
cmp dword [esp + 0x2c], 2
jne 0x41723b
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0x464468
push edx
mov dword [esp + 0x40], 0x12c
mov dword [esp + 0x38], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417093
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x20]
call fcn.00401c70
mov dword [esp + 0x314], 0
call fcn.0043d49d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov eax, dword [esi - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
sub eax, ebp
or eax, ecx
mov byte [esp + 0x314], 1
jge 0x416ef3
push ebp
lea ecx, [esp + 0x14]
call fcn.00401650
mov esi, dword [esp + 0x10]
cmp dword [esi - 8], ebp
jge 0x416f02
push 0x80070057
call fcn.00401140
push 0x104
push esi
mov dword [esi - 0xc], ebp
push 0
mov byte [esi + 0x105], 0
call edi
mov eax, esi
lea edx, [eax + 1]
jmp 0x416f20
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x416f20
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push 0x45cad0
push ecx
call fcn.00401ae0
push str.____1_
push eax
lea edx, [esp + 0x38]
push edx
mov byte [esp + 0x32c], 2
call fcn.004065c0
add esp, 0x18
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x318], 3
call fcn.00401a30
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x314], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416fa6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x314], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x416fcc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 0xc]
push eax
push eax
lea ecx, [esp + 0x18]
call fcn.00401740
push eax
lea ecx, [esp + 0x54]
push ecx
call fcn.00428da0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi - 0xc]
mov byte [esp + eax + 0x58], 0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417000
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
mov edx, dword [esp + 0x1c]
push edx
push esi
call fcn.0042826b
add esp, 8
test eax, eax
je 0x41704d
lea eax, [esp + 0x4c]
push eax
push 0x464468
push str.ApplicationsWanMP3.exe_shellopencommand
push SysReAllocString
call fcn.004164c0
add esp, 0x10
lea eax, [esi - 0x10]
mov byte [esp + 0x314], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41706f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x314], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x4173e8
call fcn.0043d49d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov eax, dword [esi - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
sub eax, ebp
or eax, ecx
mov dword [esp + 0x314], 4
jge 0x4170d2
push ebp
lea ecx, [esp + 0x14]
call fcn.00401650
mov esi, dword [esp + 0x10]
cmp dword [esi - 8], ebp
jge 0x4170e1
push 0x80070057
call fcn.00401140
push 0x104
push esi
mov dword [esi - 0xc], ebp
push 0
mov byte [esi + 0x105], 0
call edi
mov eax, esi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417100
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push 0x45cad0
push ecx
call fcn.00401ae0
push str.____1_
push eax
lea edx, [esp + 0x2c]
mov bl, 5
push edx
mov byte [esp + 0x32c], bl
call fcn.004065c0
add esp, 0x18
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x318], 6
call fcn.00401a30
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x314], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417186
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x314], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4171ac
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 0xc]
push eax
push eax
lea ecx, [esp + 0x18]
call fcn.00401740
push eax
lea ecx, [esp + 0x54]
push ecx
call fcn.00428da0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi - 0xc]
mov byte [esp + eax + 0x58], 0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4171e0
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
lea edx, [esp + 0x4c]
push edx
push 0x464468
push str.ApplicationsWanMP3.exe_shellopencommand
mov dword [esi - 0xc], eax
push SysReAllocString
mov byte [eax + esi], 0
call fcn.004164c0
lea eax, [esi - 0x10]
add esp, 0x10
mov dword [esp + 0x314], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x4173e8
call fcn.0043d49d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov eax, dword [esi - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
sub eax, ebp
or eax, ecx
mov dword [esp + 0x314], 7
jge 0x41727a
push ebp
lea ecx, [esp + 0x14]
call fcn.00401650
mov esi, dword [esp + 0x10]
cmp dword [esi - 8], ebp
jge 0x417289
push 0x80070057
call fcn.00401140
push 0x104
push esi
mov dword [esi - 0xc], ebp
push 0
mov byte [esi + 0x105], 0
call edi
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4172a2
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push 0x45cad0
push ecx
call fcn.00401ae0
push str.____1_
push eax
lea edx, [esp + 0x2c]
mov bl, 8
push edx
mov byte [esp + 0x32c], bl
call fcn.004065c0
add esp, 0x18
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x318], 9
call fcn.00401a30
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x314], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417328
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x314], 7
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41734e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov esi, dword [esp + 0x10]
mov eax, dword [esi - 4]
mov edi, dword [esi - 0xc]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
sub eax, edi
or eax, ecx
jge 0x417376
push edi
lea ecx, [esp + 0x14]
call fcn.00401650
mov esi, dword [esp + 0x10]
push edi
lea eax, [esp + 0x50]
push esi
push eax
call fcn.00428da0
mov eax, dword [esi - 0xc]
mov byte [esp + eax + 0x58], 0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417392
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
lea ecx, [esp + 0x4c]
push ecx
push 0x464468
push str.ApplicationsWanMP3.exe_shellopencommand
mov dword [esi - 0xc], eax
push SysReAllocString
mov byte [eax + esi], 0
call fcn.004164c0
lea eax, [esi - 0x10]
add esp, 0x10
mov dword [esp + 0x314], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4173f2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsWanMP3.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4177df
cmp dword [esp + 0x2c], 2
jne 0x4176ae
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push 0x464468
push eax
mov dword [esp + 0x40], 0x12c
mov dword [esp + 0x38], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4175d2
lea ecx, [esp + 0x4c]
push ecx
lea ecx, [esp + 0x20]
call fcn.00401c70
mov ebx, 0xa
mov dword [esp + 0x314], ebx
call fcn.0043d49d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov eax, dword [esi - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
sub eax, ebp
or eax, ecx
mov byte [esp + 0x314], 0xb
jge 0x4174cc
push ebp
lea ecx, [esp + 0x14]
call fcn.00401650
mov esi, dword [esp + 0x10]
cmp dword [esi - 8], ebp
jge 0x4174db
push 0x80070057
call fcn.00401140
push 0x104
push esi
mov dword [esi - 0xc], ebp
push 0
mov byte [esi + 0x105], 0
call edi
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4174f4
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
mov esi, dword [esi - 0xc]
push esi
push esi
lea ecx, [esp + 0x18]
call fcn.00401740
push eax
lea eax, [esp + 0x54]
push eax
call fcn.00428da0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi - 0xc]
mov byte [esp + eax + 0x58], 0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417540
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
mov ecx, dword [esp + 0x1c]
push ecx
push esi
call fcn.0042826b
add esp, 8
test eax, eax
je 0x41758d
lea edx, [esp + 0x4c]
push edx
push 0x464468
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsWanMP3.exe
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004164c0
add esp, 0x10
lea eax, [esi - 0x10]
mov byte [esp + 0x314], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4175ae
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x314], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x4177ca
call fcn.0043d49d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov eax, dword [esi - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
sub eax, ebp
or eax, ecx
mov dword [esp + 0x314], 0xc
jge 0x417611
push ebp
lea ecx, [esp + 0x14]
call fcn.00401650
mov esi, dword [esp + 0x10]
cmp dword [esi - 8], ebp
jge 0x417620
push 0x80070057
call fcn.00401140
push 0x104
push esi
mov dword [esi - 0xc], ebp
push 0
mov byte [esi + 0x105], 0
call edi
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417640
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
mov esi, dword [esi - 0xc]
push esi
push esi
lea ecx, [esp + 0x18]
call fcn.00401740
push eax
lea eax, [esp + 0x54]
push eax
call fcn.00428da0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi - 0xc]
mov byte [esp + eax + 0x58], 0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417690
sub eax, edx
js 0x4176a4
cmp eax, dword [esi - 8]
jle 0x41778c
push 0x80070057
call fcn.00401140
call fcn.0043d49d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov eax, dword [esi - 4]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
sub eax, ebp
or eax, ecx
mov dword [esp + 0x314], 0xd
jge 0x4176ed
push ebp
lea ecx, [esp + 0x14]
call fcn.00401650
mov esi, dword [esp + 0x10]
cmp dword [esi - 8], ebp
jge 0x4176fc
push 0x80070057
call fcn.00401140
push 0x104
push esi
mov dword [esi - 0xc], ebp
push 0
mov byte [esi + 0x105], 0
call edi
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417715
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
mov eax, dword [esi - 4]
mov edi, dword [esi - 0xc]
mov ecx, 1
sub ecx, eax
mov eax, dword [esi - 8]
sub eax, edi
or eax, ecx
jge 0x417758
push edi
lea ecx, [esp + 0x14]
call fcn.00401650
mov esi, dword [esp + 0x10]
push edi
lea eax, [esp + 0x50]
push esi
push eax
call fcn.00428da0
mov eax, dword [esi - 0xc]
mov byte [esp + eax + 0x58], 0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417774
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
lea ecx, [esp + 0x4c]
push ecx
push 0x464468
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_PathsWanMP3.exe
mov dword [esi - 0xc], eax
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [eax + esi], 0
call fcn.004164c0
lea eax, [esi - 0x10]
add esp, 0x10
mov dword [esp + 0x314], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4177d4
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerMenuExt_
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x417dc8
cmp dword [esp + 0x2c], 2
jne 0x417bda
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push 0x464468
push eax
mov dword [esp + 0x40], 0x12c
mov dword [esp + 0x38], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417a58
lea ecx, [esp + 0x4c]
push ecx
lea ecx, [esp + 0x20]
call fcn.00401c70
mov dword [esp + 0x314], 0xe
call fcn.0043d49d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov ebx, dword [esi - 4]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, ebx
sub eax, ebp
or eax, ecx
mov byte [esp + 0x314], 0xf
jge 0x4178a7
push ebp
lea ecx, [esp + 0x14]
call fcn.00401650
mov esi, dword [esp + 0x10]
cmp dword [esi - 8], ebp
jge 0x4178b6
push 0x80070057
call fcn.00401140
push 0x104
push esi
mov dword [esi - 0xc], ebp
push 0
mov byte [esi + 0x105], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4178d3
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push str.res:__
push ecx
call fcn.00401ae0
push str._search.htm
push eax
lea edx, [esp + 0x2c]
mov bl, 0x10
push edx
mov byte [esp + 0x32c], bl
call fcn.004065c0
add esp, 0x18
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x318], 0x11
call fcn.00401a30
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x314], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417959
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x314], 0xf
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41797f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 0xc]
push eax
push eax
lea ecx, [esp + 0x18]
call fcn.00401740
push eax
lea ecx, [esp + 0x54]
push ecx
call fcn.00428da0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi - 0xc]
mov byte [esp + eax + 0x58], 0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4179b0
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
mov edx, dword [esp + 0x1c]
push edx
push esi
call fcn.0042826b
add esp, 8
test eax, eax
je 0x417a2a
lea eax, [esp + 0x4c]
push eax
push 0x464468
push str.SoftwareMicrosoftInternet_ExplorerMenuExt_
push SysReAllocString
call fcn.004164c0
lea ecx, [esp + 0x5c]
push ecx
push str.Contexts
push str.SoftwareMicrosoftInternet_ExplorerMenuExt_
push SysReAllocString
mov byte [esp + 0x6c], 0x30
mov byte [esp + 0x6f], 0
mov byte [esp + 0x6e], 0
mov byte [esp + 0x6d], 0
call fcn.00415d40
add esp, 0x20
lea eax, [esi - 0x10]
mov byte [esp + 0x314], 0xe
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x417a4c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
jmp 0x417d9b
call fcn.0043d49d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov ebx, dword [esi - 4]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, ebx
sub eax, ebp
or eax, ecx
mov dword [esp + 0x314], 0x12
jge 0x417a97
push ebp
lea ecx, [esp + 0x14]
call fcn.00401650
mov esi, dword [esp + 0x10]
cmp dword [esi - 8], ebp
jge 0x417aa6
push 0x80070057
call fcn.00401140
push 0x104
push esi
mov dword [esi - 0xc], ebp
push 0
mov byte [esi + 0x105], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417ac3
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push str.res:__
push ecx
call fcn.00401ae0
push str._search.htm
push eax
lea edx, [esp + 0x2c]
mov bl, 0x13
push edx
mov byte [esp + 0x32c], bl
call fcn.004065c0
add esp, 0x18
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x318], 0x14
call fcn.00401a30
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x314], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417b49
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x314], 0x12
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417b6f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
mov eax, dword [eax - 0xc]
push eax
push eax
lea ecx, [esp + 0x18]
call fcn.00401740
push eax
lea ecx, [esp + 0x54]
push ecx
call fcn.00428da0
mov esi, dword [esp + 0x1c]
mov eax, dword [esi - 0xc]
mov byte [esp + eax + 0x58], 0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417ba0
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
lea edx, [esp + 0x4c]
push edx
push 0x464468
push str.SoftwareMicrosoftInternet_ExplorerMenuExt_
mov dword [esi - 0xc], eax
push SysReAllocString
mov byte [eax + esi], 0
call fcn.004164c0
lea eax, [esp + 0x5c]
push eax
jmp 0x417d6d
call fcn.0043d49d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [esp + 0x10], esi
mov ebx, dword [esi - 4]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, ebx
sub eax, ebp
or eax, ecx
mov dword [esp + 0x314], 0x15
jge 0x417c19
push ebp
lea ecx, [esp + 0x14]
call fcn.00401650
mov esi, dword [esp + 0x10]
cmp dword [esi - 8], ebp
jge 0x417c28
push 0x80070057
call fcn.00401140
push 0x104
push esi
mov dword [esi - 0xc], ebp
push 0
mov byte [esi + 0x105], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417c45
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
mov dword [esi - 0xc], eax
mov byte [eax + esi], 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x28]
push str.res:__
push ecx
call fcn.00401ae0
push str._search.htm
push eax
lea edx, [esp + 0x2c]
mov bl, 0x16
push edx
mov byte [esp + 0x32c], bl
call fcn.004065c0
add esp, 0x18
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x318], 0x17
call fcn.00401a30
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
mov byte [esp + 0x314], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417cc3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x314], 0x15
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417ce9
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov esi, dword [esp + 0x10]
mov edi, dword [esi - 0xc]
mov ebp, dword [esi - 4]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, ebp
sub eax, edi
or eax, ecx
jge 0x417d11
push edi
lea ecx, [esp + 0x14]
call fcn.00401650
mov esi, dword [esp + 0x10]
push edi
lea eax, [esp + 0x50]
push esi
push eax
call fcn.00428da0
mov eax, dword [esi - 0xc]
mov byte [esp + eax + 0x58], 0
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417d30
sub eax, edx
js 0x417c1e
cmp eax, dword [esi - 8]
jg 0x417c1e
lea ecx, [esp + 0x4c]
push ecx
push 0x464468
push str.SoftwareMicrosoftInternet_ExplorerMenuExt_
mov dword [esi - 0xc], eax
push SysReAllocString
mov byte [eax + esi], 0
call fcn.004164c0
lea edx, [esp + 0x5c]
push edx
push str.Contexts
push str.SoftwareMicrosoftInternet_ExplorerMenuExt_
push SysReAllocString
mov byte [esp + 0x6d], 0
mov byte [esp + 0x6e], 0
mov byte [esp + 0x6f], 0
mov byte [esp + 0x6c], 0x30
call fcn.00415d40
add esp, 0x20
lea eax, [esi - 0x10]
mov dword [esp + 0x314], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x417dbd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xor edi, edi
mov dword [esp + 0x1c], edi
test edi, edi
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.mp3OpenWithList
je 0x417de2
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.wmaOpenWithList
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push ebx
push SysReAllocString
call ebp
test eax, eax
jne 0x417fd6
cmp dword [esp + 0x2c], 2
jne 0x417f94
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x50]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push str.MRUList
push eax
mov dword [esp + 0x40], 0x12c
mov dword [esp + 0x38], 1
mov byte [esp + 0x28], 0
mov byte [esp + 0x29], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417f94
xor ecx, ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], ecx
lea eax, [esp + 0x4c]
mov byte [esp + 0x48], cl
xor ebp, ebp
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417e80
sub eax, edx
mov dword [esp + 0x18], eax
je 0x417f13
mov al, byte [esp + ebp + 0x4c]
cmp al, 0x61
mov byte [esp + 0x10], al
jl 0x417eab
cmp al, 0x7a
jg 0x417eab
movsx edx, al
mov byte [esp + edx - 0x31], 1
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x17c]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x28]
push edx
push 0
lea eax, [esp + 0x20]
push eax
push ecx
inc ebp
mov dword [esp + 0x40], 0x12c
mov dword [esp + 0x38], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x417eff
mov edi, 0x45cf30
lea esi, [esp + 0x178]
mov ecx, 0xb
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x417fc1
lea eax, [esp + 0x4c]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x417f06
sub eax, edx
cmp ebp, eax
jb 0x417e93
xor eax, eax
mov cl, byte [esp + eax + 0x30]
test cl, cl
je 0x417f48
mov cl, byte [esp + eax + 0x31]
test cl, cl
je 0x417f47
add eax, 2
cmp eax, 0x1a
jb 0x417f15
push 0x45cf30
push 0x45ecfc
push ebx
push SysReAllocString
call fcn.004164c0
add esp, 0x10
jmp 0x417fc1
inc eax
cmp eax, 0x1a
jae 0x417f2d
add al, 0x61
mov byte [esp + 0x1dc], al
xor eax, eax
jmp 0x417f60
mov cl, byte [esp + eax + 0x4c]
mov byte [esp + eax + 0x1dd], cl
inc eax
test cl, cl
jne 0x417f60
lea eax, [esp + 0x1dc]
push eax
push str.MRUList
push ebx
push SysReAllocString
call fcn.004164c0
push 0x45cf30
lea ecx, [esp + 0x24]
push ecx
jmp 0x417fb3
push 0x45ecfc
push str.MRUList
push ebx
push SysReAllocString
call fcn.004164c0
push 0x45cf30
push 0x45ecfc
push ebx
push SysReAllocString
call fcn.004164c0
add esp, 0x20
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, dword [esp + 0x1c]
test edi, edi
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.mp3
je 0x417fe4
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.wma
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push esi
push SysReAllocString
call ebp
test eax, eax
jne 0x418066
cmp dword [esp + 0x2c], 2
jne 0x418043
lea edx, [esp + 0x28]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push str.Application
push edx
mov dword [esp + 0x40], 0x12c
mov dword [esp + 0x38], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41805b
push 0x45cf30
push str.Application
push esi
push SysReAllocString
call fcn.004164c0
add esp, 0x10
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
cmp edi, 2
mov dword [esp + 0x1c], edi
jl 0x417dd4
mov ecx, dword [esp + 0x30c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x2fc]
pop ebx
call fcn.0042825d
add esp, 0x308
ret