Function at 0x57096b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x58a8f1
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x5f6998]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, 0xbf69
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
mov edi, eax
mov ecx, eax
cmp ecx, 0x415
jg 0x57092b
je 0x570921
sub ecx, 0x404
cmp ecx, 0x10
ja case.0x5708fc.1029
movzx ecx, byte [ecx + 0x570d1c]
jmp dword [ecx*4 + 0x570d08]
mov eax, 0xbf75
jmp 0x570ceb
mov eax, 0xbf71
jmp 0x570ceb
mov eax, 0xbf7e
jmp 0x570ceb
mov eax, 0xbf7f
jmp 0x570ceb
cmp ecx, 0x1404
jg 0x570959
je 0x570945
cmp ecx, 0x816
je 0x57094f
cmp ecx, 0xc04
jne case.0x5708fc.1029
mov eax, 0xbf8d
jmp 0x570ceb
mov eax, 0xbf80
jmp 0x570ceb
cmp ecx, 0x7c04
jne case.0x5708fc.1029
mov eax, 0xbf70
jmp 0x570ceb
and eax, 0x3ff
add eax, 0xfffffffc
cmp eax, 0x19
ja case.0x57097f.5
movzx edx, byte [eax + 0x570d60]
jmp dword [edx*4 + 0x570d30]
mov esi, 0xbf78
jmp case.0x57097f.5
mov esi, 0xbf76
jmp case.0x57097f.5
mov esi, 0xbf8f
jmp case.0x57097f.5
mov esi, 0xbf72
jmp case.0x57097f.5
mov esi, 0xbf7a
jmp case.0x57097f.5
mov esi, 0xbf83
jmp case.0x57097f.5
mov esi, 0xbf89
jmp case.0x57097f.5
mov esi, 0xbf7b
jmp case.0x57097f.5
mov esi, 0xbf6f
jmp case.0x57097f.5
mov esi, 0xbf81
jmp case.0x57097f.5
mov esi, 0xbf86
cmp dword [0x5fbd64], 2
jne 0x570ce8
mov eax, 0xbf69
cmp si, ax
jne 0x570ce8
xor ebx, ebx
xor ecx, ecx
mov esi, eax
mov dword [ebp - 0x43c], 7
mov dword [ebp - 0x440], ebx
mov word [ebp - 0x450], cx
lea edx, [ebp - 0x454]
push edx
push 0x20019
push ebx
push str.SOFTWAREClassesMIMEDatabaseRfc1766
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
mov dword [ebp - 0x454], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x570b35
push 0x1fc
lea ecx, [ebp - 0x416]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x418], ax
call fcn.00542dc0
push edi
push str._04X
lea edx, [ebp - 0x418]
push 0xff
push edx
call fcn.0054687c
push 0x206
lea ecx, [ebp - 0x216]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x218], ax
call fcn.00542dc0
add esp, 0x28
lea edx, [ebp - 0x458]
push edx
mov edx, dword [ebp - 0x454]
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
lea ecx, [ebp - 0x418]
push ecx
push edx
mov dword [ebp - 0x458], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [ebp - 0x454]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x570b35
xor ecx, ecx
lea edx, [ebp - 0x218]
mov word [ebp - 0x12], cx
push edx
lea ecx, [ebp - 0x450]
call fcn.00403b10
push 1
push ebx
lea eax, [ebp - 0x45c]
push eax
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x45c], 0x3b
call fcn.00401810
cmp eax, ebx
jbe 0x570b35
push eax
push ebx
lea ecx, [ebp - 0x434]
push ecx
lea ecx, [ebp - 0x450]
call fcn.00403b40
push eax
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 1
call fcn.00403c40
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], bl
call fcn.004027c0
mov eax, dword [ebp - 0x440]
cmp eax, 1
jle 0x570cd0
push 2
add eax, 0xfffffffe
push eax
lea edx, [ebp - 0x434]
push edx
lea ecx, [ebp - 0x450]
call fcn.00403b40
lea eax, [ebp - 0x434]
push 0x592274
push eax
mov byte [ebp - 4], 2
call fcn.00402390
add esp, 8
test al, al
je 0x570b82
mov esi, 0xbf78
jmp 0x570cc5
lea ecx, [ebp - 0x434]
push 0x59227c
push ecx
call fcn.00402390
add esp, 8
test al, al
je 0x570ba4
mov esi, 0xbf76
jmp 0x570cc5
lea edx, [ebp - 0x434]
push 0x592210
push edx
call fcn.00402390
add esp, 8
test al, al
je 0x570bc6
mov esi, 0xbf8f
jmp 0x570cc5
lea eax, [ebp - 0x434]
push 0x59223c
push eax
call fcn.00402390
add esp, 8
test al, al
je 0x570be8
mov esi, 0xbf81
jmp 0x570cc5
lea ecx, [ebp - 0x434]
push 0x592234
push ecx
call fcn.00402390
add esp, 8
test al, al
je 0x570c0a
mov esi, 0xbf83
jmp 0x570cc5
lea edx, [ebp - 0x434]
push 0x59226c
push edx
call fcn.00402390
add esp, 8
test al, al
je 0x570c2c
mov esi, 0xbf7a
jmp 0x570cc5
lea eax, [ebp - 0x434]
push 0x592290
push eax
call fcn.00402390
add esp, 8
test al, al
je 0x570c4b
mov esi, 0xbf72
jmp 0x570cc5
lea ecx, [ebp - 0x434]
push 0x5c70c8
push ecx
call fcn.00402390
add esp, 8
test al, al
je 0x570c6a
mov esi, 0xbf6f
jmp 0x570cc5
lea edx, [ebp - 0x434]
push 0x592220
push edx
call fcn.00402390
add esp, 8
test al, al
je 0x570c89
mov esi, 0xbf89
jmp 0x570cc5
lea eax, [ebp - 0x434]
push 0x5c70c0
push eax
call fcn.00402390
add esp, 8
test al, al
je 0x570ca8
mov esi, 0xbf7b
jmp 0x570cc5
lea ecx, [ebp - 0x434]
push 0x592250
push ecx
call fcn.00402390
add esp, 8
test al, al
je 0x570cc5
mov esi, 0xbf7f
lea ecx, [ebp - 0x434]
call fcn.004027c0
cmp dword [ebp - 0x43c], 8
jb 0x570ce8
mov edx, dword [ebp - 0x450]
push edx
call fcn.0043f967
add esp, 4
mov ax, si
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00542c3e
mov esp, ebp
pop ebp
ret