Function at 0x504c40
Capabilities:
Get graphical window text
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x657efb
mov eax, dword fs:[0]
push eax
sub esp, 0x4b8
mov eax, dword [0x758898]
xor eax, esp
mov dword [esp + 0x4b4], eax
push esi
push edi
mov eax, dword [0x758898]
xor eax, esp
push eax
lea eax, [esp + 0x4c4]
mov dword fs:[0], eax
mov esi, ecx
call fcn.005f6b34
push 0x65e
mov ecx, esi
mov dword [esi + 0x138], esi
mov dword [esi + 0x13c], 0x65e
call fcn.005f5a75
mov eax, dword [eax + 0x20]
mov dword [esi + 0x134], eax
cmp dword [esi + 0x158], 0
je 0x504cc8
lea ecx, [esi + 0x150]
push ecx
push 1
push 0
push 0
push 0
push esi
call fcn.0045b550
add esp, 0x18
jmp 0x504cd1
push esi
call fcn.0045bf70
add esp, 4
mov edx, dword [esi + 0x20]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x31
push edx
call edi
push eax
call fcn.005fe202
test eax, eax
je 0x504d93
mov edx, dword [eax + 4]
lea ecx, [esp + 0x1c]
push ecx
push 0x3c
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x504d93
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, 0x3ff
and ax, cx
mov edx, 4
cmp dx, ax
je 0x504d2a
mov dword [esp + 0x2c], 0x258
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call fcn.005fdf46
mov ecx, dword [eax + 4]
push 0x48
push 0x5a
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 9
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov edx, dword [0x678e3c]
mov cl, byte [0x678e42]
neg eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x1c], eax
mov ax, word [0x678e40]
lea edx, [esp + 0x1c]
push edx
mov word [esp + 0x40], ax
mov byte [esp + 0x42], cl
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
test eax, eax
je 0x504d93
push 1
push eax
mov eax, dword [esi + 0x134]
push 0x30
push eax
call edi
cmp dword [0x75dd30], 0
je 0x504e4c
push 0x126
push esi
mov ecx, 0x75dcf0
call fcn.004e6a60
xor ecx, ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov word [esp + 0x14], cx
mov dword [esp + 0x4cc], ecx
mov edx, dword [0x75dd28]
mov eax, dword [0x75f2f4]
push edx
push eax
lea ecx, [esp + 0x18]
call fcn.00401970
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x504df0
lea eax, [esp + 0x14]
mov ecx, dword [esi + 0x134]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
push ecx
call edi
push 0x40
lea edx, [esp + 0x5c]
push edx
push 0x435
mov ecx, esi
call fcn.005f5a75
mov eax, dword [eax + 0x20]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x504e38
lea ecx, [esp + 0x58]
push ecx
push 0x65d
mov ecx, esi
call fcn.005f5a75
mov edx, dword [eax + 0x20]
push edx
call edi
mov dword [esp + 0x4cc], 0xffffffff
lea ecx, [esp + 0x10]
call fcn.00401210
push 0x3e7
lea eax, [esp + 0xdc]
push 0
push eax
call fcn.00621270
mov eax, dword [0x75dbe4]
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xdc]
push edx
push 0
push 0
push str.Extensions
push eax
mov dword [esp + 0x24], 0x3e7
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x504ec4
lea ecx, [esp + 0xd8]
push ecx
push 0x42f
mov ecx, esi
call fcn.005f5af2
lea eax, [esp + 0xd8]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x504eb0
sub eax, edx
push eax
lea edx, [esp + 0xdc]
push edx
jmp 0x504edf
push str.3GP_7Z_AAC_ACE_AIF_APK_ARJ_ASF_AVI_BIN_BZ2_EXE_GZ_GZIP_IMG_ISO_LZH_M4A_M4V_MKV_MOV_MP3_MP4_MPA_MPE_MPEG_MPG_MSI_MSU_OGG_OGV_PDF_PLJ_PPS_PPT_QT_R0_R1_RA_RAR_RM_RMVB_SEA_SIT_SITX_TAR_TIF_TIFF_WAV_WMA_WMV_Z_ZIP
push 0x42f
mov ecx, esi
call fcn.005f5af2
push 0xd1
push str.3GP_7Z_AAC_ACE_AIF_APK_ARJ_ASF_AVI_BIN_BZ2_EXE_GZ_GZIP_IMG_ISO_LZH_M4A_M4V_MKV_MOV_MP3_MP4_MPA_MPE_MPEG_MPG_MSI_MSU_OGG_OGV_PDF_PLJ_PPS_PPT_QT_R0_R1_RA_RAR_RM_RMVB_SEA_SIT_SITX_TAR_TIF_TIFF_WAV_WMA_WMV_Z_ZIP
lea ecx, [esi + 0x148]
call fcn.00402950
mov eax, dword [esi + 0x144]
mov eax, dword [eax + 4]
test eax, eax
je 0x504f03
push eax
lea ecx, [esi + 0xdc]
call fcn.005f5bdf
mov eax, 1
mov ecx, dword [esp + 0x4c4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x4b4]
xor ecx, esp
call fcn.00620b8d
add esp, 0x4c4
ret