Function at 0x44b960
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x48b412
mov eax, dword fs:[0]
push eax
sub esp, 0x518
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x510], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x52c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x53c]
lea ecx, [esp + 0x14]
xorps xmm0, xmm0
push eax
movdqu xmmword [esp + 0x18], xmm0
call fcn.00462ee0
mov eax, dword [esp + 0x14]
cmp eax, 5
jl 0x44c549
jne 0x44b9cf
cmp dword [esp + 0x18], 9
jl 0x44c549
push 0x35
xor eax, eax
mov dword [esp + 0x5c], 0
mov dword [esp + 0x60], 0
lea ecx, [esp + 0x4c]
push str.SOFTWAREClasses_shellexContextMenuHandlersHaoZip
mov dword [esp + 0x4c], 0x80000002
mov dword [esp + 0x64], 7
mov dword [esp + 0x60], 0
mov word [esp + 0x50], ax
call fcn.00402f90
mov dword [esp + 0x534], 0
xor eax, eax
push 0x32
mov dword [esp + 0x78], 0
lea ecx, [esp + 0x68]
mov dword [esp + 0x7c], 0
push str.SOFTWAREClasses_shellexDragDropHandlersHaoZip
mov dword [esp + 0x68], 0x80000002
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], 0
mov word [esp + 0x6c], ax
call fcn.00402f90
mov byte [esp + 0x534], 1
xor eax, eax
push 0x37
mov dword [esp + 0x94], 0
lea ecx, [esp + 0x84]
mov dword [esp + 0x98], 0
push str.SOFTWAREClasses_shellexPropertySheetHandlersHaoZip
mov dword [esp + 0x84], 0x80000002
mov dword [esp + 0x9c], 7
mov dword [esp + 0x98], 0
mov word [esp + 0x88], ax
call fcn.00402f90
mov byte [esp + 0x534], 2
xor eax, eax
push 0x3d
mov dword [esp + 0xb0], 0
lea ecx, [esp + 0xa0]
mov dword [esp + 0xb4], 0
push str.SOFTWAREClassesCLSID5FED836A_C96C_4d88_A91E_F63F07726585
mov dword [esp + 0xa0], 0x80000002
mov dword [esp + 0xb8], 7
mov dword [esp + 0xb4], 0
mov word [esp + 0xa4], ax
call fcn.00402f90
mov byte [esp + 0x534], 3
xor eax, eax
push 0x4c
mov dword [esp + 0xcc], 0
lea ecx, [esp + 0xbc]
mov dword [esp + 0xd0], 0
push str.SOFTWAREClassesCLSID5FED836A_C96C_4d88_A91E_F63F07726585InprocServer32
mov dword [esp + 0xbc], 0x80000002
mov dword [esp + 0xd4], 7
mov dword [esp + 0xd0], 0
mov word [esp + 0xc0], ax
call fcn.00402f90
mov byte [esp + 0x534], 4
xor eax, eax
push 0x3d
mov dword [esp + 0xe8], 0
lea ecx, [esp + 0xd8]
mov dword [esp + 0xec], 0
push str.SOFTWAREClassesDirectory_shellexContextMenuHandlersHaoZip
mov dword [esp + 0xd8], 0x80000002
mov dword [esp + 0xf0], 7
mov dword [esp + 0xec], 0
mov word [esp + 0xdc], ax
call fcn.00402f90
mov byte [esp + 0x534], 5
mov dword [esp + 0xec], 0x80000002
mov dword [esp + 0x100], 0
mov dword [esp + 0x104], 0
push 0x3a
xor eax, eax
mov dword [esp + 0x108], 7
push str.SOFTWAREClassesDirectory_shellexDragDropHandlersHaoZip
lea ecx, [esp + 0xf8]
mov dword [esp + 0x108], 0
mov word [esp + 0xf8], ax
call fcn.00402f90
mov byte [esp + 0x534], 6
xor eax, eax
push 0x39
mov dword [esp + 0x120], 0
lea ecx, [esp + 0x110]
mov dword [esp + 0x124], 0
push str.SOFTWAREClassesDrive_shellexContextMenuHandlersHaoZip
mov dword [esp + 0x110], 0x80000002
mov dword [esp + 0x128], 7
mov dword [esp + 0x124], 0
mov word [esp + 0x114], ax
call fcn.00402f90
mov byte [esp + 0x534], 7
xor eax, eax
push 0x36
mov dword [esp + 0x13c], 0
lea ecx, [esp + 0x12c]
mov dword [esp + 0x140], 0
push str.SOFTWAREClassesDrive_shellexDragDropHandlersHaoZip
mov dword [esp + 0x12c], 0x80000002
mov dword [esp + 0x144], 7
mov dword [esp + 0x140], 0
mov word [esp + 0x130], ax
call fcn.00402f90
mov byte [esp + 0x534], 8
xor eax, eax
push 0x3a
mov dword [esp + 0x158], 0
lea ecx, [esp + 0x148]
mov dword [esp + 0x15c], 0
push str.SOFTWAREClassesFolderShellExContextMenuHandlersHaoZip
mov dword [esp + 0x148], 0x80000002
mov dword [esp + 0x160], 7
mov dword [esp + 0x15c], 0
mov word [esp + 0x14c], ax
call fcn.00402f90
mov byte [esp + 0x534], 9
xor eax, eax
push 0x37
mov dword [esp + 0x174], 0
lea ecx, [esp + 0x164]
mov dword [esp + 0x178], 0
push str.SOFTWAREClassesFolderShellExDragDropHandlersHaoZip
mov dword [esp + 0x164], 0x80000002
mov dword [esp + 0x17c], 7
mov dword [esp + 0x178], 0
mov word [esp + 0x168], ax
call fcn.00402f90
mov byte [esp + 0x534], 0xa
xor eax, eax
push 0x3b
mov dword [esp + 0x190], 0
lea ecx, [esp + 0x180]
mov dword [esp + 0x194], 0
push str.SOFTWAREClasseslnkfile_shellexContextMenuHandlersHaoZip
mov dword [esp + 0x180], 0x80000002
mov dword [esp + 0x198], 7
mov dword [esp + 0x194], 0
mov word [esp + 0x184], ax
call fcn.00402f90
mov byte [esp + 0x534], 0xb
xor eax, eax
mov dword [esp + 0x1a8], 0
mov dword [esp + 0x1ac], 0
mov dword [esp + 0x194], 0x80000002
mov dword [esp + 0x1ac], 7
mov dword [esp + 0x1a8], 0
push 0x38
push str.SOFTWAREClasseslnkfile_shellexDragDropHandlersHaoZip
lea ecx, [esp + 0x1a0]
mov word [esp + 0x1a0], ax
call fcn.00402f90
mov byte [esp + 0x534], 0xc
xor eax, eax
push 0x24
mov dword [esp + 0x1c8], 0
lea ecx, [esp + 0x1b8]
mov dword [esp + 0x1cc], 0
push str._shellexContextMenuHandlersHaoZip
mov dword [esp + 0x1b8], 0x80000000
mov dword [esp + 0x1d0], 7
mov dword [esp + 0x1cc], 0
mov word [esp + 0x1bc], ax
call fcn.00402f90
mov byte [esp + 0x534], 0xd
xor eax, eax
push 0x21
mov dword [esp + 0x1e4], 0
lea ecx, [esp + 0x1d4]
mov dword [esp + 0x1e8], 0
push str._shellexDragDropHandlersHaoZip
mov dword [esp + 0x1d4], 0x80000000
mov dword [esp + 0x1ec], 7
mov dword [esp + 0x1e8], 0
mov word [esp + 0x1d8], ax
call fcn.00402f90
mov byte [esp + 0x534], 0xe
xor eax, eax
push 0x26
mov dword [esp + 0x200], 0
lea ecx, [esp + 0x1f0]
mov dword [esp + 0x204], 0
push str._shellexPropertySheetHandlersHaoZip
mov dword [esp + 0x1f0], 0x80000000
mov dword [esp + 0x208], 7
mov dword [esp + 0x204], 0
mov word [esp + 0x1f4], ax
call fcn.00402f90
mov byte [esp + 0x534], 0xf
xor eax, eax
push 0x2c
mov dword [esp + 0x21c], 0
lea ecx, [esp + 0x20c]
mov dword [esp + 0x220], 0
push str.CLSID5FED836A_C96C_4d88_A91E_F63F07726585
mov dword [esp + 0x20c], 0x80000000
mov dword [esp + 0x224], 7
mov dword [esp + 0x220], 0
mov word [esp + 0x210], ax
call fcn.00402f90
mov byte [esp + 0x534], 0x10
xor eax, eax
push 0x3b
mov dword [esp + 0x238], 0
lea ecx, [esp + 0x228]
mov dword [esp + 0x23c], 0
push str.CLSID5FED836A_C96C_4d88_A91E_F63F07726585InprocServer32
mov dword [esp + 0x228], 0x80000000
mov dword [esp + 0x240], 7
mov dword [esp + 0x23c], 0
mov word [esp + 0x22c], ax
call fcn.00402f90
mov byte [esp + 0x534], 0x11
xor eax, eax
push 0x2c
mov dword [esp + 0x254], 0
mov dword [esp + 0x258], 0
mov dword [esp + 0x240], 0x80000000
mov dword [esp + 0x258], 7
mov dword [esp + 0x254], 0
mov word [esp + 0x244], ax
push str.Directory_shellexContextMenuHandlersHaoZip
lea ecx, [esp + 0x248]
call fcn.00402f90
mov byte [esp + 0x534], 0x12
xor eax, eax
push 0x29
mov dword [esp + 0x270], 0
lea ecx, [esp + 0x260]
mov dword [esp + 0x274], 0
push str.Directory_shellexDragDropHandlersHaoZip
mov dword [esp + 0x260], 0x80000000
mov dword [esp + 0x278], 7
mov dword [esp + 0x274], 0
mov word [esp + 0x264], ax
call fcn.00402f90
mov byte [esp + 0x534], 0x13
xor eax, eax
push 0x28
mov dword [esp + 0x28c], 0
lea ecx, [esp + 0x27c]
mov dword [esp + 0x290], 0
push str.Drive_shellexContextMenuHandlersHaoZip
mov dword [esp + 0x27c], 0x80000000
mov dword [esp + 0x294], 7
mov dword [esp + 0x290], 0
mov word [esp + 0x280], ax
call fcn.00402f90
mov byte [esp + 0x534], 0x14
xor eax, eax
push 0x25
mov dword [esp + 0x2a8], 0
lea ecx, [esp + 0x298]
mov dword [esp + 0x2ac], 0
push str.Drive_shellexDragDropHandlersHaoZip
mov dword [esp + 0x298], 0x80000000
mov dword [esp + 0x2b0], 7
mov dword [esp + 0x2ac], 0
mov word [esp + 0x29c], ax
call fcn.00402f90
mov byte [esp + 0x534], 0x15
xor eax, eax
push 0x29
mov dword [esp + 0x2c4], 0
lea ecx, [esp + 0x2b4]
mov dword [esp + 0x2c8], 0
push str.FolderShellExContextMenuHandlersHaoZip
mov dword [esp + 0x2b4], 0x80000000
mov dword [esp + 0x2cc], 7
mov dword [esp + 0x2c8], 0
mov word [esp + 0x2b8], ax
call fcn.00402f90
mov byte [esp + 0x534], 0x16
xor eax, eax
push 0x26
mov dword [esp + 0x2e0], 0
lea ecx, [esp + 0x2d0]
mov dword [esp + 0x2e4], 0
push str.FolderShellExDragDropHandlersHaoZip
mov dword [esp + 0x2d0], 0x80000000
mov dword [esp + 0x2e8], 7
mov dword [esp + 0x2e4], 0
mov word [esp + 0x2d4], ax
call fcn.00402f90
mov byte [esp + 0x534], 0x17
xor eax, eax
push 0x2a
mov dword [esp + 0x2fc], 0
lea ecx, [esp + 0x2ec]
mov dword [esp + 0x300], 0
push str.lnkfile_shellexContextMenuHandlersHaoZip
mov dword [esp + 0x2ec], 0x80000000
mov dword [esp + 0x304], 7
mov dword [esp + 0x300], 0
mov word [esp + 0x2f0], ax
call fcn.00402f90
mov byte [esp + 0x534], 0x18
xor eax, eax
push 0x27
mov dword [esp + 0x318], 0
lea ecx, [esp + 0x308]
mov dword [esp + 0x31c], 0
push str.lnkfile_shellexDragDropHandlersHaoZip
mov dword [esp + 0x308], 0x80000000
mov dword [esp + 0x320], 7
mov dword [esp + 0x31c], 0
mov word [esp + 0x30c], ax
call fcn.00402f90
mov dword [esp + 0x534], 0x19
xor eax, eax
push 0xc
mov dword [esp + 0x28], 0
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0
push str.Advapi32.dll
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
mov word [esp + 0x1c], ax
call fcn.00402f90
mov byte [esp + 0x534], 0x1a
mov eax, dword [0x4b025c]
test al, 1
jne 0x44c382
or eax, 1
mov dword [0x4b025c], eax
mov byte [esp + 0x534], 0x1b
mov dword [0x4b0258], 0
call fcn.0041d480
push 0x490fd0
call fcn.00480069
add esp, 4
mov byte [esp + 0x534], 0x1a
lea eax, [esp + 0x14]
mov ecx, 0x4b0258
push eax
call fcn.0041d650
mov edi, eax
mov byte [esp + 0x534], 0x19
cmp dword [esp + 0x28], 8
jb 0x44c3af
push dword [esp + 0x14]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
test edi, edi
jne 0x44c3ef
mov dword [esp + 0x534], 0xffffffff
lea eax, [esp + 0x44]
push 0x44b8f0
push 0x1a
push 0x1c
push eax
call fcn.004805c6
xor al, al
jmp 0x44c54e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegOpenKeyExW
push edi
call esi
push str.RegQueryValueExW
mov ebp, eax
push edi
mov dword [esp + 0x3c], ebp
call esi
push str.RegCloseKey
mov ebx, eax
push edi
mov dword [esp + 0x34], ebx
call esi
mov dword [esp + 0x30], eax
test ebp, ebp
je 0x44c3ca
test ebx, ebx
je 0x44c3ca
test eax, eax
je 0x44c3ca
xor eax, eax
mov bl, 1
push 0x206
push eax
mov word [esp + 0x324], ax
lea eax, [esp + 0x326]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
lea esi, [esp + 0x48]
xor ebp, ebp
mov dword [esp + 0x38], 0
mov edi, 0x20019
mov dword [esp + 0x40], 1
mov dword [esp + 0x3c], 0x103
call fcn.0041dd30
test al, al
mov eax, 0x20119
cmovne edi, eax
cmp dword [esi + 0x14], 8
jb 0x44c487
mov eax, dword [esi]
jmp 0x44c489
mov eax, esi
lea ecx, [esp + 0x38]
push ecx
push edi
push 0
push eax
push dword [esi - 4]
call dword [esp + 0x48]
test eax, eax
jne 0x44c525
mov word [esp + 0x31c], ax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x320]
push eax
lea eax, [esp + 0x48]
push eax
push 0
push 0
push dword [esp + 0x4c]
call dword [esp + 0x44]
test eax, eax
jne 0x44c503
mov eax, dword [esp + 0x3c]
mov ecx, 0x103
cmp eax, 0x103
cmovae eax, ecx
mov dword [esp + 0x3c], eax
add eax, eax
cmp eax, 0x208
jae 0x44c520
xor ecx, ecx
mov word [esp + eax + 0x31c], cx
lea ecx, [esp + 0x31c]
call fcn.0040ce60
test eax, eax
jne 0x44c505
xor bl, bl
push dword [esp + 0x38]
call dword [esp + 0x34]
test bl, bl
je 0x44c527
inc ebp
add esi, 0x1c
cmp ebp, 0x1a
jb 0x44c451
jmp 0x44c527
call fcn.004804d4
xor bl, bl
mov dword [esp + 0x534], 0xffffffff
lea eax, [esp + 0x44]
push 0x44b8f0
push 0x1a
push 0x1c
push eax
call fcn.004805c6
mov al, bl
jmp 0x44c54e
call fcn.0044ac90
mov ecx, dword [esp + 0x52c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.0047ff74
add esp, 0x524
ret 4