Function at 0x45e050
Capabilities:
Get file system object information
Query or enumerate registry value

Disassembly:
mov eax, 0x2f28
call fcn.004ac5b0
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x2f24], eax
push ebx
push ebp
push esi
push edi
xor eax, eax
mov ebx, edx
push 0x7fe
push eax
mov word [esp + 0xf38], ax
mov esi, ecx
lea eax, [esp + 0xf3a]
mov dword [esp + 0x28], ebx
push eax
call fcn.0048fb10
add esp, 0xc
xor eax, eax
mov word [esp + 0x730], ax
push 0x7fe
push eax
lea eax, [esp + 0x73a]
push eax
call fcn.0048fb10
add esp, 0xc
xor eax, eax
mov word [esp + 0x320], ax
push 0x206
push eax
lea eax, [esp + 0x32a]
push eax
call fcn.0048fb10
add esp, 0xc
xor eax, eax
mov word [esp + 0x528], ax
push 0x206
push eax
lea eax, [esp + 0x532]
push eax
call fcn.0048fb10
add esp, 0xc
push 0x29c5
push dword [0x4e6030]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
mov dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push eax
push 0x20119
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x45e4f7
xor eax, eax
mov dword [esp + 0x28], 0
push 0x7fe
push eax
mov word [esp + 0x1f38], ax
lea eax, [esp + 0x1f3a]
push eax
call fcn.0048fb10
add esp, 0xc
xor eax, eax
mov word [esp + 0x1730], ax
push 0x7fe
push eax
lea eax, [esp + 0x173a]
push eax
call fcn.0048fb10
add esp, 0xc
mov dword [esp + 0x1c], 0x400
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x400
push eax
lea eax, [esp + 0x1734]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1f44]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x45e4ed
nop word [eax + eax]
lea edx, [esp + 0xf30]
lea ecx, [esp + 0x1730]
call fcn.0045e940
xor eax, eax
lea edx, [esp + 0x320]
mov word [esp + 0x320], ax
lea ecx, [esp + 0xf30]
mov word [esp + 0x528], ax
lea eax, [esp + 0x528]
push eax
call fcn.0045ded0
add esp, 4
lea eax, [esp + 0xf30]
push eax
lea eax, [esp + 0x734]
push eax
call ebp
push 0
lea eax, [esp + 0xf34]
push eax
push 0x104
push 0
lea eax, [esp + 0x740]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push 0x2b4
lea eax, [esp + 0x6c]
push 0
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x68]
xor ebp, ebp
push 0x101
push 0x2b4
push eax
push ebp
lea eax, [esp + 0xf40]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x45e2a2
push dword [esp + 0x68]
push 0xffffffffffffffff
push dword [0x4e2834]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push dword [0x4e2834]
mov ebp, eax
push 1
push 0x1003
push edi
call ebx
push 0
push 0
push 0x1004
push edi
mov dword [0x4e2954], ebp
call ebx
push 0x4e2938
mov dword [0x4e293c], eax
lea eax, [esp + 0x1f34]
push 0
push 0x104d
mov dword [0x4e294c], eax
mov eax, dword [esp + 0x2f48]
push edi
mov dword [0x4e2940], 0
mov dword [0x4e2960], eax
call ebx
cmp word [esp + 0x320], 0
jne 0x45e316
lea eax, [esp + 0xf30]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push eax
lea eax, [esp + 0x324]
push eax
call ebp
jmp 0x45e31c
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x320]
mov dword [esp + 0x34], 1
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push dword [0x4e293c]
push 0x1074
push edi
call ebx
lea eax, [esp + 0x528]
mov dword [esp + 0x34], 2
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push dword [0x4e293c]
push 0x1074
push edi
call ebx
lea eax, [esp + 0x1730]
mov dword [esp + 0x34], 3
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push dword [0x4e293c]
push 0x1074
push edi
call ebx
cmp esi, 0x80000000
jne 0x45e39d
mov eax, str.HKEY_CLASSES_ROOT
jmp 0x45e3fb
cmp esi, 0x80000001
jne 0x45e3ac
mov eax, str.HKEY_CURRENT_USER
jmp 0x45e3fb
cmp esi, 0x80000002
jne 0x45e3bb
mov eax, str.HKEY_LOCAL_MACHINE
jmp 0x45e3fb
cmp esi, 0x80000003
jne 0x45e3ca
mov eax, str.HKEY_USERS
jmp 0x45e3fb
cmp esi, 0x80000004
jne 0x45e3d9
mov eax, str.HKEY_PERFORMANCE_DATA
jmp 0x45e3fb
cmp esi, 0x80000005
jne 0x45e3e8
mov eax, str.HKEY_CURRENT_CONFIG
jmp 0x45e3fb
cmp esi, 0x80000006
mov eax, str.HKEY_DYN_DATA
mov ecx, str.HKEY_CLASSES_ROOT
cmovne eax, ecx
push eax
lea eax, [esp + 0x734]
push eax
call ebp
push 0x4b3500
lea eax, [esp + 0x734]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push dword [esp + 0x20]
lea eax, [esp + 0x734]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x4bdb04
lea eax, [esp + 0x734]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x1f30]
push eax
lea eax, [esp + 0x734]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x730]
mov dword [esp + 0x34], 4
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push dword [0x4e293c]
push 0x1074
push edi
call ebx
lea eax, [esp + 0x2c]
mov dword [esp + 0x3c], 0xf000
push eax
push dword [0x4e293c]
mov dword [esp + 0x40], 0x2000
push 0x102b
push edi
call ebx
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x1734]
mov dword [esp + 0x20], 0x400
push ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], 0x400
push ecx
push 0
lea ecx, [esp + 0x2c]
inc eax
push ecx
lea ecx, [esp + 0x1f44]
mov dword [esp + 0x3c], eax
push ecx
push eax
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x45e1d0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x2738], ax
lea eax, [esp + 0x273a]
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x2730]
push dword [esp + 0x20]
push eax
call ebp
push 0x4b5b9c
lea eax, [esp + 0x2734]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x14]
push eax
push 0x20119
push 0
lea eax, [esp + 0x273c]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45e91f
push 0x7fe
push eax
mov dword [esp + 0x28], eax
mov word [esp + 0x1738], ax
lea eax, [esp + 0x173a]
push eax
call fcn.0048fb10
add esp, 0xc
xor eax, eax
mov word [esp + 0x1f30], ax
push 0x7fe
push eax
lea eax, [esp + 0x1f3a]
push eax
call fcn.0048fb10
add esp, 0xc
mov dword [esp + 0x18], 0x400
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0x400
push eax
lea eax, [esp + 0x1f34]
push eax
lea eax, [esp + 0x2c]
push eax
push 0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x1744]
push eax
push 0
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x45e915
nop word [eax + eax]
lea edx, [esp + 0xf30]
lea ecx, [esp + 0x1f30]
call fcn.0045e940
xor eax, eax
lea edx, [esp + 0x320]
mov word [esp + 0x320], ax
lea ecx, [esp + 0xf30]
mov word [esp + 0x528], ax
lea eax, [esp + 0x528]
push eax
call fcn.0045ded0
add esp, 4
lea eax, [esp + 0xf30]
push eax
lea eax, [esp + 0x734]
push eax
call ebp
push 0
lea eax, [esp + 0xf34]
push eax
push 0x104
push 0
lea eax, [esp + 0x740]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push 0x2b4
lea eax, [esp + 0x6c]
push 0
push eax
call fcn.0048fb10
add esp, 0xc
lea eax, [esp + 0x68]
xor ebp, ebp
push 0x111
push 0x2b4
push eax
push 0x80
lea eax, [esp + 0xf40]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x45e6c6
push dword [esp + 0x68]
push 0xffffffffffffffff
push dword [0x4e2834]
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push dword [0x4e2834]
mov ebp, eax
push 1
push 0x1003
push edi
call ebx
push 0
push 0
push 0x1004
push edi
mov dword [0x4e2954], ebp
call ebx
push 0x4e2938
mov dword [0x4e293c], eax
lea eax, [esp + 0x1734]
push 0
push 0x104d
mov dword [0x4e294c], eax
mov eax, dword [esp + 0x2f48]
push edi
mov dword [0x4e2940], 0
mov dword [0x4e2960], eax
call ebx
cmp word [esp + 0x320], 0
jne 0x45e73a
lea eax, [esp + 0xf30]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push eax
lea eax, [esp + 0x324]
push eax
call ebp
jmp 0x45e740
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x320]
mov dword [esp + 0x34], 1
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push dword [0x4e293c]
push 0x1074
push edi
call ebx
lea eax, [esp + 0x528]
mov dword [esp + 0x34], 2
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push dword [0x4e293c]
push 0x1074
push edi
call ebx
lea eax, [esp + 0x1f30]
mov dword [esp + 0x34], 3
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push dword [0x4e293c]
push 0x1074
push edi
call ebx
cmp esi, 0x80000000
jne 0x45e7c1
mov eax, str.HKEY_CLASSES_ROOT
jmp 0x45e81f
cmp esi, 0x80000001
jne 0x45e7d0
mov eax, str.HKEY_CURRENT_USER
jmp 0x45e81f
cmp esi, 0x80000002
jne 0x45e7df
mov eax, str.HKEY_LOCAL_MACHINE
jmp 0x45e81f
cmp esi, 0x80000003
jne 0x45e7ee
mov eax, str.HKEY_USERS
jmp 0x45e81f
cmp esi, 0x80000004
jne 0x45e7fd
mov eax, str.HKEY_PERFORMANCE_DATA
jmp 0x45e81f
cmp esi, 0x80000005
jne 0x45e80c
mov eax, str.HKEY_CURRENT_CONFIG
jmp 0x45e81f
cmp esi, 0x80000006
mov eax, str.HKEY_DYN_DATA
mov ecx, str.HKEY_CLASSES_ROOT
cmovne eax, ecx
push eax
lea eax, [esp + 0x734]
push eax
call ebp
push 0x4b3500
lea eax, [esp + 0x734]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x2730]
push eax
lea eax, [esp + 0x734]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x4bdb04
lea eax, [esp + 0x734]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x1730]
push eax
lea eax, [esp + 0x734]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x730]
mov dword [esp + 0x34], 4
mov dword [esp + 0x40], eax
lea eax, [esp + 0x2c]
push eax
push dword [0x4e293c]
push 0x1074
push edi
call ebx
lea eax, [esp + 0x2c]
mov dword [esp + 0x3c], 0xf000
push eax
push dword [0x4e293c]
mov dword [esp + 0x40], 0x1000
push 0x102b
push edi
call ebx
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x1f34]
mov dword [esp + 0x1c], 0x400
push ecx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0x400
push ecx
push 0
lea ecx, [esp + 0x28]
inc eax
push ecx
lea ecx, [esp + 0x1744]
mov dword [esp + 0x34], eax
push ecx
push eax
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x45e5f0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x2f34]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048ea75
add esp, 0x2f28
ret