Function at 0x4498ef
Capabilities:
Check if file exists
Query or enumerate registry value
Read file on windows

Disassembly:
push 0x6d8
mov eax, 0x5bf357
call fcn.00598fca
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
or dword [ebp - 0x6cc], 0xffffffff
mov dword [ebp - 0x6a4], edi
mov edi, dword [ebp + 0x20]
mov dword [ebp - 0x6dc], edi
xor edi, edi
mov dword [ebp - 0x6bc], esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 0x6b4], edx
mov dword [ebp - 0x69c], ecx
mov dword [ebp - 0x68c], esi
mov dword [ebp - 0x6a0], edi
cmp dword [ebp + 8], edi
je 0x44a375
cmp eax, edi
je 0x44a375
cmp word [eax], di
je 0x44a375
cmp edx, edi
je 0x44a375
cmp word [edx], di
je 0x44a375
cmp ecx, edi
je 0x44a375
cmp word [ecx], di
je 0x44a375
push dword [ebp - 0x6bc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44a375
xor eax, eax
push 0x206
mov word [ebp - 0x3a0], ax
lea eax, [ebp - 0x39e]
push edi
push eax
call fcn.00596530
add esp, 0xc
lea ebx, [ebp - 0x3a0]
call fcn.0042dfcf
mov ecx, dword [ebp - 0x6bc]
mov eax, ebx
call fcn.00519d68
xor ebx, ebx
test eax, eax
je 0x44a345
cmp dword [ebp + 0x14], ebx
je 0x4499e6
mov ecx, dword [ebp - 0x6bc]
call fcn.0047611f
push 0x7e
pop edi
xor eax, eax
push edi
mov word [ebp - 0x98], ax
lea eax, [ebp - 0x96]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea edx, [ebp - 0x98]
lea ecx, [ebp - 0x3a0]
call fcn.0046fe2f
test eax, eax
je 0x44a345
lea eax, [ebp - 0x98]
call fcn.0047ef19
cmp esi, ebx
je 0x449a5b
lea eax, [ebp - 0x98]
push eax
push esi
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x449a5b
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0x6dc]
mov dword [ebp - 0x6cc], ebx
call fcn.00407af8
jmp 0x44a345
mov eax, dword [0x63696c]
mov esi, 0x63696c
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6c8], eax
lea eax, [ebp - 0x6c8]
push eax
mov dword [ebp - 4], ebx
push ebx
push dword [ebp - 0x6b4]
call fcn.00426c3c
mov eax, dword [ebp - 0x6c8]
add esp, 0xc
cmp dword [eax - 0xc], ebx
jne 0x449aa4
add eax, 0xfffffff0
call fcn.00407b6b
jmp 0x44a345
xor eax, eax
push edi
mov word [ebp - 0x198], ax
lea eax, [ebp - 0x196]
push ebx
push eax
call fcn.00596530
lea eax, [ebp - 0x198]
add esp, 0xc
push eax
call fcn.00428b69
pop ecx
xor eax, eax
push edi
mov word [ebp - 0x118], ax
lea eax, [ebp - 0x116]
push ebx
push eax
call fcn.00596530
add esp, 0xc
lea eax, [ebp - 0x6e0]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x6e4]
push eax
push 0x5df64c
push str.Softwarehao123JuziBrowser
push 0x80000001
mov dword [ebp - 0x6e4], 1
mov dword [ebp - 0x6e0], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x690], eax
mov byte [ebp - 4], 1
xor eax, eax
mov dword [ebp - 0x5b8], ebx
lea edi, [ebp - 0x5b4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x5b8]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x449bc4
push 0x62
mov word [ebp - 0x660], ax
lea eax, [ebp - 0x65e]
push ebx
push eax
call fcn.00596530
add esp, 0xc
push 0x32
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x5b8]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x660]
push eax
lea eax, [ebp - 0x690]
push eax
call fcn.00407af8
push 0x2d
lea eax, [ebp - 0x690]
push eax
call fcn.0042e721
push 0x7b
lea eax, [ebp - 0x690]
push eax
call fcn.0042e721
push 0x7d
lea eax, [ebp - 0x690]
push eax
call fcn.0042e721
mov eax, dword [ebp - 0x690]
cmp dword [eax - 0xc], ebx
jne 0x449be0
push str.435ED5DD32F940f8A106535E6F2C14BE
lea eax, [ebp - 0x690]
push eax
call fcn.00407af8
lea eax, [ebp - 0x690]
call fcn.004187e2
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6b4], eax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x6a4]
cmp eax, ebx
je 0x449c22
cmp word [eax], bx
je 0x449c22
lea ecx, [ebp - 0x6b4]
push ecx
push ebx
push eax
call fcn.00426c3c
add esp, 0xc
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6b8], eax
lea eax, [ebp - 0x118]
push eax
mov byte [ebp - 4], 3
push dword [0x6cab30]
lea eax, [ebp - 0x6b8]
push str.___________________________7d_08x_04x
call fcn.0040c5ed
mov eax, dword [0x63696c]
add esp, 0xc
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6a4], eax
mov byte [ebp - 4], 4
push dword [ebp - 0x6b8]
lea ebx, [ebp - 0x6a8]
call fcn.0047f402
pop ecx
mov byte [ebp - 4], 5
push dword [eax]
lea eax, [ebp - 0x6a4]
push str.multipart_form_data__boundary_s
call fcn.00404f66
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x6a8]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6a8], eax
mov byte [ebp - 4], 6
push dword [ebp - 0x6b8]
lea eax, [ebp - 0x6a8]
push str.___s
call fcn.0040c5ed
mov eax, dword [0x63696c]
pop ecx
pop ecx
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6d4], eax
mov byte [ebp - 4], 7
push dword [ebp - 0x6b8]
lea eax, [ebp - 0x6d4]
push str.___s__
call fcn.0040c5ed
mov eax, dword [0x63696c]
pop ecx
pop ecx
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6d0], eax
mov byte [ebp - 4], 8
push dword [ebp - 0x69c]
lea eax, [ebp - 0x69c]
push eax
call fcn.0047f351
mov byte [ebp - 4], 9
push dword [eax]
mov edi, dword [ebp - 0x6a8]
push edi
push str._s_r_nContent_Disposition:_form_data__name_BDUSS__r_n_r_n_s
lea eax, [ebp - 0x6d0]
call fcn.0040c5ed
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x69c]
add esp, 0x14
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x69c], eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x6ac]
push eax
mov byte [ebp - 4], 0xa
call fcn.0047f351
mov byte [ebp - 4], 0xb
push dword [eax]
lea eax, [ebp - 0x69c]
push edi
push str._s_r_nContent_Disposition:_form_data__name_filemd5__r_n_r_n_s
call fcn.0040c5ed
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x6ac]
add esp, 0x14
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6ac], eax
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x68c], 0
je 0x449e01
push dword [ebp - 0x68c]
lea eax, [ebp - 0x68c]
push eax
call fcn.0047f351
pop ecx
pop ecx
mov byte [ebp - 4], 0xd
mov eax, dword [eax]
mov dword [ebp - 0x6a0], 1
jmp 0x449e06
mov eax, 0x5ddd69
push eax
push edi
push str._s_r_nContent_Disposition:_form_data__name_lastservermd5__r_n_r_n_s
lea eax, [ebp - 0x6ac]
call fcn.0040c5ed
add esp, 0xc
mov dword [ebp - 4], 0xc
test byte [ebp - 0x6a0], 1
je 0x449e39
mov eax, dword [ebp - 0x68c]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6a0], eax
push edi
push str._s_r_nContent_Disposition:_form_data__name_data___filename_file.dat__r_nContent_Type:_application_octet_stream_r_n_r_n
lea eax, [ebp - 0x6a0]
mov byte [ebp - 4], 0xe
call fcn.0040c5ed
mov eax, dword [0x63696c]
pop ecx
pop ecx
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6c0], eax
mov byte [ebp - 4], 0xf
push dword [ebp - 0x6a0]
lea eax, [ebp - 0x6c0]
push dword [ebp - 0x6ac]
push dword [ebp - 0x69c]
push dword [ebp - 0x6d0]
push str._s_r_n_s_r_n_s_r_n_s
call fcn.0040c5ed
mov eax, dword [0x63696c]
add esp, 0x14
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x6c4], eax
mov byte [ebp - 4], 0x10
push dword [ebp - 0x6d4]
lea eax, [ebp - 0x6c4]
push str._r_n_s_r_n
call fcn.0040c5ed
mov eax, dword [ebp - 0x6c0]
mov ebx, dword [eax - 0xc]
mov eax, dword [ebp - 0x6c4]
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x68c], eax
push 0x5dec58
lea eax, [ebp - 0x3a0]
push eax
xor edi, edi
and dword [ebp - 0x6b0], edi
lea eax, [ebp - 0x6b0]
push eax
mov dword [ebp - 0x694], edi
mov dword [ebp - 0x698], edi
call fcn.0059308d
add esp, 0x14
test eax, eax
jne 0x449fe7
push 2
push eax
push dword [ebp - 0x6b0]
call fcn.0059316a
add esp, 0xc
push dword [ebp - 0x6b0]
call fcn.0059338c
pop ecx
push 0
push 0
push dword [ebp - 0x6b0]
mov edi, eax
call fcn.0059316a
mov eax, dword [ebp - 0x68c]
add eax, edi
add eax, ebx
mov dword [ebp - 0x698], eax
add eax, 2
add esp, 0xc
push eax
call fcn.0058e040
pop ecx
mov dword [ebp - 0x694], eax
test eax, eax
je 0x449fdb
mov eax, dword [ebp - 0x698]
add eax, 2
push eax
push 0
push dword [ebp - 0x694]
call fcn.00596530
add esp, 0xc
push ebx
push dword [ebp - 0x6c0]
push dword [ebp - 0x694]
call fcn.005965b0
mov eax, dword [ebp - 0x694]
add esp, 0xc
push dword [ebp - 0x6b0]
add eax, ebx
push edi
push 1
push eax
call fcn.0059369a
push dword [ebp - 0x68c]
mov eax, dword [ebp - 0x694]
push dword [ebp - 0x6c4]
add eax, edi
add eax, ebx
push eax
call fcn.005965b0
add esp, 0x1c
push dword [ebp - 0x6b0]
call fcn.00593912
pop ecx
lea ecx, [ebp - 0x3a0]
call fcn.0047611f
cmp dword [ebp - 0x694], 0
je 0x44a28d
mov eax, dword [0x63696c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x68c], eax
xor eax, eax
mov byte [ebp - 4], 0x11
cmp ax, word [0x63f288]
jne 0x44a028
call fcn.00404168
jmp 0x44a02d
mov eax, 0x63f288
push dword [ebp - 0x690]
lea ecx, [ebp - 0x198]
push dword [ebp - 0x6c8]
push dword [ebp - 0x6b4]
push edi
push dword [ebp - 0x6d8]
push dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x118]
push ecx
push eax
push str.http:__www.hao123.com_juzi_netfavorites_upload_appver_smid_scid_stype_dresfrom_sfilesize_dparam_suname_svk_s
lea eax, [ebp - 0x68c]
call fcn.00404f66
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x5a8], ax
lea eax, [ebp - 0x5a6]
push eax
call fcn.00596530
add esp, 0x34
push 0x62f48
call fcn.0058f82d
pop ecx
mov dword [ebp - 0x6d8], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x44a0a9
push eax
call fcn.004702c4
mov esi, eax
jmp 0x44a0ab
xor esi, esi
mov byte [ebp - 4], 0x11
test esi, esi
je 0x44a12e
push dword [ebp - 0x68c]
mov eax, esi
call fcn.0040a682
push dword [ebp - 0x6a4]
mov ecx, dword [ebp - 0x694]
push dword [ebp - 0x698]
mov eax, esi
call fcn.0040a6e4
lea ebx, [ebp - 0x5a8]
mov dword [esi + 0x2468], 1
mov dword [esi + 0x26b0], 0x493e0
call fcn.0042dfcf
mov eax, ebx
push eax
mov eax, esi
call fcn.0040a6b3
call fcn.00470776
test eax, eax
je 0x44a114
push 0xa
mov eax, esi
call fcn.00470b1b
cmp dword [esi + 0x5d120], 7
je 0x44a126
xor eax, eax
mov word [ebp - 0x5a8], ax
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
lea eax, [ebp - 0x688]
push eax
mov byte [ebp - 4], 0x13
call fcn.00548b11
lea eax, [ebp - 0x5f8]
push eax
xor ebx, ebx
mov byte [ebp - 4], 0x14
call fcn.0054af1d
lea edx, [ebp - 0x5a8]
lea ecx, [ebp - 0x5c4]
mov byte [ebp - 4], 0x15
call fcn.00426b05
lea ecx, [ebp - 0x5f8]
push ecx
push eax
lea ebx, [ebp - 0x688]
mov byte [ebp - 4], 0x16
call fcn.00548b5a
push 0
push 1
lea ecx, [ebp - 0x5c4]
mov bl, al
mov byte [ebp - 4], 0x15
call fcn.00407567
test bl, bl
je 0x44a22c
cmp byte [ebp - 0x5f0], 0
je 0x44a22c
lea eax, [ebp - 0x5f8]
call fcn.0054bd37
test al, al
je 0x44a22c
mov edx, 0x5e8fdc
lea ecx, [ebp - 0x5f8]
call fcn.0054b949
cmp byte [eax + 8], 4
jne 0x44a22c
mov eax, dword [eax]
test eax, eax
je 0x44a22c
push eax
lea eax, [ebp - 0x698]
push eax
call fcn.0047f54f
pop ecx
pop ecx
mov byte [ebp - 4], 0x17
push dword [ebp - 0x690]
push dword [ebp - 0x698]
call fcn.0058f69a
pop ecx
pop ecx
test eax, eax
jne 0x44a21e
mov edx, str.errno
lea ecx, [ebp - 0x5f8]
call fcn.0054b949
cmp byte [eax + 8], 1
jne 0x44a21e
mov ecx, eax
call fcn.0054b340
mov dword [ebp - 0x6cc], eax
mov eax, dword [ebp - 0x698]
add eax, 0xfffffff0
call fcn.00407b6b
lea ecx, [ebp - 0x5f8]
mov byte [ebp - 4], 0x14
call fcn.0054b1a0
lea eax, [ebp - 0x688]
call fcn.0040b0d5
mov dword [ebp - 4], 0x11
cmp dword [ebp - 0x6cc], 0
jne 0x44a268
lea eax, [ebp - 0x98]
push eax
push dword [ebp - 0x6dc]
call fcn.00407af8
push dword [ebp - 0x694]
call fcn.0058f807
pop ecx
lea ecx, [ebp - 0x5a8]
call fcn.0047611f
mov eax, dword [ebp - 0x68c]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x6c4]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x6c0]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x6a0]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x6ac]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x69c]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x6d0]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x6d4]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x6a8]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x6a4]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x6b8]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x6b4]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x690]
add eax, 0xfffffff0
call fcn.00407b6b
mov eax, dword [ebp - 0x6c8]
add eax, 0xfffffff0
call fcn.00407b6b
xor ebx, ebx
cmp dword [ebp + 0x14], ebx
je 0x44a355
mov ecx, dword [ebp - 0x6bc]
call fcn.0047611f
lea ecx, [ebp - 0x3a0]
call fcn.0047611f
mov eax, dword [ebp - 0x6cc]
jmp 0x44a388
cmp dword [ebp + 0x14], edi
je 0x44a385
mov ecx, dword [ebp - 0x6bc]
call fcn.0047611f
or eax, 0xffffffff
call fcn.00599026
ret 0x1c