Function at 0x4139b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x643e0b
mov eax, dword fs:[0]
push eax
sub esp, 0x42c
mov eax, dword [0x758898]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x758898]
xor eax, esp
push eax
lea eax, [esp + 0x440]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], ebx
mov word [esp + 0x24], ax
mov dword [esp + 0x448], ebx
mov esi, dword [esp + 0x450]
mov ecx, str.IDMMsgHost.json
cmp esi, ebx
jne 0x413a1c
mov ecx, str.IDMMsgHostMoz.json
mov eax, dword [0x75dc58]
cmp eax, ebx
jne 0x413a2a
mov eax, 0x75dc5c
push ebx
push ecx
push eax
push 0x678de0
lea ecx, [esp + 0x30]
call fcn.00402310
mov ebp, dword [esp + 0x458]
cmp esi, ebx
je 0x413a59
xor eax, eax
cmp ebp, ebx
setne al
mov ecx, str.SOFTWAREGoogleChromeNativeMessagingHostscom.tonec.idm
add eax, 0x80000001
jmp 0x413a63
mov ecx, str.SOFTWAREMozillaNativeMessagingHostscom.tonec.idm
mov eax, 0x80000001
mov esi, dword [esp + 0x454]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x14]
push edx
mov edx, esi
neg edx
sbb edx, edx
and edx, 0x100
add edx, 0x20019
push edx
push ebx
push ecx
push eax
call edi
test eax, eax
jne 0x413af4
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebx
push ebx
push 0x679c78
push edx
mov dword [esp + 0x34], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x413adf
mov eax, dword [esp + 0x20]
cmp eax, ebx
jne 0x413ac5
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0062609a
add esp, 8
test eax, eax
jne 0x413adf
mov dword [esp + 0x18], 1
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x18], ebx
jne 0x413c91
cmp dword [esp + 0x450], ebx
je 0x413b10
xor eax, eax
cmp ebp, ebx
setne al
mov ecx, str.SOFTWAREGoogleChromeNativeMessagingHosts
add eax, 0x80000001
jmp 0x413b1a
mov ecx, str.SOFTWAREMozillaNativeMessagingHosts
mov eax, 0x80000001
neg esi
sbb esi, esi
lea edx, [esp + 0x14]
push edx
and esi, 0x100
add esi, 0xf003f
push esi
push ebx
push ecx
push eax
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x413c0f
cmp dword [esp + 0x450], 0
lea eax, [esp + 0x14]
jne 0x413ba0
push eax
push esi
push 0
push str.SOFTWAREMozilla
push 0x80000001
call edi
test eax, eax
jne 0x413c91
mov ecx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebp
mov eax, str.SOFTWAREMozillaNativeMessagingHosts
mov edi, 0x80000001
push 0
lea ecx, [esp + 0x18]
push ecx
push 0
push esi
push 0
push 0x67997c
push 0
push eax
push edi
call ebx
test eax, eax
je 0x413c15
jmp 0x413c91
push 0
push eax
xor edx, edx
push 0
push esi
test ebp, ebp
setne dl
push 0
push 0x67997c
push 0
push str.SoftwareGoogle
add edx, 0x80000001
mov edi, edx
push edi
call ebx
test eax, eax
jne 0x413c91
mov ecx, dword [esp + 0x14]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
call ebp
push 0
lea edx, [esp + 0x18]
push edx
push 0
push esi
push 0
push 0x67997c
push 0
push str.SoftwareGoogleChrome
push edi
call ebx
test eax, eax
jne 0x413c91
mov eax, dword [esp + 0x14]
push eax
call ebp
mov eax, str.SOFTWAREGoogleChromeNativeMessagingHosts
jmp 0x413b80
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
push 0
lea edx, [esp + 0x1c]
push edx
push 0
push esi
push 0
push 0x67997c
push 0
push str.com.tonec.idm
push eax
call ebx
test eax, eax
je 0x413c3f
mov ecx, dword [esp + 0x14]
push ecx
jmp 0x413c8f
mov edx, dword [esp + 0x20]
mov eax, edx
test edx, edx
jne 0x413c4d
lea eax, [esp + 0x24]
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413c50
sub eax, esi
sar eax, 1
mov ecx, edx
test edx, edx
jne 0x413c69
lea ecx, [esp + 0x24]
lea edx, [eax + eax + 2]
mov eax, dword [esp + 0x18]
push edx
push ecx
push 1
push 0
push 0x679c78
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp + 0x18]
push ecx
call ebp
mov edx, dword [esp + 0x14]
push edx
call ebp
mov dword [esp + 0x448], 0xffffffff
lea ecx, [esp + 0x20]
call fcn.00401210
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.00620b8d
add esp, 0x438
ret