Function at 0x418b6d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x79c]
sub esp, 0x81c
mov eax, dword [0x4c2660]
xor eax, ebp
mov dword [ebp + 0x798], eax
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
cmp dword [0x4c8604], 2
mov dword [ebp - 0x78], 0x808
mov esi, 0x20019
jl 0x418d37
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x418bbe
xor eax, eax
jmp 0x418e10
lea eax, [ebp - 0x74]
push eax
push esi
push ebx
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
jne 0x418cd3
lea eax, [ebp - 0x74]
push eax
push esi
push ebx
push str.http_shellopencommand
mov edi, SysReAllocString
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x418c41
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x418c41
mov eax, dword [ebp - 0x78]
lea eax, [ebp + eax - 0x70]
cmp byte [eax - 1], bl
je 0x418c1c
mov byte [eax], bl
lea eax, [ebp - 0x70]
push str.chrome.exe
push eax
call fcn.00468470
pop ecx
pop ecx
test eax, eax
je 0x418c41
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
pop eax
jmp 0x418e10
lea eax, [ebp - 0x74]
push eax
push esi
push ebx
push str.http_shellopenddeexecApplication
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x418cbc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x418cc3
mov eax, dword [ebp - 0x78]
lea eax, [ebp + eax - 0x70]
cmp byte [eax - 1], bl
je 0x418c7d
mov byte [eax], bl
lea eax, [ebp - 0x70]
push str.IExplore
push eax
call fcn.00469630
pop ecx
pop ecx
test eax, eax
jne 0x418c96
xor edi, edi
inc edi
jmp 0x418cb1
lea eax, [ebp - 0x70]
push str.Firefox
push eax
call fcn.00469630
mov edi, eax
neg edi
sbb edi, edi
neg edi
add edi, 2
pop ecx
pop ecx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x418cc5
push 2
pop edi
cmp eax, edi
je 0x418cc5
mov edi, ebx
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x418e0e
cmp eax, ebx
jne 0x418cc5
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push str.Progid
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x418cc5
mov eax, dword [ebp - 0x78]
lea eax, [ebp + eax - 0x70]
cmp byte [eax - 1], bl
je 0x418d01
mov byte [eax], bl
lea eax, [ebp - 0x70]
push str.FirefoxURL
push eax
call fcn.00469630
pop ecx
pop ecx
test eax, eax
jne 0x418d1a
push 2
pop edi
jmp 0x418cb1
lea eax, [ebp - 0x70]
push str.IE.HTTP
push eax
call fcn.00469630
mov edi, eax
neg edi
sbb edi, edi
and edi, 2
inc edi
jmp 0x418caf
lea eax, [ebp - 0x74]
push eax
push esi
push ebx
push str.http_shellopencommand
mov edi, SysReAllocString
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x418d90
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x418d90
mov eax, dword [ebp - 0x78]
lea eax, [ebp + eax - 0x70]
cmp byte [eax - 1], bl
je 0x418d78
mov byte [eax], bl
lea eax, [ebp - 0x70]
push str.chrome.exe
push eax
call fcn.00468470
pop ecx
pop ecx
test eax, eax
jne 0x418c30
lea eax, [ebp - 0x74]
push eax
push esi
push ebx
push str.http_shellopenddeexecApplication
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x418e0c
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x418e02
mov eax, dword [ebp - 0x78]
lea eax, [ebp + eax - 0x70]
cmp byte [eax - 1], bl
je 0x418dcc
mov byte [eax], bl
lea eax, [ebp - 0x70]
push str.IExplore
push eax
call fcn.00469630
pop ecx
pop ecx
test eax, eax
jne 0x418de5
xor edi, edi
inc edi
jmp 0x418e04
lea eax, [ebp - 0x70]
push str.Firefox
push eax
call fcn.00469630
mov edi, eax
neg edi
sbb edi, edi
pop ecx
neg edi
pop ecx
add edi, 2
jmp 0x418e04
mov edi, ebx
push dword [ebp - 0x74]
jmp 0x418cc8
mov edi, ebx
mov eax, edi
mov ecx, dword [ebp + 0x798]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00465f42
add ebp, 0x79c
leave
ret