Function at 0x40e8e0
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5f104d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4d4
push ebx
mov ebx, dword [esp + 0x4e8]
push esi
push edi
xor edi, edi
mov dword [esp + 0x18], edi
mov dword [ebx], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], edi
mov word [esp + 0x24], di
mov esi, dword [0x6cce08]
mov dword [esp + 0x4e8], edi
cmp esi, edi
jne 0x40e930
mov esi, 0x6cce0c
mov eax, 0x69e048
push ebp
test eax, eax
je 0x40ea67
cmp esi, edi
je 0x40ea67
mov ecx, str.IDMGCExt.crx
test ecx, ecx
je 0x40ea67
push eax
lea ecx, [esp + 0x40]
call fcn.00401ec0
push esi
lea ecx, [esp + 0x34]
mov byte [esp + 0x4f0], 1
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], edi
mov word [esp + 0x38], di
call fcn.00401f50
push str.IDMGCExt.crx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x4f0], 2
call fcn.0040d700
lea ecx, [esp + 0x24]
mov byte [esp + 0x4ec], 3
call fcn.00401070
mov esi, dword [esp + 0x44]
lea ecx, [esp + 0x48]
call fcn.00401f40
push eax
call fcn.005c2c42
add esp, 4
lea ecx, [esp + 0x30]
mov edi, eax
call fcn.00401f40
push eax
call fcn.005c2c42
add esi, edi
lea esi, [eax + esi + 3]
lea ebp, [esi + esi]
push ebp
call fcn.005db66d
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x24], edi
je 0x40ea32
mov ecx, ebp
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [esp + 0x48]
call fcn.00401f40
push eax
lea ecx, [esp + 0x34]
call fcn.00401f40
push eax
lea ecx, [esp + 0x44]
call fcn.00401f40
push eax
mov eax, dword [esp + 0x30]
push esi
push eax
call fcn.005c2bd2
mov ecx, dword [esp + 0x38]
push ecx
call fcn.005c2c42
add esp, 0x18
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x4ec], 2
call fcn.00401070
lea ecx, [esp + 0x30]
mov byte [esp + 0x4ec], 1
call fcn.00401070
lea ecx, [esp + 0x3c]
mov byte [esp + 0x4ec], 0
call fcn.00401070
xor edi, edi
mov edx, dword [0x6c826c]
mov dword [esp + 0x20], edx
push str.jeaohhlajejodfjadcponpnjgkiikocn
lea eax, [esp + 0x24]
push str.SOFTWAREGoogleChromeExtensions_s
push eax
mov byte [esp + 0x4f8], 4
call fcn.005d809b
mov edx, dword [esp + 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push edi
push edx
push reloc.WS2_32.dll_bind
call esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, 0x410
test eax, eax
jne 0x40ec1e
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
lea ecx, [esp + 0xd4]
push eax
push ecx
push 0
push 0
push 0x69ef8c
push edx
mov dword [ebx], 1
mov dword [esp + 0x30], ebp
call edi
test eax, eax
jne 0x40ec09
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x40eafb
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0xd8]
push eax
call fcn.005c531c
add esp, 8
test eax, eax
jne 0x40ec09
lea ecx, [esp + 0x18]
lea edx, [esp + 0x54]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push 0x69ef84
push eax
mov dword [esp + 0x30], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ec09
mov esi, dword [0x6ccc8c]
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40eb72
test cl, cl
je 0x40eb6e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40eb72
add eax, 2
add esi, 2
test cl, cl
jne 0x40eb4a
xor eax, eax
jmp 0x40eb77
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40eb88
mov dword [esp + 0x1c], 1
jmp 0x40ec09
mov eax, dword [0x6c826c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
mov byte [esp + 0x4ec], 5
test eax, eax
jne 0x40eba5
lea eax, [esp + 0x28]
lea ecx, [esp + 0x14]
push ecx
push eax
call fcn.0040e770
add esp, 8
test eax, eax
je 0x40ebf8
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40ebe7
test cl, cl
je 0x40ebe3
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40ebe7
add eax, 2
add esi, 2
test cl, cl
jne 0x40ebbf
xor eax, eax
jmp 0x40ebec
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ebf8
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x14]
mov byte [esp + 0x4ec], 4
call fcn.005df266
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x40ec24
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004408a0
test eax, eax
je 0x40ed9e
mov edx, dword [esp + 0x20]
lea ecx, [esp + 0x10]
push ecx
push 0x20119
push 0
push edx
push reloc.WS2_32.dll_bind
mov dword [esp + 0x30], 0
call esi
test eax, eax
jne 0x40ed9e
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xd4]
push eax
push ecx
push 0
push 0
push 0x69ef8c
push edx
mov dword [esp + 0x2c], ebp
call edi
test eax, eax
jne 0x40ed91
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x40ec8e
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0xd8]
push eax
call fcn.005c531c
add esp, 8
test eax, eax
jne 0x40ed91
lea ecx, [esp + 0x14]
lea edx, [esp + 0x54]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push 0x69ef84
push eax
mov dword [esp + 0x2c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ed91
mov esi, dword [0x6ccc8c]
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40ed01
test cl, cl
je 0x40ecfd
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40ed01
add eax, 2
add esi, 2
test cl, cl
jne 0x40ecdd
xor eax, eax
jmp 0x40ed06
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ed14
mov dword [esp + 0x1c], 1
jmp 0x40ed91
mov eax, dword [0x6c826c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov byte [esp + 0x4ec], 6
test eax, eax
jne 0x40ed31
lea eax, [esp + 0x28]
lea ecx, [esp + 0x18]
push ecx
push eax
call fcn.0040e770
add esp, 8
test eax, eax
je 0x40ed80
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40ed6f
test cl, cl
je 0x40ed6b
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40ed6f
add eax, 2
add esi, 2
test cl, cl
jne 0x40ed4b
xor eax, eax
jmp 0x40ed74
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40ed80
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x4ec], 4
call fcn.005df266
mov eax, dword [esp + 0x10]
push eax
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.jmolcgpienlcieaajfkkdamlngancncm
lea ecx, [esp + 0x24]
push str.SOFTWAREGoogleChromeExtensions_s
push ecx
call fcn.005d809b
mov eax, dword [esp + 0x2c]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push eax
push reloc.WS2_32.dll_bind
call esi
test eax, eax
pop ebp
jne 0x40ee0c
mov ecx, dword [esp + 0xc]
push ecx
call ebx
lea edx, [esp + 0xc]
push edx
push 0xf003f
push 0
push str.SOFTWAREGoogleChromeExtensions
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x40ee0c
mov eax, dword [esp + 0xc]
push str.jmolcgpienlcieaajfkkdamlngancncm
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov ecx, dword [esp + 0xc]
push ecx
call ebx
push 0
push 0
push 0
push 0
push 0
push 0x40d730
call fcn.005df864
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4e8], 0
call fcn.005df266
lea ecx, [esp + 0x20]
mov dword [esp + 0x4e8], 0xffffffff
call fcn.00401070
mov ecx, dword [esp + 0x4e0]
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x4e0
ret 4