Function at 0x436130
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45c889
mov eax, dword fs:[0]
push eax
sub esp, 0x828
mov eax, dword [0x478584]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x818], ebx
mov eax, dword [0x47839c]
mov edx, dword [eax + 0xc]
mov ecx, 0x47839c
mov dword [ebp - 0x834], esi
call edx
add eax, 0x10
mov dword [ebp - 0x814], eax
mov dword [ebp - 4], 2
mov eax, dword [edi]
push 0x2e
push eax
call fcn.0043db8c
add esp, 8
cmp eax, ebx
je 0x4361de
lea edx, [eax + 2]
cmp edx, ebx
jne 0x4361ba
xor eax, eax
push eax
push edx
lea ecx, [ebp - 0x814]
call fcn.004019a0
jmp 0x4361ea
mov eax, edx
lea edi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4361c0
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [ebp - 0x814]
call fcn.004019a0
jmp 0x4361ea
push edi
lea ecx, [ebp - 0x814]
call fcn.00401f40
mov edx, dword [ebp - 0x814]
mov edi, dword [edx - 0xc]
cmp edi, ebx
jge 0x436201
push 0x80070057
call fcn.00401000
mov eax, dword [edx - 8]
mov ecx, 1
sub ecx, dword [edx - 4]
sub eax, edi
or eax, ecx
jge 0x436224
push edi
lea ecx, [ebp - 0x814]
call fcn.00401390
mov edx, dword [ebp - 0x814]
lea eax, [edi + 1]
push eax
push edx
call fcn.004409d0
mov eax, dword [ebp - 0x814]
add esp, 8
cmp edi, dword [eax - 8]
jg 0x4361f7
mov dword [eax - 0xc], edi
mov edx, dword [ebp - 0x814]
xor ecx, ecx
mov word [edx + edi*2], cx
mov eax, dword [ebp - 0x814]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0x462608
push eax
call edi
test eax, eax
jne 0x4362bc
push str.image_png
mov ecx, esi
call fcn.00404fd0
mov dword [ebp - 0x818], 1
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x814]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x43629e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043dfbe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x814]
push 0x4625ec
push ecx
call edi
test eax, eax
je 0x43664e
mov edx, dword [ebp - 0x814]
push str.jpeg
push edx
call edi
test eax, eax
je 0x43664e
mov eax, dword [ebp - 0x814]
push 0x4625d8
push eax
call edi
test eax, eax
jne 0x436323
push str.image_gif
mov ecx, esi
call fcn.00404fd0
mov dword [ebp - 0x818], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x814]
call fcn.004014c0
jmp 0x43629e
mov ecx, dword [ebp - 0x814]
push str.tiff
push ecx
call edi
test eax, eax
jne 0x43635e
push str.image_tiff
mov ecx, esi
call fcn.00404fd0
mov dword [ebp - 0x818], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x814]
call fcn.004014c0
jmp 0x43629e
mov edx, dword [ebp - 0x814]
push 0x462598
push edx
call edi
test eax, eax
jne 0x436399
push str.image_bmp
mov ecx, esi
call fcn.00404fd0
mov dword [ebp - 0x818], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x814]
call fcn.004014c0
jmp 0x43629e
mov eax, dword [ebp - 0x814]
push 0x46257c
push eax
call edi
test eax, eax
je 0x436625
mov ecx, dword [ebp - 0x814]
push str.html
push ecx
call edi
test eax, eax
je 0x436625
mov edx, dword [ebp - 0x814]
push 0x462568
push edx
call edi
test eax, eax
jne 0x436400
push str.text_css
mov ecx, esi
call fcn.00404fd0
mov dword [ebp - 0x818], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x814]
call fcn.004014c0
jmp 0x43629e
mov eax, dword [ebp - 0x814]
push 0x46254c
push eax
call edi
test eax, eax
jne 0x43643b
push str.text_javascript
mov ecx, esi
call fcn.00404fd0
mov dword [ebp - 0x818], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x814]
call fcn.004014c0
jmp 0x43629e
mov ecx, dword [ebp - 0x814]
push 0x462524
push ecx
call edi
test eax, eax
jne 0x436476
push str.application_x_shockwave_flash
mov ecx, esi
call fcn.00404fd0
mov dword [ebp - 0x818], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x814]
call fcn.004014c0
jmp 0x43629e
mov edx, dword [ebp - 0x814]
push 0x46251c
push edx
call edi
test eax, eax
jne 0x4364b1
push str.text_xml
mov ecx, esi
call fcn.00404fd0
mov dword [ebp - 0x818], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x814]
call fcn.004014c0
jmp 0x43629e
lea ecx, [ebp - 0x820]
call fcn.00401460
mov byte [ebp - 4], 5
lea eax, [ebp - 0x824]
push eax
push 0x20019
push ebx
push str.MIMEDatabaseContent_Type_
push SysReAllocStringLen
mov dword [ebp - 0x824], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4365d2
mov byte [ebp - 0x819], bl
xor edi, edi
mov eax, dword [ebp - 0x824]
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x82c]
push ecx
lea edx, [ebp - 0x410]
push edx
push edi
push eax
mov dword [ebp - 0x82c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x4365c5
mov eax, dword [ebp - 0x824]
lea ecx, [ebp - 0x828]
push ecx
push 0x20019
push ebx
lea edx, [ebp - 0x410]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4365b8
mov eax, dword [ebp - 0x828]
lea ecx, [ebp - 0x830]
push ecx
lea edx, [ebp - 0x810]
push edx
push ebx
push ebx
push str.Extension
push eax
mov dword [ebp - 0x830], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4365ab
mov edx, dword [ebp - 0x814]
lea ecx, [ebp - 0x80e]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4365ab
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x820]
call fcn.00402400
mov byte [ebp - 0x819], 1
mov ecx, dword [ebp - 0x828]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
cmp byte [ebp - 0x819], bl
je 0x4364f3
mov edx, dword [ebp - 0x824]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x820]
cmp dword [eax - 0xc], ebx
jne 0x436615
push str.application_unknown
mov ecx, esi
call fcn.00404fd0
mov dword [ebp - 0x818], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x820]
call fcn.004014c0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x814]
call fcn.004014c0
jmp 0x43629e
lea ecx, [ebp - 0x820]
push ecx
mov ecx, esi
call fcn.00401880
jmp 0x4365e9
push str.text_html
mov ecx, esi
call fcn.00404fd0
mov dword [ebp - 0x818], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x814]
call fcn.004014c0
jmp 0x43629e
push str.image_jpeg
mov ecx, esi
call fcn.00404fd0
mov dword [ebp - 0x818], 1
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x814]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x436292