Function at 0x40bcf0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494e77
mov eax, dword fs:[0]
push eax
sub esp, 0xd14
mov eax, dword [0x639440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xce0], 0
lea eax, [ebp - 0xce0]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
cmp dword [ebp - 0xce0], 0
jne 0x40bd52
mov al, 1
jmp 0x40c0b4
mov dword [ebp - 0xce4], 0
mov eax, 1
test eax, eax
je 0x40c0a5
mov dword [ebp - 0xcf4], 0x200
mov ecx, dword [ebp - 0xce4]
mov dword [ebp - 0xcf8], ecx
mov edx, dword [ebp - 0xce4]
add edx, 1
mov dword [ebp - 0xce4], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xcf4]
push eax
lea ecx, [ebp - 0xc10]
push ecx
mov edx, dword [ebp - 0xcf8]
push edx
mov eax, dword [ebp - 0xce0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0xcfc], eax
cmp dword [ebp - 0xcfc], 0x103
jne 0x40bdcf
jmp 0x40c0a5
lea ecx, [ebp - 0xc10]
push ecx
lea ecx, [ebp - 0xc40]
call fcn.00405570
mov dword [ebp - 4], 0
lea edx, [ebp - 0xc10]
push edx
lea eax, [ebp - 0x410]
push eax
call fcn.004717b1
add esp, 8
push str._shellopencommand
lea ecx, [ebp - 0x410]
push ecx
call fcn.00471740
add esp, 8
mov dword [ebp - 0xcdc], 0
lea edx, [ebp - 0xcdc]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [ebp - 0xce0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
cmp dword [ebp - 0xcdc], 0
jne 0x40be60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.00406e90
nop
jmp 0x40bd5c
mov dword [ebp - 0xcec], 1
mov dword [ebp - 0xce8], 0x200
lea edx, [ebp - 0xce8]
push edx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xcec]
push ecx
push 0
push 0x4976f0
mov edx, dword [ebp - 0xcdc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0xcdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [ebp - 0xce8], 0
je 0x40becd
cmp dword [ebp - 0xcf0], 0
jne 0x40becd
lea ecx, [ebp - 0x810]
test ecx, ecx
jne 0x40bee5
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.00406e90
nop
jmp 0x40bd5c
lea edx, [ebp - 0x810]
push edx
lea ecx, [ebp - 0xc58]
call fcn.00405570
mov byte [ebp - 4], 1
lea eax, [ebp - 0xc10]
push eax
lea ecx, [ebp - 0x410]
push ecx
call fcn.004717b1
add esp, 8
push str.CapabilitiesURLAssociations
lea edx, [ebp - 0x410]
push edx
call fcn.00471740
add esp, 8
mov dword [ebp - 0xcdc], 0
lea eax, [ebp - 0xcdc]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x410]
push ecx
mov edx, dword [ebp - 0xce0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0xc28]
call fcn.00405a50
mov byte [ebp - 4], 2
cmp dword [ebp - 0xcdc], 0
jne 0x40bf7c
push 0x497730
lea ecx, [ebp - 0xc28]
call fcn.004075e0
nop
jmp 0x40bfcb
lea eax, [ebp - 0xce8]
push eax
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0xcec]
push edx
push 0
push 0x497734
mov eax, dword [ebp - 0xcdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xcf0], eax
mov ecx, dword [ebp - 0xcdc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x810]
push edx
lea ecx, [ebp - 0xc28]
call fcn.004075e0
nop
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd08], esp
lea eax, [ebp - 0xc28]
push eax
call fcn.004054c0
mov dword [ebp - 0xd0c], eax
mov byte [ebp - 4], 3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd10], esp
lea edx, [ebp - 0xc58]
push edx
call fcn.004054c0
mov dword [ebp - 0xd14], eax
mov byte [ebp - 4], 4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd18], esp
lea eax, [ebp - 0xc40]
push eax
call fcn.004054c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcd8]
call fcn.00405ee0
mov dword [ebp - 0xd00], eax
mov ecx, dword [ebp - 0xd00]
mov dword [ebp - 0xd04], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0xd04]
push edx
lea eax, [ebp - 0xd20]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00404790
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcd8]
call fcn.00407020
nop
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc28]
call fcn.00406e90
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc58]
call fcn.00406e90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.00406e90
nop
jmp 0x40bd5c
mov ecx, dword [ebp - 0xce0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c2a8
mov esp, ebp
pop ebp
ret