Function at 0x405d0a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0xd38
lea ebp, [esp - 4]
mov eax, dword [0x597f54]
xor eax, ebp
mov dword [ebp + 0xd38], eax
push 0x44
mov eax, 0x51c655
call fcn.004e2876
mov eax, dword [ebp + 0xd44]
mov ebx, ecx
mov dword [ebp - 0x24], eax
movzx eax, word [ebx + 0x53c]
cmp dword [ebp + 0xd48], eax
jge 0x4062ff
lea eax, [ebp - 0x20]
push eax
push 1
xor esi, esi
push esi
push str.SoftwareMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 0xd28]
push eax
push esi
push esi
push str.Version
push dword [ebp - 0x20]
mov dword [ebp - 0x3c], 0xf
mov byte [ebp + 0xd28], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xd28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x405dc5
push 0x40
push str.Newer_Internet_Explorer_version_required
push str.Internet_Explorer_4.0x_or_later_must_be_installed_for_this_operation_to_function_correctly.
push dword [ebx + 0x218]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4062ff
lea ecx, [ebp + 0x16c]
call fcn.00405c17
lea ecx, [ebp + 0xc0]
mov dword [ebp - 4], esi
call fcn.00405cca
lea ecx, [ebp + 0x60]
mov byte [ebp - 4], 1
call fcn.004397e0
lea ecx, [ebp]
call fcn.004397e0
mov esi, 0xff
push esi
push str.sign.reallegal.com
lea eax, [ebp + 0xba4]
push eax
lea edi, [ebx + 0xd4]
push str.SigningServer
mov ecx, edi
call fcn.00439180
push esi
push str._signatures_api_trancert.dll
lea eax, [ebp + 0xaa0]
push eax
push str.SigningAppPath
mov ecx, edi
call fcn.00439180
push dword [ebp + 0xd48]
lea ecx, [ebx + 0x498]
call fcn.00404c91
test al, al
push 0xf4
je 0x405e72
call fcn.004b1a2e
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
test esi, esi
mov byte [ebp - 4], 2
je 0x405e6b
mov ecx, esi
call fcn.00480240
mov dword [esi], vtable.CPnxCertifyX.0
jmp 0x405e6d
xor esi, esi
mov dword [ebp - 0x10], esi
jmp 0x405e93
call fcn.004b1a2e
pop ecx
mov dword [ebp - 0x18], eax
test eax, eax
mov byte [ebp - 4], 3
je 0x405e8c
mov ecx, eax
call fcn.00480240
jmp 0x405e8e
xor eax, eax
mov dword [ebp - 0x10], eax
mov esi, eax
lea eax, [ebx + 0x20c]
push eax
push 1
lea eax, [ebp + 0xaa0]
push eax
lea eax, [ebp + 0xba4]
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00481440
test eax, eax
jne 0x405ee9
push 0x30
push str.Internet_Connection_Failed
mov ecx, esi
call fcn.004057aa
push eax
push dword [ebx + 0x218]
call dword [sym.imp.USER32.dll_MessageBoxA]
test esi, esi
je 0x4062e9
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
jmp 0x4062e9
mov esi, dword [ebp + 0xd48]
imul esi, esi, 0x30
add esi, dword [ebx + 0x540]
mov dword [ebp + 0x16c], 0x2af9
mov dword [ebp + 0x170], 0x4272
push dword [esi + 4]
lea ecx, [ebp + 0x174]
mov dword [ebp - 0x18], esi
call fcn.00403255
push dword [esi + 0xc]
lea ecx, [ebp + 0x190]
call fcn.00403255
push dword [esi + 0x10]
lea ecx, [ebp + 0x1ac]
call fcn.00403255
push dword [esi + 8]
lea ecx, [ebp + 0x1c8]
call fcn.00403255
push dword [esi + 0x14]
lea ecx, [ebp + 0x1e4]
call fcn.00403255
push dword [ebx + 0x498]
lea esi, [ebx + 0x52c]
lea edi, [ebp + 0x204]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebp + 0x214]
movsd dword es:[edi], dword [esi]
call fcn.00403255
mov esi, dword [ebp + 0xd48]
mov edi, dword [ebp - 0x18]
imul esi, esi, 0x28
fld qword [edi + 0x20]
fstp qword [ebp + 0x234]
add esi, dword [ebx + 0x5d0]
lea ecx, [ebp + 0x60]
mov eax, dword [esi + 0x1c]
mov dword [ebp + 0x23c], eax
movsx eax, word [esi + 0x20]
mov dword [ebp + 0x240], eax
movsx eax, word [esi + 0x22]
and dword [ebx + 0x89c], 0
mov dword [ebp + 0x244], eax
lea eax, [ebp - 0x50]
push eax
push dword [ebx + 0x260]
call fcn.004399e0
test eax, eax
je 0x4062e9
mov ecx, dword [ebx + 0x260]
mov eax, dword [ecx]
call dword [eax + 4]
movzx eax, ax
mov dword [ebp + 0x200], eax
push 0x14
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp + 0x25c]
call fcn.00404d10
push dword [edi + 0x1c]
lea ecx, [ebp + 0x270]
push dword [edi + 0x18]
call fcn.00404d10
xor edi, edi
mov dword [ebp - 0x38], vtable.CBinData.0
mov dword [ebp - 0x28], 0x40
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
push dword [esi + 4]
lea ecx, [ebp - 0x38]
push dword [esi]
mov byte [ebp - 4], 4
call fcn.00404d10
lea ecx, [ebp - 0x38]
call fcn.00439c60
push edi
lea ecx, [ebp + 0x284]
mov dword [ebp + 0x29c], 0xf
call fcn.0040224c
lea eax, [ebp + 0x284]
push eax
push dword [ebp - 0x34]
lea ecx, [ebp - 0x19]
mov byte [ebp - 4], 5
call fcn.0043a0c0
cmp dword [ebp + 0x29c], 0x10
mov eax, dword [ebp + 0x288]
jae 0x406078
lea eax, [ebp + 0x288]
push eax
lea ecx, [ebp + 0x248]
call fcn.00404d3e
push 0
push dword [ebp - 0x24]
lea edi, [ebx + 0x8a0]
and dword [edi], 0
call dword [sym.imp.USER32.dll_EnableWindow]
mov esi, eax
push edi
neg esi
push str.Verify_transcript_signature...
push dword [ebx + 0x218]
sbb esi, esi
inc esi
call fcn.00467070
mov ecx, dword [ebp - 0x10]
and dword [ebp - 0x14], 0
mov dword [ebx + 0x89c], eax
add esp, 0xc
lea eax, [ebp + 0x16c]
push eax
call fcn.004814c0
test eax, eax
jne 0x406120
push 0x30
mov ecx, dword [ebp - 0x10]
push str.Verification_Failed
call fcn.004057aa
jmp 0x406289
call fcn.00466c30
mov ecx, dword [ebp - 0x14]
inc dword [ebp - 0x14]
mov eax, 0x5dc
cmp ecx, eax
jge 0x406100
mov ecx, dword [ebp - 0x14]
inc dword [ebp - 0x14]
jmp 0x406102
mov ecx, eax
push eax
push ecx
push dword [ebx + 0x89c]
call fcn.00467230
mov ecx, dword [ebp - 0x10]
add esp, 0xc
push 0x64
call fcn.00480570
test eax, eax
jne 0x406125
cmp dword [edi], 0
je 0x4060e4
cmp dword [edi], 0
je 0x406137
mov ecx, dword [ebp - 0x10]
call fcn.00480090
jmp 0x406296
push 1
push 1
push dword [ebx + 0x89c]
call fcn.00467230
add esp, 0xc
push dword [ebx + 0x89c]
call dword [sym.imp.USER32.dll_UpdateWindow]
call fcn.00466c30
push dword [ebx + 0x218]
push dword [ebx + 0x89c]
call fcn.004671f0
and dword [ebx + 0x89c], 0
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea eax, [ebp + 0xc0]
push eax
call fcn.004805e0
test eax, eax
jne 0x40618e
push 0x10
jmp 0x4060d2
push str.Verification_successful:_This_transcript_was_signed_by
lea eax, [ebp + 0x2a0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp + 0x1a8], 0x10
mov eax, dword [ebp + 0x194]
jae 0x4061b5
lea eax, [ebp + 0x194]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push eax
lea eax, [ebp + 0x2a0]
push eax
call edi
cmp dword [ebp + 0x1a4], 0
je 0x406248
cmp dword [ebp + 0x12c], 0
je 0x406248
cmp dword [ebp + 0x130], 0x10
mov ecx, dword [ebp + 0x11c]
jae 0x4061ec
lea ecx, [ebp + 0x11c]
cmp dword [ebp + 0x1a8], 0x10
mov eax, dword [ebp + 0x194]
jae 0x406201
lea eax, [ebp + 0x194]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x406248
push str.__now
lea eax, [ebp + 0x2a0]
push eax
call edi
cmp dword [ebp + 0x130], 0x10
mov eax, dword [ebp + 0x11c]
jae 0x406230
lea eax, [ebp + 0x11c]
push eax
lea eax, [ebp + 0x2a0]
push eax
call edi
push 0x52e878
lea eax, [ebp + 0x2a0]
push eax
call edi
push str._on
lea eax, [ebp + 0x2a0]
push eax
call edi
push 0x80
lea eax, [ebp + 0xca8]
push eax
push dword [ebp - 0x18]
mov ecx, ebx
call fcn.00408d18
lea eax, [ebp + 0xca8]
push eax
lea eax, [ebp + 0x2a0]
push eax
call edi
push 0x40
push str.Signature_Successfully_Verified
lea eax, [ebp + 0x2a0]
push eax
push dword [ebx + 0x218]
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x4062a3
mov eax, dword [ecx]
push 1
call dword [eax]
test esi, esi
je 0x4062b2
push 1
push dword [ebp - 0x24]
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [ebx + 0x89c]
test eax, eax
je 0x4062ca
push dword [ebx + 0x218]
push eax
call fcn.004671f0
pop ecx
pop ecx
push 0
push 1
lea ecx, [ebp + 0x284]
call fcn.0040241b
push dword [ebp - 0x34]
mov dword [ebp - 0x38], vtable.CBinData.0
call fcn.004b1a59
pop ecx
lea ecx, [ebp + 0xc0]
call fcn.0040595f
lea ecx, [ebp + 0x16c]
call fcn.004058da
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0xd38]
xor ecx, ebp
call fcn.004e2867
add ebp, 0xd3c
leave
ret 8