Function at 0x423ae0
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e8
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x2d4], ax
lea eax, [ebp - 0x2d2]
push eax
mov edi, ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
call fcn.00411780
call fcn.00425560
cmp eax, 5
jge 0x423bd2
mov dword [ebp - 0x4e8], 0x104
call fcn.0040bd40
lea eax, [ebp - 0x4e0]
push eax
push 0x20019
push 0
push str.http_shellopencommand
push SysReAllocString
xor bl, bl
mov dword [ebp - 0x4e0], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x423bb0
lea eax, [ebp - 0x4e8]
push eax
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x4e4]
push eax
push 0
push 0
push dword [ebp - 0x4e0]
mov dword [ebp - 0x4e4], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x4e0]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmove ebx, ecx
call esi
push SysReAllocString
call esi
test bl, bl
jne 0x423cf0
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0xcc], ax
lea eax, [ebp - 0xca]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
mov dword [ebp - 0x4e4], 0x64
call fcn.0040bd40
lea eax, [ebp - 0x4e0]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push SysReAllocString
xor bl, bl
mov dword [ebp - 0x4e0], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x423c7a
lea eax, [ebp - 0x4e4]
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x4e8]
push eax
push 0
push str.ProgId
push dword [ebp - 0x4e0]
mov dword [ebp - 0x4e8], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x4e0]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmove ebx, ecx
call esi
push SysReAllocString
call esi
test bl, bl
je 0x423bbf
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x4dc], ax
lea eax, [ebp - 0x4da]
push eax
call sub.MSVCR110.dll_memset
lea eax, [ebp - 0xcc]
push eax
push str._s_shellopencommand
lea eax, [ebp - 0x4dc]
push 0x208
push eax
call fcn.00401000
add esp, 0x1c
call fcn.0040bd40
push 0x104
lea eax, [ebp - 0x2d4]
push eax
push 0
lea eax, [ebp - 0x4dc]
push eax
push SysReAllocString
call fcn.00424b50
test al, al
je 0x423bbf
lea ecx, [ebp - 0x2d4]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x423d00
sub ecx, edx
sar ecx, 1
je 0x423bbf
cmp word [ebp - 0x2d4], 0x22
jne 0x423d77
lea eax, [ebp - 0x4e0]
push eax
lea eax, [ebp - 0x2d4]
push eax
mov dword [ebp - 0x4e0], 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 0x4e0], 0
mov esi, eax
jle 0x423d59
test esi, esi
je 0x423d89
push dword [esi]
push 0x208
push edi
call fcn.004078a0
test esi, esi
je 0x423d89
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x2d4]
push eax
push 0x208
push edi
call fcn.004078a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.004314a6
mov esp, ebp
pop ebp
ret