Function at 0x416628
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xd800
call fcn.005fec20
mov eax, dword [0x708c34]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, str.LoadPasswordFromNewIntenetExplorer
xor ebx, ebx
push edi
push str._s_entered
mov dword [ebp - 0xd7cc], ebx
call fcn.00449974
push str.Explorer
push str.Internet
push str.Microsoft
push str.Software
push 0x67da60
lea eax, [ebp - 0x88c]
push 0x3e8
push eax
call fcn.00445d6d
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xd7c8]
add esp, 0x24
push eax
push 9
push ebx
lea eax, [ebp - 0x88c]
push eax
push SysReAllocString
call esi
test eax, eax
je 0x4166b4
push edi
push str._s_:__Failed_to_open_registry_key_SoftwareMicrosoftInternet_Explorer
jmp 0x416bab
push str.orage
push 0x67dac0
push str.elliFo
push 0x67dacc
push str._s_s_sSt_s2
lea eax, [ebp - 0xc74]
push 0x3e8
push eax
call fcn.00445d6d
add esp, 0x1c
lea eax, [ebp - 0xd7c0]
push eax
push 9
push 0
lea eax, [ebp - 0xc74]
push eax
push dword [ebp - 0xd7c8]
call esi
test eax, eax
je 0x41670a
push edi
push str._s_:__Failed_to_open_registry_key_SoftwareMicrosoftInternet_ExplorerIntelliFormsStorage2
jmp 0x416bab
xor ecx, ecx
mov dword [ebp - 0xd7bc], 0x400
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0xd7bc]
mov edi, ecx
push eax
lea eax, [ebp - 0x4a4]
push eax
push ecx
push dword [ebp - 0xd7c0]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
je 0x4167b4
lea esi, [ebp - 0xd794]
test eax, eax
jne 0x4167ae
lea eax, [ebp - 0x4a4]
push eax
call fcn.00631510
pop ecx
cmp eax, 1
jb 0x41677b
cmp ebx, 0xfa
jae 0x4167ae
lea eax, [ebp - 0x4a4]
push eax
push 0x80
push esi
call fcn.006311ec
add esp, 0xc
inc ebx
sub esi, 0xffffff80
xor eax, eax
mov dword [ebp - 0xd7bc], 0x400
push eax
push eax
push eax
push eax
lea eax, [ebp - 0xd7bc]
inc edi
push eax
lea eax, [ebp - 0x4a4]
push eax
push edi
push dword [ebp - 0xd7c0]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x416744
mov dword [ebp - 0xd7cc], ebx
push ebx
mov edi, str.LoadPasswordFromNewIntenetExplorer
push edi
push str._s_:_Total_Reg_Website_URL_Hashes_found____d
call fcn.00449974
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0xc
push dword [ebp - 0xd7c0]
call esi
push dword [ebp - 0xd7c8]
call esi
push edi
cmp ebx, 1
jae 0x4167ee
push str._s_:__No_stored_IE_autocomplete_registry_hashes_found....
jmp 0x416bab
push str._s__Smart_Mode__Checking_for_Popular_Websites_automatically
call fcn.00449974
pop ecx
pop ecx
push 0x68
pop edi
mov esi, str.http:__www.facebook.com_
mov dword [ebp - 0xd7d0], edi
push esi
push str.LoadPasswordFromNewIntenetExplorer
push str._s_:_Trying_Popular_Website____ws
call fcn.00449974
push 0x3e8
lea eax, [ebp - 0x4a4]
push eax
push esi
call fcn.0044950d
lea eax, [ebp - 0x4a4]
push eax
call fcn.00631510
add esp, 0x1c
cmp eax, 1
jb 0x416880
lea edi, [ebp - 0xd794]
mov dword [ebp - 0xd7d4], ebx
lea eax, [ebp - 0x4a4]
push edi
push eax
call fcn.00631435
pop ecx
pop ecx
test eax, eax
jne 0x41686c
lea eax, [ebp - 0x4a4]
push esi
push eax
call fcn.00412567
pop ecx
pop ecx
sub edi, 0xffffff80
sub ebx, 1
jne 0x41684a
mov ebx, dword [ebp - 0xd7cc]
mov edi, dword [ebp - 0xd7d0]
add esi, 0x200
sub edi, 1
mov dword [ebp - 0xd7d0], edi
jne 0x416808
push 0x13
pop ecx
mov esi, str.3C374A40_BAE4_11CF_BF7D_00AA006946EE
and dword [ebp - 0xd7b8], 0
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
push 0x13
pop ecx
push 0
movsw word es:[edi], word [esi]
mov esi, str.AFA0DC11_C313_11D0_831A_00C04FD5AE38
lea edi, [ebp - 0xa4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, dword [sym.imp.ole32.dll_CLSIDFromString]
lea eax, [ebp - 0xd7b4]
push eax
lea eax, [ebp - 0x54]
push eax
call esi
lea eax, [ebp - 0xd7a4]
push eax
lea eax, [ebp - 0xa4]
push eax
call esi
lea eax, [ebp - 0xd7b8]
push eax
lea eax, [ebp - 0xd7a4]
push eax
push 1
push 0
lea eax, [ebp - 0xd7b4]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x416929
push eax
push str.LoadPasswordFromNewIntenetExplorer
push str._s_:_CoCreateInstance_failed_with_error_0x_.8x
call fcn.00449974
add esp, 0xc
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x416bb2
mov eax, dword [ebp - 0xd7b8]
lea edx, [ebp - 0xd7c4]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jns 0x416b5f
push eax
push str.LoadPasswordFromNewIntenetExplorer
push str._s_:_EnumUrls_failed_with_error_0x_.8x
call fcn.00449974
mov eax, dword [ebp - 0xd7b8]
add esp, 0xc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x41691e
cmp dword [ebp - 0xd7fc], 0
je 0x416b5f
push dword [ebp - 0xd7fc]
lea eax, [ebp - 0x5a94]
push 0x2710
push eax
call fcn.00630941
lea eax, [ebp - 0x5a94]
push eax
call fcn.00630ba0
inc eax
push eax
lea eax, [ebp - 0x5a94]
push eax
call fcn.0063119e
lea eax, [ebp - 0x5a94]
mov esi, str.LoadPasswordFromNewIntenetExplorer
push eax
push esi
push str._s_:_Found_the_history_URL__S
call fcn.00449974
lea eax, [ebp - 0x5a94]
push 0x3f
push eax
call fcn.0062758b
add esp, 0x2c
test eax, eax
je 0x4169d4
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x5a94]
push eax
call fcn.00630ba0
pop ecx
cmp word [ebp + eax*2 - 0x5a96], 0x2f
jne 0x416a08
lea eax, [eax*2 - 2]
cmp eax, 0x4e20
jae 0x416bc1
xor ecx, ecx
mov word [ebp + eax - 0x5a94], cx
push str.http:__
call fcn.00630ba0
push eax
lea eax, [ebp - 0x5a94]
push str.http:__
push eax
call fcn.00630f06
add esp, 0x10
test eax, eax
je 0x416a52
push str.https:__
call fcn.00630ba0
push eax
lea eax, [ebp - 0x5a94]
push str.https:__
push eax
call fcn.00630f06
add esp, 0x10
test eax, eax
jne 0x416b5f
push 0x3e8
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x5a94]
push eax
call fcn.0044950d
lea eax, [ebp - 0x4a4]
push eax
call fcn.00631510
add esp, 0x10
cmp eax, 1
jb 0x416b5f
lea eax, [ebp - 0x5a94]
push eax
push esi
push str._n_s_:___Check_if_hash_matches_with_URL__s
call fcn.00449974
add esp, 0xc
lea esi, [ebp - 0xd794]
mov edi, ebx
lea eax, [ebp - 0x4a4]
push esi
push eax
call fcn.00631435
pop ecx
pop ecx
test eax, eax
jne 0x416ac7
lea eax, [ebp - 0x5a94]
push eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00412567
pop ecx
pop ecx
sub esi, 0xffffff80
sub edi, 1
jne 0x416a9f
push 0x67df78
lea eax, [ebp - 0x5a94]
push 0x2710
push eax
call fcn.006308d2
push 0x3e8
lea eax, [ebp - 0x4a4]
push eax
lea eax, [ebp - 0x5a94]
push eax
call fcn.0044950d
lea eax, [ebp - 0x5a94]
push eax
push str.LoadPasswordFromNewIntenetExplorer
push str._n_s_:___Check_if_hash_matches_with_URL__s
call fcn.00449974
lea eax, [ebp - 0x4a4]
push eax
call fcn.00631510
add esp, 0x28
cmp eax, 1
jb 0x416b5f
lea esi, [ebp - 0xd794]
mov edi, ebx
lea eax, [ebp - 0x4a4]
push esi
push eax
call fcn.00631435
pop ecx
pop ecx
test eax, eax
jne 0x416b57
lea eax, [ebp - 0x5a94]
push eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00412567
pop ecx
pop ecx
sub esi, 0xffffff80
sub edi, 1
jne 0x416b2f
mov eax, dword [ebp - 0xd7c4]
lea edx, [ebp - 0xd7d8]
push edx
lea edx, [ebp - 0xd800]
push edx
mov ecx, dword [eax]
push 1
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x416965
mov eax, dword [ebp - 0xd7c4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0xd7b8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
push str.LoadPasswordFromNewIntenetExplorer
push str._n_s_:___Finished_checking_with_URL_Hashes_for_Internet_Explorer
call fcn.00449974
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005fe955
leave
ret
call fcn.005fe87a
int3