Function at 0x402930
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fe12
mov eax, dword fs:[0]
push eax
sub esp, 0xd00
mov eax, dword [0x504070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xcf4], eax
lea eax, [ebp - 0xce4]
push eax
push 0x20019
push 0
push edx
push ecx
mov dword [ebp - 0xce4], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0xce4]
test eax, eax
jne 0x402998
mov al, 1
jmp 0x402ddb
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xcec]
mov dword [ebp - 0xcec], 0x200
push ecx
lea ecx, [ebp - 0x414]
push ecx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, 1
cmp eax, 0x103
je 0x402dcd
xor eax, eax
mov dword [ebp - 0xc18], 7
mov dword [ebp - 0xc1c], 0
mov word [ebp - 0xc2c], ax
cmp word [ebp - 0x414], ax
jne 0x4029fb
xor ecx, ecx
jmp 0x402a13
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402a04
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0xc2c]
call fcn.00406a60
mov dword [ebp - 4], 0
xor ecx, ecx
nop
movzx eax, word [ebp + ecx - 0x414]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x816], ax
test ax, ax
jne 0x402a30
lea edi, [ebp - 0x814]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402a51
lea eax, [ebp - 0xce0]
mov dword [ebp - 0xce0], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x814]
mov ecx, 0xa
push eax
push dword [ebp - 0xce4]
mov esi, str._shellopencommand
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0xce0]
test eax, eax
je 0x402d6d
lea ecx, [ebp - 0xce8]
mov dword [ebp - 0xcf0], 1
push ecx
lea ecx, [ebp - 0xc14]
mov dword [ebp - 0xce8], 0x200
push ecx
lea ecx, [ebp - 0xcf0]
push ecx
push 0
push 0x4600c0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xce0]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xce8], 0
je 0x402d6d
test esi, esi
jne 0x402d6d
lea eax, [ebp - 0xc14]
push eax
lea ecx, [ebp - 0xc5c]
call fcn.00405530
xor ecx, ecx
movzx eax, word [ebp + ecx - 0x414]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x816], ax
test ax, ax
jne 0x402b10
lea edi, [ebp - 0x814]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x402b31
lea eax, [ebp - 0xce0]
mov dword [ebp - 0xce0], 0
push eax
push 0x20019
push 0
lea eax, [ebp - 0x814]
mov ecx, 0xf
push eax
push dword [ebp - 0xce4]
mov esi, str.CapabilitiesURLAssociations
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
mov dword [ebp - 0xc30], 7
mov dword [ebp - 0xc34], 0
mov word [ebp - 0xc44], ax
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xce0]
test eax, eax
jne 0x402ba7
push eax
push 0x4600c0
jmp 0x402c07
lea ecx, [ebp - 0xce8]
push ecx
lea ecx, [ebp - 0xc14]
push ecx
lea ecx, [ebp - 0xcf0]
push ecx
push 0
push str.http
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xce0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0xc14], 0
jne 0x402be4
xor ecx, ecx
jmp 0x402bff
lea ecx, [ebp - 0xc14]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402bf0
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0xc14]
push eax
lea ecx, [ebp - 0xc44]
call fcn.00406a60
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xcfc], esp
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x402c35
mov eax, dword [ecx]
jmp 0x402c37
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp - 0xc44]
push edx
push eax
call fcn.00406b60
sub esp, 0x18
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0xd00], esp
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x402c72
mov eax, dword [ecx]
jmp 0x402c74
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp - 0xc5c]
push edx
push eax
call fcn.00406b60
sub esp, 0x18
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
cmp dword [ecx + 0x14], 8
jb 0x402ca9
mov eax, dword [ecx]
jmp 0x402cab
mov eax, ecx
xor edx, edx
push 0xffffffffffffffff
mov word [eax], dx
lea eax, [ebp - 0xc2c]
push edx
push eax
call fcn.00406b60
lea ecx, [ebp - 0xcdc]
mov byte [ebp - 4], 2
call fcn.00402220
mov byte [ebp - 4], 5
push dword [ebp - 0xcf8]
push eax
push ecx
mov ecx, dword [ebp - 0xcf4]
lea eax, [ebp - 0xd08]
push eax
call fcn.0040a0b0
lea ecx, [ebp - 0xcdc]
call fcn.004023d0
mov eax, dword [ebp - 0xc30]
cmp eax, 8
jb 0x402d15
inc eax
lea ecx, [ebp - 0xc44]
push eax
push dword [ebp - 0xc44]
call fcn.00407d10
xor eax, eax
mov dword [ebp - 0xc30], 7
mov word [ebp - 0xc44], ax
mov eax, dword [ebp - 0xc48]
mov dword [ebp - 0xc34], 0
cmp eax, 8
jb 0x402d50
inc eax
lea ecx, [ebp - 0xc5c]
push eax
push dword [ebp - 0xc5c]
call fcn.00407d10
xor eax, eax
mov dword [ebp - 0xc48], 7
mov dword [ebp - 0xc4c], 0
mov word [ebp - 0xc5c], ax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0xc18]
cmp eax, 8
jb 0x402d92
inc eax
lea ecx, [ebp - 0xc2c]
push eax
push dword [ebp - 0xc2c]
call fcn.00407d10
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xcec]
mov dword [ebp - 0xcec], 0x200
push ecx
lea ecx, [ebp - 0x414]
mov eax, ebx
push ecx
push eax
push dword [ebp - 0xce4]
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x4029d1
push dword [ebp - 0xce4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0042cc9c
mov esp, ebp
pop ebp
ret