Function at 0x401700
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x8698
call fcn.004046b0
sub esp, eax
mov eax, dword [esp + eax]
mov dword [ebp - 0x866c], edx
mov dword [ebp - 0x8668], 0xff
mov dword [ebp - 0x8658], 0
mov ecx, eax
mov dword [ebp - 0x8674], eax
lea eax, [ebp - 0x8618]
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x861c]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x8614]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x8658]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x8668]
mov dword [esp + 8], eax
lea eax, [ebp - 0x8412]
mov dword [ebp - 0x8628], 0x7ffe
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0xc], 0
mov dword [esp + 4], eax
mov dword [esp], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
sub esp, 0x30
test eax, eax
jne 0x401a51
mov eax, dword [ebp - 0x8658]
test eax, eax
je 0x401940
xor ebx, ebx
lea esi, [ebp - 0x8610]
lea edi, [ebp - 0x8214]
jmp 0x4018d2
cmp dword [ebp - 0x866c], 0x80000002
mov dword [esp + 4], esi
je 0x401a40
mov dword [esp], str._nHKCU__s_n
call sub.msvcrt.dll_wprintf_s
mov dword [esp + 0xc], esi
mov dword [esp + 8], str.SOFTWAREClientsStartMenuInternet_sCapabilities
mov dword [esp + 4], 0x1fe
mov dword [esp], edi
call sub.msvcrt.dll_swprintf_s
lea eax, [ebp - 0x8638]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x866c]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x8670], eax
call eax
sub esp, 0x14
test eax, eax
je 0x4019d1
mov dword [esp + 4], str.IEXPLORE.EXE
mov dword [esp], esi
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x4019c0
mov dword [esp + 0xc], esi
mov dword [esp + 8], str.SOFTWAREClientsStartMenuInternet_s_shellopencommand
mov dword [esp + 4], 0x1fe
mov dword [esp], edi
call sub.msvcrt.dll_swprintf_s
lea eax, [ebp - 0x8638]
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x866c]
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [ebp - 0x8670]
sub esp, 0x14
test eax, eax
je 0x401948
add ebx, 1
cmp dword [ebp - 0x8658], ebx
jbe 0x401940
lea eax, [ebp - 0x8648]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0x8674]
mov dword [ebp - 0x8648], 0xff
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
sub esp, 0x20
test eax, eax
je 0x4017e0
mov dword [esp], str.error:_cannot_enumerate_registry_n
add ebx, 1
call sub.msvcrt.dll_wprintf_s
cmp dword [ebp - 0x8658], ebx
ja 0x4018d2
nop
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [ebp - 0x8628]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x8638]
lea edx, [ebp - 0x8016]
mov dword [esp + 0x10], edx
mov dword [ebp - 0x8670], edx
mov dword [ebp - 0x8628], 0x7ffe
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x8670]
sub esp, 0x18
test eax, eax
je 0x401a74
mov eax, dword [ebp - 0x8638]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
jmp 0x4018c7
mov dword [esp], str.__name:_Internet_Explorer_n
call sub.msvcrt.dll_wprintf_s
jmp 0x401873
lea eax, [ebp - 0x8628]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x8638]
lea edx, [ebp - 0x8016]
mov dword [esp + 0x10], edx
mov dword [ebp - 0x8678], edx
mov dword [ebp - 0x8628], 0x7ffe
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.ApplicationName
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x8678]
sub esp, 0x18
test eax, eax
je 0x401a62
mov eax, dword [ebp - 0x8638]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
jmp 0x40185b
mov dword [esp], str._nHKLM__s_n
call sub.msvcrt.dll_wprintf_s
jmp 0x401800
mov dword [esp], str.error:_cannot_query_registry_n
call sub.msvcrt.dll_wprintf_s
jmp 0x401940
mov dword [esp + 4], edx
mov dword [esp], str.__name:__s_n
call sub.msvcrt.dll_wprintf_s
jmp 0x401a29
mov dword [esp + 4], edx
mov dword [esp], str.__path:__s_n
call sub.msvcrt.dll_wprintf_s
jmp 0x4019a4