Function at 0x41c1c0
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x488b6d
mov eax, dword fs:[0]
push eax
mov eax, 0x1070
call fcn.00430020
mov eax, dword [0x4b1070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, ecx
xor eax, eax
mov dword [ebp - 0x1048], 0
mov dword [ebp - 0x1044], 0
mov dword [ebp - 0x1044], 7
mov dword [ebp - 0x1048], 0
mov word [ebp - 0x1058], ax
cmp word [edx], ax
jne 0x41c22e
xor ecx, ecx
jmp 0x41c240
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c231
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x1058]
call fcn.004185d0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x810]
push 0x800
push 0
push eax
call fcn.0045cfa0
add esp, 0xc
mov dword [ebp - 0x1074], 0
lea eax, [ebp - 0x107c]
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x41c39c
push 0x800
lea eax, [ebp - 0x1010]
push 0
push eax
call fcn.0045cfa0
add esp, 0xc
mov dword [ebp - 0x1074], 0x400
lea eax, [ebp - 0x1074]
push eax
lea eax, [ebp - 0x1010]
push eax
push 0
push 0
push str.Progid
push dword [ebp - 0x107c]
call edi
push dword [ebp - 0x107c]
mov esi, eax
call ebx
test esi, esi
jne 0x41c39c
cmp dword [ebp - 0x1074], esi
je 0x41c3fa
lea eax, [ebp - 0x1010]
push eax
lea ecx, [ebp - 0x1028]
call fcn.00417a50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1028]
push 0x13
push str._shellopencommand
call fcn.0041b660
cmp dword [ebp - 0x1014], 8
lea ecx, [ebp - 0x107c]
push ecx
push 1
lea eax, [ebp - 0x1028]
cmovae eax, dword [ebp - 0x1028]
push esi
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x41c389
lea eax, [ebp - 0x1074]
mov dword [ebp - 0x1074], 0x400
push eax
lea eax, [ebp - 0x810]
push eax
push esi
push esi
push 0x49d924
push dword [ebp - 0x107c]
call edi
push dword [ebp - 0x107c]
mov esi, eax
call ebx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1028]
call fcn.00418cb0
test esi, esi
je 0x41c3fa
lea eax, [ebp - 0x1078]
push eax
push 1
push 0
push str.http_shellopencommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c6b2
lea eax, [ebp - 0x1074]
mov dword [ebp - 0x1074], 0x400
push eax
lea eax, [ebp - 0x810]
push eax
push 0
push 0
push 0x49d924
push dword [ebp - 0x1078]
call edi
push dword [ebp - 0x1078]
mov esi, eax
call ebx
test esi, esi
jne 0x41c6b2
xor eax, eax
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x1014], 7
mov dword [ebp - 0x1018], 0
mov word [ebp - 0x1028], ax
cmp word [ebp - 0x810], ax
jne 0x41c438
xor ecx, ecx
jmp 0x41c450
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41c441
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x1028]
call fcn.004185d0
mov byte [ebp - 4], 2
xor eax, eax
mov dword [ebp - 0x1030], 0
mov dword [ebp - 0x102c], 0
mov dword [ebp - 0x102c], 7
mov dword [ebp - 0x1030], 0
mov word [ebp - 0x1040], ax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x1018], eax
je 0x41c635
push 1
push ecx
lea eax, [ebp - 0x1078]
mov dword [ebp - 0x1078], 0x22
push eax
lea ecx, [ebp - 0x1028]
call fcn.00417bc0
cmp eax, 0xffffffff
je 0x41c501
push 0xffffffffffffffff
inc eax
lea ecx, [ebp - 0x1028]
push eax
lea eax, [ebp - 0x1070]
push eax
call fcn.00417950
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1028]
push eax
call fcn.004179d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1070]
call fcn.00418cb0
push 1
push ecx
lea eax, [ebp - 0x1078]
mov dword [ebp - 0x1078], 0x22
push eax
lea ecx, [ebp - 0x1028]
call fcn.00417bc0
mov esi, eax
cmp esi, 0xffffffff
je 0x41c592
push 0xffffffffffffffff
lea ecx, [esi + 1]
push ecx
lea eax, [ebp - 0x1070]
push eax
lea ecx, [ebp - 0x1028]
call fcn.00417950
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1040]
push eax
call fcn.004179d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1070]
call fcn.00418cb0
push esi
push 0
lea eax, [ebp - 0x1070]
push eax
lea ecx, [ebp - 0x1028]
call fcn.00417950
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1028]
push eax
call fcn.004179d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1070]
call fcn.00418cb0
push 2
push ecx
push 0x49d84c
lea ecx, [ebp - 0x1040]
call fcn.00417bc0
cmp eax, 0xffffffff
je 0x41c5ce
cmp dword [ebp - 0x1044], 8
lea ecx, [ebp - 0x1058]
cmovae ecx, dword [ebp - 0x1058]
push ecx
push ecx
push eax
lea ecx, [ebp - 0x1040]
call fcn.0041c850
jmp 0x41c5e4
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x1058]
push eax
lea ecx, [ebp - 0x1040]
call fcn.004189e0
push 6
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp dword [ebp - 0x102c], 8
lea edx, [ebp - 0x1040]
push 1
cmovae edx, dword [ebp - 0x1040]
lea ecx, [ebp - 0x1028]
cmp dword [ebp - 0x1014], 8
mov esi, eax
push 0
cmovae ecx, dword [ebp - 0x1028]
push edx
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
test esi, esi
jne 0x41c635
call dword [sym.imp.ole32.dll_CoUninitialize]
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x102c]
cmp eax, 8
jb 0x41c657
inc eax
lea ecx, [ebp - 0x1040]
push eax
push dword [ebp - 0x1040]
call fcn.00418be0
xor eax, eax
mov dword [ebp - 0x102c], 7
mov dword [ebp - 0x1030], 0
mov word [ebp - 0x1040], ax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x1014]
cmp eax, 8
jb 0x41c695
inc eax
lea ecx, [ebp - 0x1028]
push eax
push dword [ebp - 0x1028]
call fcn.00418be0
xor eax, eax
mov dword [ebp - 0x1014], 7
mov dword [ebp - 0x1018], 0
mov word [ebp - 0x1028], ax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1044]
cmp eax, 8
jb 0x41c6d7
inc eax
lea ecx, [ebp - 0x1058]
push eax
push dword [ebp - 0x1058]
call fcn.00418be0
xor eax, eax
mov dword [ebp - 0x1044], 7
mov dword [ebp - 0x1048], 0
mov word [ebp - 0x1058], ax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042ed56
mov esp, ebp
pop ebp
ret