Function at 0x40a9d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4484da
mov eax, dword fs:[0]
push eax
sub esp, 0x3a0
mov eax, dword [0x45ff68]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3ac], ecx
mov ecx, dword [ebp + 8]
call fcn.0040b170
test eax, eax
jne 0x40aa14
xor al, al
jmp 0x40b0fa
mov byte [ebp - 0x361], 0
mov byte [ebp - 0x362], 0
lea eax, [ebp - 0x240]
push eax
call fcn.00409410
mov ecx, eax
call fcn.00425670
mov dword [ebp - 4], 0
push 0
push 0x44b9a4
mov ecx, dword [ebp + 8]
call fcn.00409120
cmp eax, 0xffffffff
je 0x40ab3e
mov byte [ebp - 0x361], 1
push 0
push str.DEFIE
mov ecx, dword [ebp + 8]
call fcn.00409120
cmp eax, 0xffffffff
je 0x40aab6
movzx ecx, byte [ebp - 0x362]
test ecx, ecx
jne 0x40aab6
push 0
push str.IEXPLORE
lea ecx, [ebp - 0x240]
call fcn.00409120
cmp eax, 0xffffffff
jne 0x40aaa8
push 0
push str.iexplore
lea ecx, [ebp - 0x240]
call fcn.00409120
cmp eax, 0xffffffff
je 0x40aab6
mov byte [ebp - 0x361], 0
mov byte [ebp - 0x362], 1
push 0
push str.DEFCHROME
mov ecx, dword [ebp + 8]
call fcn.00409120
cmp eax, 0xffffffff
je 0x40aafa
movzx edx, byte [ebp - 0x362]
test edx, edx
jne 0x40aafa
push 0
push str.chrome
lea ecx, [ebp - 0x240]
call fcn.00409120
cmp eax, 0xffffffff
je 0x40aafa
mov byte [ebp - 0x361], 0
mov byte [ebp - 0x362], 1
push 0
push str.DEFFIREFOX
mov ecx, dword [ebp + 8]
call fcn.00409120
cmp eax, 0xffffffff
je 0x40ab3e
movzx eax, byte [ebp - 0x362]
test eax, eax
jne 0x40ab3e
push 0
push str.firefox
lea ecx, [ebp - 0x240]
call fcn.00409120
cmp eax, 0xffffffff
je 0x40ab3e
mov byte [ebp - 0x361], 0
mov byte [ebp - 0x362], 1
movzx ecx, byte [ebp - 0x361]
test ecx, ecx
je 0x40ab6d
mov byte [ebp - 0x36c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00405790
mov al, byte [ebp - 0x36c]
jmp 0x40b0fa
push 0x2c
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x3a8]
push eax
call fcn.00409410
mov ecx, eax
call fcn.00426c80
mov byte [ebp - 4], 1
mov dword [ebp - 0x374], 0
jmp 0x40aba5
mov ecx, dword [ebp - 0x374]
add ecx, 1
mov dword [ebp - 0x374], ecx
lea ecx, [ebp - 0x3a8]
call fcn.0040e1f0
cmp dword [ebp - 0x374], eax
jae 0x40b0c7
push 0x7c
mov edx, dword [ebp - 0x374]
push edx
lea ecx, [ebp - 0x3a8]
call fcn.00408700
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00409410
mov ecx, eax
call fcn.00426bf0
mov byte [ebp - 4], 2
push 0
lea ecx, [ebp - 0x394]
call fcn.00408700
push eax
lea ecx, [ebp - 0x228]
call fcn.00404b50
mov byte [ebp - 4], 3
mov dword [ebp - 0x368], 0
push 0
push str.HKEY_CLASSES_ROOT
lea ecx, [ebp - 0x228]
call fcn.004090f0
cmp eax, 0xffffffff
je 0x40ac9c
mov dword [ebp - 0x368], SysStringLen
push 0x44b50e
lea ecx, [ebp - 0x330]
call fcn.00401130
mov byte [ebp - 4], 4
push str.HKEY_CLASSES_ROOT_
lea ecx, [ebp - 0x288]
call fcn.00401130
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x330]
push ecx
lea edx, [ebp - 0x288]
push edx
lea eax, [ebp - 0x228]
push eax
call fcn.00409410
mov ecx, eax
call fcn.00426550
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x288]
call fcn.00401240
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x330]
call fcn.00401240
jmp 0x40aed4
push 0
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x228]
call fcn.004090f0
cmp eax, 0xffffffff
je 0x40ad29
mov dword [ebp - 0x368], SysStringLen
push 0x44b50f
lea ecx, [ebp - 0x258]
call fcn.00401130
mov byte [ebp - 4], 6
push str.HKEY_CURRENT_USER_
lea ecx, [ebp - 0x2b8]
call fcn.00401130
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x258]
push ecx
lea edx, [ebp - 0x2b8]
push edx
lea eax, [ebp - 0x228]
push eax
call fcn.00409410
mov ecx, eax
call fcn.00426550
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2b8]
call fcn.00401240
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x258]
call fcn.00401240
jmp 0x40aed4
push 0
push str.HKEY_LOCAL_MACHINE
lea ecx, [ebp - 0x228]
call fcn.004090f0
cmp eax, 0xffffffff
je 0x40adb6
mov dword [ebp - 0x368], SysStringLen
push 0x44b516
lea ecx, [ebp - 0x270]
call fcn.00401130
mov byte [ebp - 4], 8
push str.HKEY_LOCAL_MACHINE_
lea ecx, [ebp - 0x2e8]
call fcn.00401130
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x270]
push ecx
lea edx, [ebp - 0x2e8]
push edx
lea eax, [ebp - 0x228]
push eax
call fcn.00409410
mov ecx, eax
call fcn.00426550
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2e8]
call fcn.00401240
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x270]
call fcn.00401240
jmp 0x40aed4
push 0
push str.HKEY_USERS
lea ecx, [ebp - 0x228]
call fcn.004090f0
cmp eax, 0xffffffff
je 0x40ae43
mov dword [ebp - 0x368], SysStringLen
push 0x44b517
lea ecx, [ebp - 0x2d0]
call fcn.00401130
mov byte [ebp - 4], 0xa
push str.HKEY_USERS_
lea ecx, [ebp - 0x2a0]
call fcn.00401130
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x2d0]
push ecx
lea edx, [ebp - 0x2a0]
push edx
lea eax, [ebp - 0x228]
push eax
call fcn.00409410
mov ecx, eax
call fcn.00426550
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2a0]
call fcn.00401240
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x2d0]
call fcn.00401240
jmp 0x40aed4
push 0
push str.HKEY_CURRENT_CONFIG
lea ecx, [ebp - 0x228]
call fcn.004090f0
cmp eax, 0xffffffff
je 0x40aecd
mov dword [ebp - 0x368], SysStringLen
push 0x44b51e
lea ecx, [ebp - 0x318]
call fcn.00401130
mov byte [ebp - 4], 0xc
push str.HKEY_CURRENT_CONFIG_
lea ecx, [ebp - 0x300]
call fcn.00401130
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x318]
push ecx
lea edx, [ebp - 0x300]
push edx
lea eax, [ebp - 0x228]
push eax
call fcn.00409410
mov ecx, eax
call fcn.00426550
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x300]
call fcn.00401240
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x318]
call fcn.00401240
jmp 0x40aed4
mov byte [ebp - 0x361], 0
cmp dword [ebp - 0x368], 0
jne 0x40af33
mov cl, byte [ebp - 0x361]
mov byte [ebp - 0x369], cl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
call fcn.00401240
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x394]
call fcn.00405850
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3a8]
call fcn.00405850
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00405790
mov al, byte [ebp - 0x369]
jmp 0x40b0fa
lea edx, [ebp - 0x39c]
push edx
push 0x101
push 0
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x360]
push ecx
call fcn.00409410
mov ecx, eax
call fcn.00427380
mov dword [ebp - 0x380], eax
mov ecx, dword [ebp - 0x380]
call fcn.004087e0
push eax
mov edx, dword [ebp - 0x368]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40af8a
mov dword [ebp - 0x37c], 1
jmp 0x40af94
mov dword [ebp - 0x37c], 0
mov al, byte [ebp - 0x37c]
mov byte [ebp - 0x36b], al
lea ecx, [ebp - 0x360]
call fcn.00405790
movzx ecx, byte [ebp - 0x36b]
test ecx, ecx
je 0x40b0a4
lea ecx, [ebp - 0x394]
call fcn.0040e1f0
cmp eax, 1
jbe 0x40b09d
mov dword [ebp - 0x388], 1
xor edx, edx
mov word [ebp - 0x210], dx
push 0x1fc
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.0042e230
add esp, 0xc
mov dword [ebp - 0x384], 0x1fe
lea ecx, [ebp - 0x384]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x388]
push eax
push 0
push 1
lea ecx, [ebp - 0x394]
call fcn.00408700
push eax
lea ecx, [ebp - 0x348]
push ecx
call fcn.00409410
mov ecx, eax
call fcn.00427380
mov dword [ebp - 0x398], eax
mov ecx, dword [ebp - 0x398]
call fcn.004087e0
push eax
mov edx, dword [ebp - 0x39c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b068
mov dword [ebp - 0x378], 1
jmp 0x40b072
mov dword [ebp - 0x378], 0
mov al, byte [ebp - 0x378]
mov byte [ebp - 0x36d], al
lea ecx, [ebp - 0x348]
call fcn.00405790
movzx ecx, byte [ebp - 0x36d]
test ecx, ecx
je 0x40b09b
mov byte [ebp - 0x361], 1
jmp 0x40b0a4
mov byte [ebp - 0x361], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x228]
call fcn.00401240
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x394]
call fcn.00405850
jmp 0x40ab96
mov dl, byte [ebp - 0x361]
mov byte [ebp - 0x36a], dl
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3a8]
call fcn.00405850
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00405790
mov al, byte [ebp - 0x36a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042ec10
mov esp, ebp
pop ebp
ret 4