Function at 0x404890
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x57382c
mov eax, dword fs:[0]
push eax
sub esp, 0x40c
mov eax, dword [0x5dbcc8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
test byte [0x5ee52c], 1
jne 0x4048f5
or dword [0x5ee52c], 1
push 0x5a55b8
mov ecx, 0x5ee528
mov byte [ebp - 4], 1
call fcn.0040cf20
push 0x578240
call fcn.00547602
add esp, 4
mov byte [ebp - 4], bl
mov eax, dword [0x5ee528]
mov eax, dword [eax - 0xc]
cmp eax, ebx
jne 0x404a5f
push 0x3ff
lea ecx, [ebp - 0x40f]
push ebx
push ecx
mov byte [ebp - 0x410], bl
call fcn.00549e40
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0xc
lea edx, [ebp - 0x414]
push edx
push 1
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsDyBrowser.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], 0x400
call esi
test eax, eax
jne 0x404981
mov edx, dword [ebp - 0x414]
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x410]
push ecx
push ebx
push ebx
push 0x5a4fc6
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404981
mov eax, dword [ebp - 0x414]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x404983
xor al, al
movzx eax, al
lea ecx, [ebp - 0x410]
cmp eax, ebx
jne 0x404a1f
push 0x400
push ebx
push ecx
call fcn.00549e40
add esp, 0xc
lea edx, [ebp - 0x414]
push edx
push 1
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsCKBrowser.exe
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x418], 0x400
call esi
test eax, eax
jne 0x4049fe
mov edx, dword [ebp - 0x414]
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x410]
push ecx
push ebx
push ebx
push 0x5a4fc6
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4049fe
mov eax, dword [ebp - 0x414]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x404a00
xor al, al
movzx eax, al
cmp eax, ebx
je 0x404a5f
lea ecx, [ebp - 0x410]
push ecx
lea ecx, [ebp - 0x414]
call fcn.0040c9f0
mov byte [ebp - 4], 2
jmp 0x404a2f
push ecx
lea ecx, [ebp - 0x414]
call fcn.0040c9f0
mov byte [ebp - 4], 3
push eax
mov ecx, 0x5ee528
call fcn.0040d610
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x414]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404a5f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [0x5ee528]
mov ecx, dword [ebp + 8]
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [eax - 0xc], ebx
jne 0x404a8d
push 3
push ebx
push ebx
push ecx
push str.open
push ebx
call esi
cmp eax, 0x20
jge 0x404ac8
mov edx, dword [ebp + 8]
push 3
push ebx
push edx
jmp 0x404abb
push 5
push ebx
push ecx
push eax
push str.open
push ebx
call esi
cmp eax, 0x20
jge 0x404ac8
mov edx, dword [ebp + 8]
push 3
push ebx
push ebx
push edx
push str.open
push ebx
call esi
cmp eax, 0x20
jge 0x404ac8
mov eax, dword [ebp + 8]
push 3
push ebx
push eax
push str.IExplore.exe
push str.open
push ebx
call esi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404aee
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00545eb2
mov esp, ebp
pop ebp
ret