Function at 0x419f70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x43b96b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x568
push ebx
push esi
push edi
lea ecx, [esp + 0x430]
call fcn.00408940
push 1
xor ebx, ebx
push 0x43d888
lea ecx, [esp + 0x438]
mov dword [esp + 0x584], ebx
call fcn.00410b10
mov esi, dword [ebp + 8]
xor eax, eax
mov byte [esp + 0x120], bl
mov ecx, 0x40
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
stosb byte es:[edi], al
lea eax, [esp + 0x124]
push eax
push 0x43d994
push esi
push 0x43da8c
lea ecx, [esp + 0x444]
call fcn.00410ea0
cmp byte [esp + 0x120], bl
jne 0x41a034
lea ecx, [esp + 0x430]
mov dword [esp + 0x57c], 0xffffffff
call fcn.00408a70
xor eax, eax
mov ecx, dword [esp + 0x574]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp esi, 0x27
jne 0x41a04f
mov ecx, dword [ebp + 0xc]
push ecx
push 0x104
lea edx, [esp + 0x128]
push edx
jmp 0x41a19d
cmp esi, 0x84
jne 0x41a0c1
call fcn.0040dab0
mov esi, eax
xor eax, eax
mov byte [esp + 0x18], bl
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x120]
push 0x43e598
push eax
call fcn.0042b4a0
add esp, 8
test eax, eax
je 0x41a1a2
push esi
lea ecx, [esp + 0x124]
push ecx
lea edx, [esp + 0x20]
push edx
call fcn.0042b677
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x104
lea ecx, [esp + 0x128]
push ecx
call fcn.00401710
jmp 0x41a1a2
cmp esi, 0x21
je 0x41a0e1
cmp esi, 0x22
je 0x41a0e1
cmp esi, 0x2b
je 0x41a0e1
cmp esi, 0x2c
je 0x41a0e1
cmp esi, 0x83
jne 0x41a1a2
mov word [esp + 0x228], bx
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x22a]
rep stosd dword es:[edi], eax
push ebx
push 0x61
push 0x43da8c
lea ecx, [esp + 0x43c]
stosw word es:[edi], ax
call fcn.00410cc0
push 0x208
lea edx, [esp + 0x22c]
push edx
push 0x43e5ac
push 0x79
push 0x43da8c
lea ecx, [esp + 0x444]
mov esi, eax
call fcn.004110b0
cmp word [esp + 0x228], bx
jne 0x41a157
push str.Unknown
push 0x104
lea eax, [esp + 0x230]
push eax
call fcn.00408090
mov byte [esp + 0x18], bl
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
push esi
lea ecx, [esp + 0x22c]
push ecx
push str._tag_Sexp_d
stosw word es:[edi], ax
lea edx, [esp + 0x24]
push 0x104
push edx
stosb byte es:[edi], al
call fcn.00409b60
add esp, 0x14
lea eax, [esp + 0x18]
push eax
push 0x104
lea ecx, [esp + 0x128]
push ecx
call fcn.00401ac0
push 0x43dfa8
call fcn.00405560
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x41a324
xor eax, eax
mov byte [esp + 0x228], bl
mov ecx, 0x40
lea edi, [esp + 0x229]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x18], bl
xor eax, eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
lea edx, [esp + 0x10]
push edx
push 1
push ebx
stosw word es:[edi], ax
push str.htmlfile_shellopencommand
push 0x80000000
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 0x104
stosb byte es:[edi], al
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x41a2d3
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x41a2d3
cmp dword [esp + 0x14], 4
jbe 0x41a2d3
cmp byte [esp + 0x18], 0x22
jne 0x41a280
lea ecx, [esp + 0x19]
push 0x22
push ecx
call fcn.0042abe0
add esp, 8
cmp eax, ebx
je 0x41a2d3
lea edx, [esp + 0x19]
push edx
mov byte [eax], bl
push 0x104
lea eax, [esp + 0x230]
push eax
call fcn.00401710
jmp 0x41a2d3
lea ecx, [esp + 0x18]
push ecx
push 0x104
lea edx, [esp + 0x230]
push edx
call fcn.00401710
lea eax, [esp + 0x228]
push 0x43efac
push eax
call fcn.0042b4a0
add esp, 8
cmp eax, ebx
je 0x41a2d3
mov byte [eax], bl
dec eax
lea ecx, [esp + 0x228]
cmp eax, ecx
jbe 0x41a2d3
mov edi, edi
cmp byte [eax], 0x20
jne 0x41a2d3
mov byte [eax], bl
dec eax
lea edx, [esp + 0x228]
cmp eax, edx
ja 0x41a2c0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ShellExecuteA
push esi
call edi
cmp eax, ebx
jne 0x41a2ed
push str.ShellExecute
push esi
call edi
cmp byte [esp + 0x120], bl
je 0x41a324
cmp eax, ebx
je 0x41a324
mov cl, byte [esp + 0x228]
push 0xa
cmp cl, bl
push ebx
lea ecx, [esp + 0x128]
je 0x41a31a
push ecx
lea edx, [esp + 0x234]
push edx
jmp 0x41a31c
push ebx
push ecx
push str.open
push ebx
call eax
lea ecx, [esp + 0x430]
mov dword [esp + 0x57c], 0xffffffff
call fcn.00408a70
mov ecx, dword [esp + 0x574]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret