Function at 0x10001470
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x10015664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x180
lea eax, [ebp - 0x184]
mov dword [ebp - 0x194], 0
push 0
push eax
mov dword [ebp - 0x18c], 0
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x188], 0
call fcn.10007250
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x18c]
add esp, 0xc
push eax
push 1
push 0
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push 0x80000001
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10001536
lea eax, [ebp - 0x188]
mov dword [ebp - 0x188], 0x40
push eax
push 0x10016968
lea eax, [ebp - 0x190]
push eax
push 0
push str.ProgId
push dword [ebp - 0x18c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000152e
cmp dword [ebp - 0x190], 1
je 0x1000152e
mov word [0x10016968], ax
push dword [ebp - 0x18c]
call esi
cmp word [0x10016968], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
je 0x100015db
push 0x10016968
lea eax, [ebp - 0x184]
push eax
call ebx
push str._shellopencommand
lea eax, [ebp - 0x184]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x184]
lea eax, [ecx + eax*2]
push eax
call ebx
lea eax, [ebp - 0x18c]
push eax
push 1
push 0
lea eax, [ebp - 0x184]
push eax
push 0x80000000
call edi
test eax, eax
jne 0x100015db
lea eax, [ebp - 0x188]
mov dword [ebp - 0x188], 0x200
push eax
push 0x10016168
lea eax, [ebp - 0x190]
push eax
push 0
push 0
push dword [ebp - 0x18c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100015d3
cmp dword [ebp - 0x190], 1
je 0x100015d3
mov word [0x10016168], ax
push dword [ebp - 0x18c]
call esi
cmp word [0x10016168], 0
jne 0x100016b9
lea eax, [ebp - 0x18c]
push eax
push 1
push 0
push str.SoftwareClasseshttp_shellopencommand
push 0x80000001
call edi
test eax, eax
jne 0x1000164c
lea eax, [ebp - 0x188]
mov dword [ebp - 0x188], 0x200
push eax
push 0x10016168
lea eax, [ebp - 0x190]
push eax
push 0
push 0
push dword [ebp - 0x18c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10001644
cmp dword [ebp - 0x190], 1
je 0x10001644
mov word [0x10016168], ax
push dword [ebp - 0x18c]
call esi
cmp word [0x10016168], 0
jne 0x100016b9
lea eax, [ebp - 0x18c]
push eax
push 1
push 0
push str.SoftwareClasseshttp_shellopencommand
push 0x80000002
call edi
test eax, eax
jne 0x100016b9
lea eax, [ebp - 0x188]
mov dword [ebp - 0x188], 0x200
push eax
push 0x10016168
lea eax, [ebp - 0x190]
push eax
push 0
push 0
push dword [ebp - 0x18c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100016b1
cmp dword [ebp - 0x190], 1
je 0x100016b1
mov word [0x10016168], ax
push dword [ebp - 0x18c]
call esi
mov ecx, dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
mov word [0x10017290], ax
mov word [0x10017a90], ax
mov word [0x10016a90], ax
mov word [0x10016a68], ax
mov eax, dword [0x10016160]
test eax, eax
je 0x100016f5
push eax
call ecx
mov ecx, dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [0x10016160], 0
mov eax, dword [0x10016164]
test eax, eax
je 0x1000170b
push eax
call ecx
mov dword [0x10016164], 0
cmp word [0x10016168], 0
je 0x10001a39
push str..exe
push 0x10016168
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov esi, eax
test esi, esi
je 0x10001a39
sub eax, 0x10016168
sar eax, 1
cmp word [0x1001616a], 0x22
jne 0x1000174f
add eax, 3
push eax
push 0x1001616a
jmp 0x10001758
add eax, 4
push eax
push 0x10016168
push 0x10017290
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
movzx ecx, word [esi + 8]
lea eax, [esi + 8]
test cx, cx
je 0x10001788
cmp ecx, 0x22
jne 0x10001780
add esi, 0xa
cmp word [esi], 0
je 0x10001788
push esi
jmp 0x10001781
push eax
push 0x10017a90
call ebx
push 0x10017290
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x188], eax
nop dword [eax]
test eax, eax
je 0x100017bc
movzx ecx, word [eax*2 + 0x1001728e]
dec eax
test cx, cx
je 0x100017bc
cmp ecx, 0x5c
je 0x100017bc
cmp ecx, 0x2f
jne 0x100017a0
mov dword [ebp - 0x188], eax
lea eax, [eax*2 + 0x10017290]
push eax
push 0x10016a90
call ebx
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x194]
push eax
sub esp, 0xc
call fcn.10001190
mov esi, dword [ebp - 0x194]
add esp, 0x14
test esi, esi
je 0x10001a26
mov dword [ebp - 0x188], 0
movzx eax, word [esi]
test ax, ax
je 0x10001839
nop word [eax + eax]
push eax
call fcn.100031fd
mov ecx, dword [ebp - 0x188]
add esp, 4
mov word [esi + ecx*2], ax
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
movzx eax, word [esi + eax*2]
test ax, ax
jne 0x10001810
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push str.avastbrowser
push esi
call edi
test eax, eax
jne 0x10001855
push str.avast
jmp 0x1000192a
push str.avgbrowser
push esi
call edi
test eax, eax
jne 0x1000186b
push 0x10012fe8
jmp 0x1000192a
push str.launchwinapp
push esi
call edi
test eax, eax
jne 0x1000189a
mov eax, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.windows
push 0x10017290
call eax
test eax, eax
je 0x1000192d
push str.edge
jmp 0x1000192a
push str.launcher
push esi
call edi
test eax, eax
jne 0x100018dd
mov eax, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push str.opera
push 0x10017290
call eax
test eax, eax
je 0x100018c2
push str.opera
jmp 0x1000192a
push str.SZBrowser
push 0x10017290
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x1000192d
push str.safezone
jmp 0x1000192a
push str.chrome
push esi
call edi
test eax, eax
je 0x1000192d
push str.iexplore
push esi
call edi
test eax, eax
je 0x1000192d
push str.firefox
push esi
call edi
test eax, eax
je 0x1000192d
push str.safari
push esi
call edi
test eax, eax
je 0x1000192d
push str.secure
push esi
call edi
test eax, eax
je 0x1000192d
push str.ucbrowser
push esi
call edi
test eax, eax
je 0x1000192d
push str.unknown
push esi
call ebx
push esi
push 0x10016a68
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push str.iexplore
push 0x10016a68
call edi
test eax, eax
jne 0x10001990
mov dword [ebp - 0x194], eax
mov edx, str.SOFTWAREMicrosoftInternet_Explorer
lea eax, [ebp - 0x194]
push eax
push str.svcVersion
call fcn.10001340
add esp, 8
test eax, eax
je 0x10001988
lea eax, [ebp - 0x194]
mov edx, str.SOFTWAREMicrosoftInternet_Explorer
push eax
push str.Version
call fcn.10001340
add esp, 8
mov eax, dword [ebp - 0x194]
jmp 0x100019c0
push str.edge
push 0x10016a68
call edi
test eax, eax
jne 0x100019a7
call fcn.10002050
jmp 0x100019c0
push str.chrome
push 0x10016a68
call edi
test eax, eax
jne 0x100019be
call fcn.10001b10
jmp 0x100019c0
xor eax, eax
push str.iexplore
push 0x10016a68
mov dword [0x10016160], eax
call edi
test eax, eax
jne 0x100019f2
call fcn.100026d0
pop edi
pop esi
mov dword [0x10016164], eax
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006338
mov esp, ebp
pop ebp
ret
push str.chrome
push 0x10016a68
call edi
test eax, eax
jne 0x10001a1f
call fcn.10001fe0
pop edi
pop esi
mov dword [0x10016164], eax
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006338
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [0x10016164], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10006338
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 4
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10006338
mov esp, ebp
pop ebp
ret