Function at 0x410b80
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x613b1d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4d4
push ebx
mov ebx, dword [esp + 0x4e8]
push esi
push edi
xor edi, edi
mov dword [esp + 0x1c], edi
mov dword [ebx], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], edi
mov word [esp + 0x24], di
mov esi, dword [0x6f62f8]
mov dword [esp + 0x4e8], edi
cmp esi, edi
jne 0x410bd0
mov esi, 0x6f62fc
mov eax, 0x6c5124
push ebp
test eax, eax
je 0x410d08
cmp esi, edi
je 0x410d08
mov ecx, str.IDMGCExt.crx
test ecx, ecx
je 0x410d08
push edi
push eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], edi
mov dword [esp + 0x40], edi
mov word [esp + 0x3c], di
call fcn.00402ce0
push esi
lea ecx, [esp + 0x40]
mov byte [esp + 0x4f0], 1
call fcn.0040e5b0
push str.IDMGCExt.crx
lea ecx, [esp + 0x4c]
mov byte [esp + 0x4f0], 2
call fcn.0040e5b0
lea ecx, [esp + 0x24]
mov byte [esp + 0x4ec], 3
call fcn.00401070
mov esi, dword [esp + 0x38]
lea ecx, [esp + 0x48]
call fcn.004023b0
push eax
call fcn.005e519b
add esp, 4
lea ecx, [esp + 0x3c]
mov edi, eax
call fcn.004023b0
push eax
call fcn.005e519b
add esi, edi
lea esi, [eax + esi + 3]
lea ebp, [esi + esi]
push ebp
call fcn.005fdccd
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 0x24], edi
je 0x410cd3
mov ecx, ebp
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [esp + 0x48]
call fcn.004023b0
push eax
lea ecx, [esp + 0x40]
call fcn.004023b0
push eax
lea ecx, [esp + 0x38]
call fcn.004023b0
push eax
mov eax, dword [esp + 0x30]
push esi
push eax
call fcn.005e512b
mov ecx, dword [esp + 0x38]
push ecx
call fcn.005e519b
add esp, 0x18
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x4ec], 2
call fcn.00401070
lea ecx, [esp + 0x3c]
mov byte [esp + 0x4ec], 1
call fcn.00401070
lea ecx, [esp + 0x30]
mov byte [esp + 0x4ec], 0
call fcn.00401070
xor edi, edi
mov edx, dword [0x6f175c]
mov dword [esp + 0x14], edx
push str.ngpampappnmepgilojfohadhhmbhlaek
lea eax, [esp + 0x18]
push str.SOFTWAREGoogleChromeExtensions_s
push eax
mov byte [esp + 0x4f8], 4
call fcn.005fa6fb
mov edx, dword [esp + 0x20]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edx
push reloc.WS2_32.dll_bind
call edi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410ec5
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0xd4]
push eax
push ecx
push 0
push 0
push 0x6c6224
push edx
mov dword [ebx], 1
mov dword [esp + 0x34], 0x410
call ebp
test eax, eax
jne 0x410eb6
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x410d9b
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0xd8]
push eax
call fcn.005e783c
add esp, 8
test eax, eax
jne 0x410eb6
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x54]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push 0x6c621c
push eax
mov dword [esp + 0x34], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x410eb6
mov esi, dword [0x6f618c]
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x410e12
test cl, cl
je 0x410e0e
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x410e12
add eax, 2
add esi, 2
test cl, cl
jne 0x410dea
xor eax, eax
jmp 0x410e17
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410e35
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov dword [esp + 0x24], 1
call ebx
jmp 0x410ecb
mov eax, dword [0x6f175c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov byte [esp + 0x4ec], 5
test eax, eax
jne 0x410e52
lea eax, [esp + 0x28]
lea ecx, [esp + 0x18]
push ecx
push eax
call fcn.00410a10
add esp, 8
test eax, eax
je 0x410ea5
mov esi, dword [esp + 0x18]
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x410e94
test cl, cl
je 0x410e90
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x410e94
add eax, 2
add esi, 2
test cl, cl
jne 0x410e6c
xor eax, eax
jmp 0x410e99
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410ea5
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x18]
mov byte [esp + 0x4ec], 4
call fcn.006018cc
mov eax, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
jmp 0x410ecb
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00446240
test eax, eax
je 0x411043
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x10]
push ecx
push 0x20119
push 0
push edx
push reloc.WS2_32.dll_bind
mov dword [esp + 0x34], 0
call edi
test eax, eax
jne 0x411043
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
lea ecx, [esp + 0xd4]
push eax
push ecx
push 0
push 0
push 0x6c6224
push edx
mov dword [esp + 0x30], 0x410
call ebp
test eax, eax
jne 0x41103c
mov eax, dword [esp + 0x24]
test eax, eax
jne 0x410f39
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0xd8]
push eax
call fcn.005e783c
add esp, 8
test eax, eax
jne 0x41103c
lea ecx, [esp + 0x18]
lea edx, [esp + 0x54]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push 0x6c621c
push eax
mov dword [esp + 0x30], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41103c
mov esi, dword [0x6f618c]
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x410fac
test cl, cl
je 0x410fa8
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x410fac
add eax, 2
add esi, 2
test cl, cl
jne 0x410f88
xor eax, eax
jmp 0x410fb1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x410fbf
mov dword [esp + 0x20], 1
jmp 0x41103c
mov eax, dword [0x6f175c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
mov byte [esp + 0x4ec], 6
test eax, eax
jne 0x410fdc
lea eax, [esp + 0x28]
lea ecx, [esp + 0x1c]
push ecx
push eax
call fcn.00410a10
add esp, 8
test eax, eax
je 0x41102b
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x54]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x41101a
test cl, cl
je 0x411016
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x41101a
add eax, 2
add esi, 2
test cl, cl
jne 0x410ff6
xor eax, eax
jmp 0x41101f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41102b
mov dword [esp + 0x20], 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x4ec], 4
call fcn.006018cc
mov eax, dword [esp + 0x10]
push eax
call ebx
push str.jmolcgpienlcieaajfkkdamlngancncm
lea ecx, [esp + 0x18]
push str.SOFTWAREGoogleChromeExtensions_s
push ecx
call fcn.005fa6fb
mov eax, dword [esp + 0x20]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push eax
push reloc.WS2_32.dll_bind
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop ebp
test eax, eax
jne 0x4110b3
mov ecx, dword [esp + 0xc]
push ecx
call ebx
lea edx, [esp + 0xc]
push edx
push 0xf003f
push 0
push str.SOFTWAREGoogleChromeExtensions
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x4110b3
mov eax, dword [esp + 0xc]
push str.jmolcgpienlcieaajfkkdamlngancncm
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call ebx
call fcn.00446240
test eax, eax
je 0x41110e
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push 0x20119
push 0
push eax
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x41110e
mov ecx, dword [esp + 0xc]
push ecx
call ebx
lea edx, [esp + 0xc]
push edx
push 0xf013f
push 0
push str.SOFTWAREGoogleChromeExtensions
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x41110e
mov eax, dword [esp + 0xc]
push str.jmolcgpienlcieaajfkkdamlngancncm
push eax
call esi
mov ecx, dword [esp + 0xc]
push ecx
call ebx
push str.jeaohhlajejodfjadcponpnjgkiikocn
lea edx, [esp + 0x14]
push str.SOFTWAREGoogleChromeExtensions_s
push edx
call fcn.005fa6fb
mov ecx, dword [esp + 0x1c]
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x411177
mov edx, dword [esp + 0xc]
push edx
call ebx
lea eax, [esp + 0xc]
push eax
push 0xf003f
push 0
push str.SOFTWAREGoogleChromeExtensions
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x411177
mov ecx, dword [esp + 0xc]
push str.jeaohhlajejodfjadcponpnjgkiikocn
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call ebx
call fcn.00446240
test eax, eax
je 0x4111d2
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push 0x20119
push 0
push ecx
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x4111d2
mov edx, dword [esp + 0xc]
push edx
call ebx
lea eax, [esp + 0xc]
push eax
push 0xf013f
push 0
push str.SOFTWAREGoogleChromeExtensions
push reloc.WS2_32.dll_bind
call edi
test eax, eax
jne 0x4111d2
mov ecx, dword [esp + 0xc]
push str.jeaohhlajejodfjadcponpnjgkiikocn
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call ebx
push 0
push 0
push 0
push 0
push 0
push 0x40e5e0
call fcn.00601eca
lea ecx, [esp + 0x10]
mov byte [esp + 0x4e8], 0
call fcn.006018cc
lea ecx, [esp + 0x20]
mov dword [esp + 0x4e8], 0xffffffff
call fcn.00401070
mov ecx, dword [esp + 0x4e0]
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x4e0
ret 4