Function at 0x411280
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x700
push ebx
push esi
push edi
lea edi, [ebp - 0x4c0]
mov ecx, 0x130
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov eax, dword [0x45e034]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, 0xae703a
call fcn.0041ea00
mov dword [ebp - 0xc], 0
push 0x208
call fcn.0041e720
add esp, 4
mov dword [ebp - 0x6fc], eax
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x24], eax
push 0x208
push 0
lea eax, [ebp - 0x234]
push eax
call fcn.00420f80
add esp, 0xc
push 0x208
push 0
lea eax, [ebp - 0x444]
push eax
call fcn.00420f80
add esp, 0xc
push 0x80000001
push str.SOFTWAREClientsMail
push 0x44c3b0
call fcn.004116e0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x411496
mov eax, dword [ebp - 0xc]
push eax
push 0x104
push 0xae51e0
call fcn.00425800
add esp, 0xc
push str.SOFTWAREClientsMail_
push 0x104
lea eax, [ebp - 0x234]
push eax
call fcn.004254c0
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
push 0x104
lea ecx, [ebp - 0x234]
push ecx
call fcn.004254c0
add esp, 0xc
push str._shellopencommand
push 0x104
lea eax, [ebp - 0x234]
push eax
call fcn.004254c0
add esp, 0xc
lea eax, [ebp - 0x234]
mov dword [ebp - 0x450], eax
mov esi, esp
push 0
mov eax, dword [ebp - 0x24]
push eax
push 0x44c3b0
mov ecx, dword [ebp - 0x450]
push ecx
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHRegGetPathW]
cmp esi, esp
call fcn.0041e9d0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x411436
push 0x80000001
lea eax, [ebp - 0x234]
push eax
push 0x44c3b0
call fcn.004116e0
add esp, 0xc
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x45c]
push eax
push 0x44c980
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00425d70
add esp, 0xc
mov dword [ebp - 0x468], eax
lea eax, [ebp - 0x45c]
push eax
push 0x44c980
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00425d70
add esp, 0xc
mov dword [ebp - 0x468], eax
mov eax, dword [ebp - 0x468]
push eax
push 0x104
push 0xae4fd8
call fcn.00425800
add esp, 0xc
jmp 0x411491
cmp dword [ebp - 0x18], 0
je 0x411491
lea eax, [ebp - 0x474]
push eax
push 0x44c980
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00425d70
add esp, 0xc
mov dword [ebp - 0x480], eax
lea eax, [ebp - 0x474]
push eax
push 0x44c980
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00425d70
add esp, 0xc
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x480]
push eax
push 0x104
push 0xae4fd8
call fcn.00425800
add esp, 0xc
jmp 0x411626
push 0x80000002
push str.SOFTWAREClientsMail
push 0x44c3b0
call fcn.004116e0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x411626
mov eax, dword [ebp - 0xc]
push eax
push 0x104
push 0xae51e0
call fcn.00425800
add esp, 0xc
push str.SOFTWAREClientsMail_
push 0x104
lea eax, [ebp - 0x234]
push eax
call fcn.004254c0
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
push 0x104
lea ecx, [ebp - 0x234]
push ecx
call fcn.004254c0
add esp, 0xc
push str._shellopencommand
push 0x104
lea eax, [ebp - 0x234]
push eax
call fcn.004254c0
add esp, 0xc
lea eax, [ebp - 0x234]
mov dword [ebp - 0x450], eax
mov esi, esp
push 0
mov eax, dword [ebp - 0x24]
push eax
push 0x44c3b0
mov ecx, dword [ebp - 0x450]
push ecx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHRegGetPathW]
cmp esi, esp
call fcn.0041e9d0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4115cb
push 0x80000002
lea eax, [ebp - 0x234]
push eax
push 0x44c3b0
call fcn.004116e0
add esp, 0xc
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x48c]
push eax
push 0x44c980
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00425d70
add esp, 0xc
mov dword [ebp - 0x498], eax
lea eax, [ebp - 0x48c]
push eax
push 0x44c980
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00425d70
add esp, 0xc
mov dword [ebp - 0x498], eax
mov eax, dword [ebp - 0x498]
push eax
push 0x104
push 0xae4fd8
call fcn.00425800
add esp, 0xc
jmp 0x411626
cmp dword [ebp - 0x18], 0
je 0x411626
lea eax, [ebp - 0x4a4]
push eax
push 0x44c980
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00425d70
add esp, 0xc
mov dword [ebp - 0x4b0], eax
lea eax, [ebp - 0x4a4]
push eax
push 0x44c980
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00425d70
add esp, 0xc
mov dword [ebp - 0x4b0], eax
mov eax, dword [ebp - 0x4b0]
push eax
push 0x104
push 0xae4fd8
call fcn.00425800
add esp, 0xc
push edx
mov ecx, ebp
push eax
lea edx, [0x411658]
call fcn.0041e970
pop eax
pop edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041ea40
add esp, 0x700
cmp ebp, esp
call fcn.0041e9d0
mov esp, ebp
pop ebp
ret