Function at 0x411ad0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4249fe
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x431078]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 4], 0
call fcn.00403eb0
mov ecx, eax
test ecx, ecx
je 0x41222f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x98], eax
push 0xa
push esi
push str.popup_web_
mov dword [ebp - 4], 1
call fcn.0041861d
add esp, 0xc
test eax, eax
jne 0x411d26
add esi, 0x14
jne 0x411b56
xor ecx, ecx
jmp 0x411b6f
mov ecx, esi
lea edx, [ecx + 2]
jmp 0x411b60
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411b60
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x98]
call fcn.00405390
xor esi, esi
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], esi
push eax
push 0x101
push esi
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x411bab
mov esi, dword [ebp - 0xa0]
mov byte [ebp - 4], 1
test eax, eax
je 0x411bc8
test esi, esi
je 0x411bbe
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 4
jmp 0x411ece
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x9c], pe_nt_image_headers32
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0xa8]
push eax
push 0
push str.ProgId
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x411bb3
mov eax, dword [ebp - 0xa8]
cmp eax, 1
je 0x411c09
cmp eax, 2
jne 0x411bb3
mov eax, dword [ebp - 0x9c]
test eax, eax
je 0x411c26
test al, 1
jne 0x411bb3
shr eax, 1
cmp word [ebp + eax*2 - 0x92], 0
je 0x411c2f
jmp 0x411bb3
xor eax, eax
mov word [ebp - 0x90], ax
lea eax, [ebp - 0x90]
push str.ChromeHTML
push eax
call fcn.004181a7
add esp, 8
test eax, eax
je 0x411d11
lea eax, [ebp - 0x90]
push str.ChromeBHTML
push eax
call fcn.004181a7
add esp, 8
test eax, eax
je 0x411d11
lea eax, [ebp - 0x90]
push str.ChromeDHTML
push eax
call fcn.004181a7
add esp, 8
test eax, eax
je 0x411d11
lea eax, [ebp - 0x90]
push str.MSEdgeHTM
push eax
call fcn.004181a7
add esp, 8
test eax, eax
je 0x411cfc
lea eax, [ebp - 0x90]
push str.MSEdgeBHTML
push eax
call fcn.004181a7
add esp, 8
test eax, eax
je 0x411cfc
lea eax, [ebp - 0x90]
push str.MSEdgeDHTML
push eax
call fcn.004181a7
add esp, 8
test eax, eax
je 0x411cfc
lea eax, [ebp - 0x90]
push str.FirefoxURL
push eax
call fcn.004181a7
add esp, 8
test eax, eax
jne 0x411bb3
test esi, esi
je 0x411cf2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 3
jmp 0x411ece
test esi, esi
je 0x411d07
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 2
jmp 0x411ece
test esi, esi
je 0x411d1c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 1
jmp 0x411ece
push 0xd
push esi
push str.popup_chrome_
call fcn.0041861d
add esp, 0xc
test eax, eax
jne 0x411d86
add esi, 0x1a
jne 0x411d58
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x98]
call fcn.00405390
mov esi, 1
jmp 0x411ece
mov ecx, esi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411d60
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x98]
call fcn.00405390
mov esi, 1
jmp 0x411ece
push 0xb
push esi
push str.popup_edge_
call fcn.0041861d
add esp, 0xc
test eax, eax
jne 0x411de6
add esi, 0x16
jne 0x411db8
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x98]
call fcn.00405390
mov esi, 2
jmp 0x411ece
mov ecx, esi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411dc0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x98]
call fcn.00405390
mov esi, 2
jmp 0x411ece
push 0xe
push esi
push str.popup_firefox_
call fcn.0041861d
add esp, 0xc
test eax, eax
jne 0x411e46
add esi, 0x1c
jne 0x411e18
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x98]
call fcn.00405390
mov esi, 3
jmp 0x411ece
mov ecx, esi
lea edx, [ecx + 2]
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411e20
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x98]
call fcn.00405390
mov esi, 3
jmp 0x411ece
push 0x11
push esi
push str.popup_ie_control_
call fcn.0041861d
add esp, 0xc
test eax, eax
jne 0x411ea3
add esi, 0x22
jne 0x411e75
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x98]
call fcn.00405390
mov esi, 4
jmp 0x411ece
mov ecx, esi
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411e80
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x98]
call fcn.00405390
mov esi, 4
jmp 0x411ece
test esi, esi
jne 0x411eab
xor ecx, ecx
jmp 0x411ebf
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411eb0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0x98]
call fcn.00405390
xor esi, esi
call fcn.00403eb0
mov ecx, eax
test ecx, ecx
je 0x412239
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa0], eax
push ebx
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 3
call fcn.004119a0
test al, al
jne 0x411f2c
test ebx, ebx
jne 0x411f07
xor ecx, ecx
jmp 0x411f1f
mov ecx, ebx
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411f10
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0xa0]
call fcn.00405390
push 0x425848
push 0x42672c
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], 4
call fcn.004050f0
call fcn.00403eb0
mov ecx, eax
test ecx, ecx
je 0x412243
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x9c], eax
push ebx
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 5
call fcn.004119a0
test al, al
jne 0x411f9f
test ebx, ebx
jne 0x411f7e
xor ecx, ecx
jmp 0x411f92
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411f83
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [ebp - 0x9c]
call fcn.00405390
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0xa8]
push eax
call fcn.00410070
add esp, 8
push dword [eax]
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 7
push 0x425680
call fcn.004050f0
mov edx, dword [ebp - 0xa8]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x411fef
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x9c]
mov eax, ebx
mov byte [ebp - 4], 4
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x412010
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0xa0]
lea ecx, [ebp - 0x98]
push edi
push 0x426730
call fcn.004050f0
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x98]
push 0x426738
call fcn.004050f0
cmp esi, 1
jne 0x41208e
push 0x425848
push 0x42672c
lea ecx, [ebp - 0x98]
call fcn.004050f0
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xa4]
push 0x426740
push eax
call fcn.00402240
push 0x42672c
push eax
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 8
push eax
call fcn.004118d0
add esp, 0x18
mov byte [ebp - 4], 0xa
jmp 0x4120e1
cmp esi, 2
jne 0x412138
push 0x425848
push 0x42672c
lea ecx, [ebp - 0x98]
call fcn.004050f0
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0xa4]
push str.msedge.exe___app_
push eax
call fcn.00402240
push 0x42672c
push eax
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 0xb
push eax
call fcn.004118d0
add esp, 0x18
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0xa4]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4120fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push dword [ebp - 0x9c]
call fcn.00412250
mov edx, dword [ebp - 0x9c]
add esp, 4
mov byte [ebp - 0x91], al
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4121db
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4121db
cmp esi, 3
jne 0x4121ac
push 0x425848
push 0x42672c
lea ecx, [ebp - 0x98]
call fcn.004050f0
lea ecx, [ebp - 0x9c]
call fcn.00401c80
push dword [ebp - 0x98]
lea eax, [ebp - 0x9c]
mov byte [ebp - 4], 0xe
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push str.firefox.exe__width__d__height__d__new_window___s_
push eax
call fcn.00403ce0
mov esi, dword [ebp - 0x9c]
push esi
call fcn.00412250
mov byte [ebp - 0x91], al
add esp, 0x18
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4121db
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4121db
cmp esi, 4
jne 0x4121c7
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x98]
call fcn.00412710
add esp, 0xc
jmp 0x4121d5
push dword [ebp - 0x98]
call fcn.00412250
add esp, 4
mov byte [ebp - 0x91], al
add edi, 0xfffffff0
mov ecx, ebx
lock xadd dword [edi + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x4121f2
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x98]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x41220d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov al, byte [ebp - 0x91]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041345d
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402f20
push 0x80004005
call fcn.00402f20
push 0x80004005
call fcn.00402f20
int3