Function at 0x413703
Capabilities:
Check os version
Create process on windows
Get common file path
Get program files directory
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1058]
mov eax, 0x1058
call fcn.00428c50
push 0xffffffffffffffff
push 0x431d2c
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x445bbc]
xor eax, ebp
mov dword [ebp + 0x1054], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov esi, 0x7fe
mov dword [ebp - 4], ebx
push esi
mov word [ebp + 0x854], ax
lea eax, [ebp + 0x856]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ecx, al
shr eax, 8
movzx eax, al
cmp ecx, 6
jne 0x413898
cmp eax, 1
jne 0x413898
lea eax, [ebp - 0x10]
push eax
push 1
push ebx
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x413898
xor eax, eax
push esi
mov word [ebp + 0x54], ax
lea eax, [ebp + 0x56]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x54]
push eax
push ebx
push ebx
push str.Progid
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x400
call edi
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x413898
cmp dword [ebp - 0x14], ebx
je 0x4138e8
lea eax, [ebp + 0x54]
push eax
lea ecx, [ebp + 0x1c]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push str._shellopencommand
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp + 0x38]
push eax
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP90.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___wchar_t_const__]
add esp, 0xc
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 2
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 1
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp dword [ebp + 0x34], 8
mov eax, dword [ebp + 0x20]
jae 0x413846
lea eax, [ebp + 0x20]
lea ecx, [ebp - 0x10]
push ecx
push 1
push ebx
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x413888
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x854]
push eax
push ebx
push ebx
push 0x438bf4
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x400
call edi
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp esi, ebx
je 0x4138e8
lea eax, [ebp - 0x10]
push eax
push 1
push ebx
push str.http_shellopencommand
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x413a7e
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x854]
push eax
push ebx
push ebx
push 0x438bf4
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x400
call edi
push dword [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x413a7e
lea eax, [ebp + 0x854]
push eax
lea ecx, [ebp + 0x38]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 3
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_void_]
mov byte [ebp - 4], 4
cmp dword [ebp + 0x4c], ebx
je 0x413a65
push ebx
push 0x22
lea ecx, [ebp + 0x38]
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t__unsigned_int_const]
mov ecx, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
cmp dword [ecx], eax
je 0x413954
push dword [ecx]
inc eax
push eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp + 0x38]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
push eax
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 5
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push ebx
push 0x22
lea ecx, [ebp + 0x38]
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t__unsigned_int_const]
mov esi, eax
mov eax, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
cmp dword [eax], esi
je 0x4139c3
push dword [eax]
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp + 0x38]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
push eax
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 6
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push esi
push ebx
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp + 0x38]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::substr_unsigned_int__unsigned_int_]
push eax
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 7
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push ebx
push 0x43977c
lea ecx, [ebp + 0x1c]
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t_const___unsigned_int_const]
mov ecx, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::npos]
cmp dword [ecx], eax
je 0x413a00
cmp dword [ebp + 0x1078], 8
mov ecx, dword [ebp + 0x1064]
jae 0x4139f1
lea ecx, [ebp + 0x1064]
push ecx
push 2
push eax
lea ecx, [ebp + 0x1c]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::replace_unsigned_int__unsigned_int__wchar_t_const__]
jmp 0x413a10
lea eax, [ebp + 0x1060]
push eax
lea ecx, [ebp + 0x1c]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
cmp dword [ebp + 0x50], 8
mov eax, dword [ebp + 0x3c]
jae 0x413a1c
lea eax, [ebp + 0x3c]
push eax
call fcn.004196bf
pop ecx
test al, al
je 0x413a65
cmp dword [ebp + 0x34], 8
mov ecx, dword [ebp + 0x20]
jae 0x413a33
lea ecx, [ebp + 0x20]
cmp dword [ebp + 0x50], 8
mov eax, dword [ebp + 0x3c]
jae 0x413a3f
lea eax, [ebp + 0x3c]
push 1
push ebx
push ecx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 3
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp + 0x38]
jmp 0x413b27
lea ecx, [ebp + 0x1c]
mov byte [ebp - 4], 3
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov esi, 0x439790
push esi
lea ecx, [ebp]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov byte [ebp - 4], 8
cmp dword [ebp + 0x1078], 8
mov eax, dword [ebp + 0x1064]
jae 0x413aa6
lea eax, [ebp + 0x1064]
push eax
lea ecx, [ebp]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push esi
lea ecx, [ebp]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
push 0x800
lea eax, [ebp + 0x854]
push ebx
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
push ebx
push 0x26
lea eax, [ebp + 0x854]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x413b24
push 0x40
lea eax, [ebp + 0x854]
push str.Internet_Exploreriexplore.exe
push eax
call dword [sym.imp.MSVCR90.dll_wcsncat]
mov eax, dword [ebp + 4]
add esp, 0xc
cmp dword [ebp + 0x18], 8
jae 0x413b0d
lea eax, [ebp + 4]
push 1
push ebx
push eax
lea eax, [ebp + 0x854]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp]
mov byte [ebp - 4], bl
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x1060]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1054]
xor ecx, ebp
call fcn.0042860c
add ebp, 0x1058
leave
ret