Function at 0x475baf
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
push 0x3c
mov eax, 0x49aea8
call fcn.00481e05
mov esi, ecx
mov dword [ebp - 0x30], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], ebx
call fcn.0040e3d4
xor ecx, ecx
mov dword [ebp - 4], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x14]
push eax
inc ecx
push ecx
push ebx
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push 0x80000001
mov dword [ebp - 0x1c], ecx
call edi
test eax, eax
jne 0x475d2b
push str.Progid
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], ebx
call fcn.0040de39
lea ecx, [ebp - 0x18]
push ecx
push ebx
lea ecx, [ebp - 0x20]
push ecx
push ebx
mov ecx, eax
call fcn.00404b49
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
lea ecx, [ebp - 0x40]
neg ebx
sbb bl, bl
call fcn.0040e39e
inc bl
je 0x475ed4
mov eax, dword [ebp - 0x18]
inc eax
push eax
call fcn.0047ac3c
lea ecx, [ebp - 0x40]
mov dword [esp], str.Progid
mov edi, eax
call fcn.0040de39
lea ecx, [ebp - 0x18]
push ecx
push edi
lea ecx, [ebp - 0x20]
push ecx
push 0
mov ecx, eax
call fcn.00404b49
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
lea ecx, [ebp - 0x40]
neg ebx
sbb bl, bl
call fcn.0040e39e
inc bl
je 0x475d25
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040de39
push str.IE.HTTP
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], 1
call fcn.0040e311
test al, al
je 0x475cb8
push str.InternetExplorer
lea ecx, [ebp - 0x38]
call fcn.0040de39
mov byte [ebp - 4], 2
jmp 0x475d0a
push str.FirefoxURL
lea ecx, [ebp - 0x2c]
call fcn.0040e311
test al, al
je 0x475cdc
push str.Firefox
lea ecx, [ebp - 0x38]
call fcn.0040de39
mov byte [ebp - 4], 3
jmp 0x475d0a
push str.ChromeHTML
lea ecx, [ebp - 0x2c]
call fcn.0040e311
lea ecx, [ebp - 0x38]
test al, al
je 0x475d00
push str.Chrome
call fcn.0040de39
mov byte [ebp - 4], 4
jmp 0x475d0a
push edi
call fcn.0040de39
mov byte [ebp - 4], 5
lea eax, [ebp - 0x38]
mov ecx, esi
push eax
call fcn.0040e369
lea ecx, [ebp - 0x38]
call fcn.0040e39e
lea ecx, [ebp - 0x2c]
call fcn.0040e39e
push edi
jmp 0x475ece
lea eax, [ebp - 0x14]
push eax
push 1
push ebx
push str.HTTP_shellopencommand
push 0x80000000
call edi
test eax, eax
jne 0x475edd
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], ebx
push eax
push ebx
push ebx
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x475ed4
mov eax, dword [ebp - 0x18]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0047ac3c
pop ecx
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x28], ebx
push eax
push 0
push 0
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x475ecd
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
je 0x475ecd
cmp dword [ebp - 0x24], 1
jl 0x475ecd
push dword [edi]
lea ecx, [ebp - 0x48]
call fcn.0041cb7e
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], 6
push ecx
mov ecx, eax
call fcn.0041d497
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 8
call fcn.0040e39e
push str.iexplore.exe
lea ecx, [ebp - 0x40]
call fcn.0041cb7e
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x38]
call fcn.0041d4c4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 8
mov bl, al
call fcn.0040e39e
lea ecx, [ebp - 0x40]
test bl, bl
je 0x475e28
push str.InternetExplorer
call fcn.0040de39
mov byte [ebp - 4], 0xa
jmp 0x475ea4
push str.firefox.exe
call fcn.0041cb7e
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0xb
push eax
lea ecx, [ebp - 0x38]
call fcn.0041d4c4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 8
mov bl, al
call fcn.0040e39e
lea ecx, [ebp - 0x40]
test bl, bl
je 0x475e67
push str.Firefox
call fcn.0040de39
mov byte [ebp - 4], 0xc
jmp 0x475ea4
push str.chrome.exe
call fcn.0041cb7e
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 0xd
push eax
lea ecx, [ebp - 0x38]
call fcn.0041d4c4
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 8
mov bl, al
call fcn.0040e39e
test bl, bl
je 0x475ebb
push str.Chrome
lea ecx, [ebp - 0x40]
call fcn.0040de39
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
call fcn.0040e369
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 8
call fcn.0040e39e
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x38]
call fcn.0040e39e
mov ebx, dword [ebp - 0x28]
push ebx
call fcn.0047de81
pop ecx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.00481dd3
ret