Function at 0x40bed0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x491ae7
mov eax, dword fs:[0]
push eax
sub esp, 0xd14
mov eax, dword [0x9143c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xce0], 0
lea eax, [ebp - 0xce0]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
cmp dword [ebp - 0xce0], 0
jne 0x40bf32
mov al, 1
jmp 0x40c294
mov dword [ebp - 0xce4], 0
mov eax, 1
test eax, eax
je 0x40c285
mov dword [ebp - 0xcf4], 0x200
mov ecx, dword [ebp - 0xce4]
mov dword [ebp - 0xcf8], ecx
mov edx, dword [ebp - 0xce4]
add edx, 1
mov dword [ebp - 0xce4], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xcf4]
push eax
lea ecx, [ebp - 0xc10]
push ecx
mov edx, dword [ebp - 0xcf8]
push edx
mov eax, dword [ebp - 0xce0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0xcfc], eax
cmp dword [ebp - 0xcfc], 0x103
jne 0x40bfaf
jmp 0x40c285
lea ecx, [ebp - 0xc10]
push ecx
lea ecx, [ebp - 0xc40]
call fcn.00405690
mov dword [ebp - 4], 0
lea edx, [ebp - 0xc10]
push edx
lea eax, [ebp - 0x410]
push eax
call fcn.004719ff
add esp, 8
push str._shellopencommand
lea ecx, [ebp - 0x410]
push ecx
call fcn.0047198e
add esp, 8
mov dword [ebp - 0xcdc], 0
lea edx, [ebp - 0xcdc]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [ebp - 0xce0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
cmp dword [ebp - 0xcdc], 0
jne 0x40c040
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.004070e0
nop
jmp 0x40bf3c
mov dword [ebp - 0xcec], 1
mov dword [ebp - 0xce8], 0x200
lea edx, [ebp - 0xce8]
push edx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xcec]
push ecx
push 0
push 0x4936d0
mov edx, dword [ebp - 0xcdc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0xcdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [ebp - 0xce8], 0
je 0x40c0ad
cmp dword [ebp - 0xcf0], 0
jne 0x40c0ad
lea ecx, [ebp - 0x810]
test ecx, ecx
jne 0x40c0c5
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.004070e0
nop
jmp 0x40bf3c
lea edx, [ebp - 0x810]
push edx
lea ecx, [ebp - 0xc58]
call fcn.00405690
mov byte [ebp - 4], 1
lea eax, [ebp - 0xc10]
push eax
lea ecx, [ebp - 0x410]
push ecx
call fcn.004719ff
add esp, 8
push str.CapabilitiesURLAssociations
lea edx, [ebp - 0x410]
push edx
call fcn.0047198e
add esp, 8
mov dword [ebp - 0xcdc], 0
lea eax, [ebp - 0xcdc]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x410]
push ecx
mov edx, dword [ebp - 0xce0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0xc28]
call fcn.00405b70
mov byte [ebp - 4], 2
cmp dword [ebp - 0xcdc], 0
jne 0x40c15c
push 0x493710
lea ecx, [ebp - 0xc28]
call fcn.00407830
nop
jmp 0x40c1ab
lea eax, [ebp - 0xce8]
push eax
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0xcec]
push edx
push 0
push 0x493714
mov eax, dword [ebp - 0xcdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xcf0], eax
mov ecx, dword [ebp - 0xcdc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x810]
push edx
lea ecx, [ebp - 0xc28]
call fcn.00407830
nop
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd08], esp
lea eax, [ebp - 0xc28]
push eax
call fcn.004055e0
mov dword [ebp - 0xd0c], eax
mov byte [ebp - 4], 3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd10], esp
lea edx, [ebp - 0xc58]
push edx
call fcn.004055e0
mov dword [ebp - 0xd14], eax
mov byte [ebp - 4], 4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd18], esp
lea eax, [ebp - 0xc40]
push eax
call fcn.004055e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcd8]
call fcn.00406130
mov dword [ebp - 0xd00], eax
mov ecx, dword [ebp - 0xd00]
mov dword [ebp - 0xd04], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0xd04]
push edx
lea eax, [ebp - 0xd20]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004047d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcd8]
call fcn.00407270
nop
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc28]
call fcn.004070e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc58]
call fcn.004070e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.004070e0
nop
jmp 0x40bf3c
mov ecx, dword [ebp - 0xce0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c5de
mov esp, ebp
pop ebp
ret