Function at 0x404d6a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa74
mov eax, dword [0x43c064]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0xa70], edx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xa6c], eax
mov ebx, ecx
mov dword [ebp - 0xa5c], eax
mov dword [ebp - 0xa60], eax
mov dword [ebp - 0xa68], 0x28
mov dword [ebp - 0xa74], 0x208
call fcn.0040b0d2
mov ecx, ebx
mov esi, eax
call fcn.0040b2d4
lea edi, [eax + 0x14]
lea ecx, [edi + edi]
call fcn.00401e04
mov dword [ebp - 0xa64], eax
test eax, eax
je 0x404f9c
push 0x208
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0x644]
call fcn.0040b4cf
cmp esi, 9
je 0x404fe2
cmp esi, 0xffffffff
je 0x404fe2
mov edi, 0x208
cmp esi, 0xa
jae 0x404e30
imul edx, esi, 0x30
lea ecx, [ebp - 0x644]
push edi
mov edx, dword [edx + 0x41bf10]
call fcn.0040b51a
push edi
mov edx, str..exe
lea ecx, [ebp - 0x644]
call fcn.0040b51a
mov ebx, dword [ebp - 0xa64]
lea eax, [ebp - 0xa5c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x644]
mov ecx, 0x80000002
call fcn.0040bac7
test eax, eax
jne 0x404e96
movzx eax, byte [ebp - 0x2c]
xor ecx, ecx
cmp dword [ebp - 0xa58], 1
cmove eax, ecx
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xa58]
push eax
push ecx
push str.UseUrl
push dword [ebp - 0xa5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x404f51
cmp esi, 9
je 0x404f95
cmp esi, 0xffffffff
je 0x404f95
cmp esi, 0xa
jae 0x404f95
imul esi, esi, 0x30
cmp dword [esi + 0x41bf3c], 0
je 0x404f95
push edi
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0xa54]
call fcn.0040b4cf
mov edx, dword [esi + 0x41bf3c]
lea ecx, [ebp - 0xa54]
push edi
call fcn.0040b51a
push edi
mov edx, str..exe
lea ecx, [ebp - 0xa54]
call fcn.0040b51a
lea eax, [ebp - 0xa5c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0xa54]
mov ecx, 0x80000002
call fcn.0040bac7
test eax, eax
jne 0x404f95
movzx eax, byte [ebp - 0x2c]
xor ecx, ecx
cmp dword [ebp - 0xa58], 1
cmove eax, ecx
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xa58]
push eax
push ecx
push str.UseUrl
push dword [ebp - 0xa5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404f95
cmp dword [ebp - 0xa58], 1
jne 0x404f7c
mov edx, 0x41b7b8
lea ecx, [ebp - 0x2c]
call fcn.0040b3de
test eax, eax
jne 0x404f8b
mov edx, 0x41b7bc
lea ecx, [ebp - 0x2c]
call fcn.0040b3de
test eax, eax
jne 0x404f8b
cmp dword [ebp - 0xa58], 4
jne 0x404f95
cmp dword [ebp - 0x2c], 0
je 0x404f95
mov dword [ebp - 0xa6c], 1
mov ecx, ebx
call fcn.00401e39
cmp dword [ebp - 0xa60], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x404fb3
push dword [ebp - 0xa60]
call esi
and dword [ebp - 0xa60], 0
cmp dword [ebp - 0xa5c], 0
je 0x404fcb
push dword [ebp - 0xa5c]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa6c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00416bd0
mov esp, ebp
pop ebp
ret
mov edx, ebx
mov ebx, dword [ebp - 0xa64]
push edi
mov ecx, ebx
call fcn.0040b4cf
push edi
mov edx, str._shell_
mov ecx, ebx
call fcn.0040b51a
mov edx, dword [ebp - 0xa70]
mov ecx, ebx
push edi
call fcn.0040b51a
push edi
mov edx, 0x41b7a4
mov ecx, ebx
call fcn.0040b51a
lea eax, [ebp - 0xa60]
mov edx, ebx
push eax
push 0x20019
push ecx
mov ecx, Ordinal_1
call fcn.0040bac7
test eax, eax
jne 0x404f95
movzx eax, byte [ebp - 0x234]
xor ecx, ecx
cmp dword [ebp - 0xa58], 1
cmove eax, ecx
mov byte [ebp - 0x234], al
lea eax, [ebp - 0xa74]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0xa58]
push eax
push ecx
push ecx
push dword [ebp - 0xa60]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404f95
mov edx, str..exe
lea ecx, [ebp - 0x234]
call fcn.0040b5f5
mov edx, eax
test edx, edx
je 0x404f95
xor eax, eax
mov word [edx + 8], ax
jmp 0x4050cb
movzx eax, word [edx - 2]
cmp eax, 0x61
jb 0x4050af
cmp eax, 0x7a
jbe 0x4050c8
cmp eax, 0x41
jb 0x4050b9
cmp eax, 0x5a
jbe 0x4050c8
cmp eax, 0x30
jb 0x4050c3
cmp eax, 0x39
jbe 0x4050c8
cmp eax, 0x5f
jne 0x4050d5
add edx, 0xfffffffe
lea eax, [ebp - 0x234]
cmp edx, eax
ja 0x4050a1
mov edi, 0x208
lea ecx, [ebp - 0x644]
push edi
call fcn.0040b51a
jmp 0x404e36