Function at 0x40525b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa74
mov eax, dword [0x45b070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0xa70], edx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xa6c], eax
mov edi, ecx
mov dword [ebp - 0xa5c], eax
mov dword [ebp - 0xa60], eax
mov dword [ebp - 0xa68], 0x28
mov dword [ebp - 0xa74], 0x208
call fcn.0040b631
mov ecx, edi
mov esi, eax
call fcn.0040b82d
lea ebx, [eax + 0x14]
lea ecx, [ebx + ebx]
call fcn.0040202c
mov dword [ebp - 0xa64], eax
test eax, eax
je 0x40548d
push 0x208
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0x644]
call fcn.0040ba65
cmp esi, 9
je 0x4054d1
cmp esi, 0xffffffff
je 0x4054d1
mov ebx, 0x208
cmp esi, 0xa
jae 0x405321
imul edx, esi, 0x30
lea ecx, [ebp - 0x644]
push ebx
mov edx, dword [edx + 0x434010]
call fcn.0040bab0
push ebx
mov edx, str..exe
lea ecx, [ebp - 0x644]
call fcn.0040bab0
mov edi, dword [ebp - 0xa64]
lea eax, [ebp - 0xa5c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x644]
mov ecx, 0x80000002
call fcn.0040c046
test eax, eax
jne 0x405387
movzx eax, byte [ebp - 0x2c]
xor ecx, ecx
cmp dword [ebp - 0xa58], 1
cmove eax, ecx
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xa58]
push eax
push ecx
push str.UseUrl
push dword [ebp - 0xa5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x405442
cmp esi, 9
je 0x405486
cmp esi, 0xffffffff
je 0x405486
cmp esi, 0xa
jae 0x405486
imul esi, esi, 0x30
cmp dword [esi + 0x43403c], 0
je 0x405486
push ebx
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0xa54]
call fcn.0040ba65
mov edx, dword [esi + 0x43403c]
lea ecx, [ebp - 0xa54]
push ebx
call fcn.0040bab0
push ebx
mov edx, str..exe
lea ecx, [ebp - 0xa54]
call fcn.0040bab0
lea eax, [ebp - 0xa5c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0xa54]
mov ecx, 0x80000002
call fcn.0040c046
test eax, eax
jne 0x405486
movzx eax, byte [ebp - 0x2c]
xor ecx, ecx
cmp dword [ebp - 0xa58], 1
cmove eax, ecx
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xa58]
push eax
push ecx
push str.UseUrl
push dword [ebp - 0xa5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405486
cmp dword [ebp - 0xa58], 1
jne 0x40546d
mov edx, 0x433938
lea ecx, [ebp - 0x2c]
call fcn.0040b955
test eax, eax
jne 0x40547c
mov edx, 0x43393c
lea ecx, [ebp - 0x2c]
call fcn.0040b955
test eax, eax
jne 0x40547c
cmp dword [ebp - 0xa58], 4
jne 0x405486
cmp dword [ebp - 0x2c], 0
je 0x405486
mov dword [ebp - 0xa6c], 1
mov ecx, edi
call fcn.00402061
cmp dword [ebp - 0xa60], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x4054a4
push dword [ebp - 0xa60]
call esi
and dword [ebp - 0xa60], 0
cmp dword [ebp - 0xa5c], 0
je 0x4054bc
push dword [ebp - 0xa5c]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa6c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0042d667
leave
ret
mov edx, edi
mov edi, dword [ebp - 0xa64]
push ebx
mov ecx, edi
call fcn.0040ba65
push ebx
mov edx, str._shell_
mov ecx, edi
call fcn.0040bab0
mov edx, dword [ebp - 0xa70]
mov ecx, edi
push ebx
call fcn.0040bab0
push ebx
mov edx, 0x433924
mov ecx, edi
call fcn.0040bab0
lea eax, [ebp - 0xa60]
mov edx, edi
push eax
push 0x20019
push ecx
mov ecx, Ordinal_1
call fcn.0040c046
test eax, eax
jne 0x405486
movzx eax, byte [ebp - 0x234]
xor ecx, ecx
cmp dword [ebp - 0xa58], 1
cmove eax, ecx
mov byte [ebp - 0x234], al
lea eax, [ebp - 0xa74]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0xa58]
push eax
push ecx
push ecx
push dword [ebp - 0xa60]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405486
mov edx, str..exe
lea ecx, [ebp - 0x234]
call fcn.0040bb85
mov edx, eax
test edx, edx
je 0x405486
xor eax, eax
mov word [edx + 8], ax
jmp 0x4055ba
movzx eax, word [edx - 2]
cmp eax, 0x61
jb 0x40559e
cmp eax, 0x7a
jbe 0x4055b7
cmp eax, 0x41
jb 0x4055a8
cmp eax, 0x5a
jbe 0x4055b7
cmp eax, 0x30
jb 0x4055b2
cmp eax, 0x39
jbe 0x4055b7
cmp eax, 0x5f
jne 0x4055c4
add edx, 0xfffffffe
lea eax, [ebp - 0x234]
cmp edx, eax
ja 0x405590
mov ebx, 0x208
lea ecx, [ebp - 0x644]
push ebx
call fcn.0040bab0
jmp 0x405327