Function at 0x12012173
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
mov eax, 0x12087898
call fcn.12055780
sub esp, 0x68
mov eax, dword [0x120b3180]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0xd], bl
mov esi, SysReAllocString
mov edi, str..htm
jne 0x12012231
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push str.InternetShortcut_shellopencommand
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x12012231
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.12073af3
lea eax, [ebp + 0xc]
push ebx
push eax
push ebx
push edi
push esi
mov dword [ebp + 0xc], ebx
call fcn.1200f59a
add esp, 0x14
test eax, eax
je 0x1201221f
cmp dword [ebp + 0xc], ebx
je 0x1201221f
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x1201221f
push 1
push ebx
push ebx
push dword [ebp - 0x14]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jbe 0x1201221f
mov dword [ebp - 0x18], 1
push dword [ebp + 0xc]
call fcn.12074064
cmp dword [ebp - 0x18], ebx
pop ecx
jne 0x1201235b
lea ecx, [ebp - 0x14]
call fcn.120738f5
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
push str.http
call fcn.12012379
add esp, 0xc
test eax, eax
je 0x12012297
lea eax, [ebp - 0x14]
lea ecx, [ebp + 0xc]
push eax
call fcn.120736df
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.12073ef8
push str.netscape
push dword [ebp + 0xc]
call fcn.12055ca0
pop ecx
test eax, eax
pop ecx
jne 0x12012287
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x18], 1
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], bl
call fcn.1207396a
cmp dword [ebp - 0x18], ebx
jne 0x120122f7
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x120122f7
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x40
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push 0x120b7bd0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x120122ee
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x70]
push dword [ebp + 8]
push eax
call fcn.12012379
add esp, 0xc
test eax, eax
je 0x120122ee
mov byte [ebp - 0xd], 1
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
cmp dword [eax - 8], ebx
je 0x1201235b
cmp byte [ebp - 0xd], bl
je 0x1201235b
push 0x44
lea eax, [ebp - 0x74]
pop esi
push esi
push ebx
push eax
call fcn.12055850
add esp, 0xc
lea eax, [ebp - 0x30]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x74], esi
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 1
pop edi
push edi
call fcn.12073d9a
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x12012351
push dword [ebp - 0x30]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2c]
call esi
mov dword [ebp - 0x18], edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.12073de9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1207396a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret