Function at 0x413490
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
sub esp, 0x924
lea ebp, [esp - 4]
mov eax, dword [0x4a9c04]
xor eax, ebp
mov dword [ebp + 0x924], eax
push 0x20
mov eax, 0x48073b
call fcn.0044fa1b
mov eax, dword [ebp + 0x930]
cmp byte [eax], 0x2e
mov edi, dword [ebp + 0x934]
mov ecx, dword [ebp + 0x938]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x2c], ecx
je 0x4134d8
xor al, al
jmp 0x4137a6
xor ebx, ebx
push eax
cmp byte [ebp + 0x93c], bl
je 0x413781
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
call fcn.00401a1e
push eax
lea eax, [ebp - 0x14]
push str.SoftwareClasses_
push eax
mov dword [ebp - 4], ebx
call fcn.00413452
add esp, 0xc
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 4], 2
cmp ecx, ebx
je 0x41351d
call fcn.00401e2b
mov dword [ebp - 0x28], ebx
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x41352b
call fcn.0040109f
jmp 0x41352d
xor eax, eax
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 0x10], ebx
jne 0x413564
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x4134d1
call fcn.00401e2b
jmp 0x4134d1
cmp dword [ebp - 0x24], 2
mov esi, 0x485d1c
jne 0x4135cc
mov edi, 0x103
push edi
lea eax, [ebp + 0x821]
push ebx
push eax
mov byte [ebp + 0x820], bl
call fcn.0044f370
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x820]
push eax
push ebx
push ebx
push esi
push dword [ebp - 0x10]
mov dword [ebp - 0x20], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x20]
mov byte [ebp + eax + 0x820], bl
cmp byte [ebp + 0x820], bl
je 0x4135cc
push dword [ebp - 0x1c]
lea eax, [ebp + 0x820]
push eax
call fcn.0044f215
pop ecx
pop ecx
test eax, eax
jne 0x41354f
push dword [ebp - 0x1c]
call fcn.0044fc30
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
pop ecx
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push esi
push dword [ebp - 0x10]
call edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
call fcn.00401a1e
push eax
lea eax, [ebp - 0x20]
push str.SoftwareClasses_
push eax
mov byte [ebp - 4], 3
call fcn.00413452
add esp, 0xc
push eax
lea ecx, [ebp - 0x14]
call fcn.00413428
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
je 0x41362d
call fcn.00401e2b
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 2
cmp ecx, ebx
je 0x41363d
call fcn.00401e2b
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x41364b
call fcn.0040109f
jmp 0x41364d
xor eax, eax
lea ecx, [ebp - 0x24]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 0x18], ebx
je 0x41354f
push dword [ebp - 0x2c]
call fcn.0044fc30
pop ecx
inc eax
push eax
push dword [ebp - 0x2c]
push 1
push esi
push dword [ebp - 0x18]
call edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.shellopencommand
push dword [ebp - 0x18]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 0x10], ebx
je 0x41354f
push 0x208
lea eax, [ebp + 0x618]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + 0x618]
push eax
push str.__s_____1_
lea eax, [ebp]
push 0x618
push eax
call fcn.0044f483
lea eax, [ebp]
push eax
call fcn.0044fc30
add esp, 0x14
inc eax
push eax
lea eax, [ebp]
push eax
push 1
push esi
push dword [ebp - 0x10]
call edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.DefaultIcon
push dword [ebp - 0x18]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 0x10], ebx
je 0x41354f
lea eax, [ebp + 0x618]
push eax
push str.__s__0
lea eax, [ebp]
push 0x618
push eax
call fcn.0044f483
lea eax, [ebp]
push eax
call fcn.0044fc30
add esp, 0x14
inc eax
push eax
lea eax, [ebp]
push eax
push 1
push esi
push dword [ebp - 0x10]
call edi
push dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x18]
call esi
mov ecx, dword [ebp - 0x14]
cmp ecx, ebx
je 0x413796
call fcn.00401e2b
jmp 0x413796
mov esi, SysReAllocString
push esi
call fcn.00412ae2
push edi
push esi
call fcn.00412ae2
add esp, 0x10
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x924]
xor ecx, ebp
call fcn.0044f35b
add ebp, 0x928
leave
ret