Function at 0x41b540
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x85c
mov eax, dword [0x4ae23c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x83c]
push eax
mov dword [ebp - 0x848], 0x104
mov dword [ebp - 0x850], 0x104
mov dword [ebp - 0x854], 1
mov dword [ebp - 0x85c], 0x104
mov dword [ebp - 0x83c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41b809
mov eax, dword [ebp - 0x838]
cmp eax, 6
jb 0x41b725
jne 0x41b5ba
cmp dword [ebp - 0x834], 0
je 0x41b725
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea ecx, [ebp - 0x84c]
push ecx
push 0
push reloc.WS2_32.dll_accept
call edi
test eax, eax
jne 0x41b809
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edx, [ebp - 0x840]
push edx
push 0xf003f
push eax
mov eax, dword [ebp - 0x84c]
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push eax
call esi
test eax, eax
jne 0x41b711
lea ecx, [ebp - 0x85c]
push ecx
mov ecx, dword [ebp - 0x840]
lea edx, [ebp - 0x518]
push edx
lea eax, [ebp - 0x854]
push eax
push 0
push str.Progid
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41b711
lea edx, [ebp - 0x844]
push edx
push eax
push SysReAllocStringLen
call edi
test eax, eax
jne 0x41b711
push 0x498470
lea eax, [ebp - 0x518]
push 0x104
push eax
call fcn.0046445a
mov eax, dword [ebp - 0x844]
add esp, 0xc
lea ecx, [ebp - 0x840]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x518]
push edx
push eax
call esi
test eax, eax
jne 0x41b711
lea ecx, [ebp - 0x850]
push ecx
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x858]
push eax
mov eax, dword [ebp - 0x840]
push 0
lea ecx, [ebp - 0x848]
push ecx
lea edx, [ebp - 0x720]
push edx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor eax, eax
mov edi, edi
movzx ecx, word [ebp + eax - 0x108]
mov word [ebp + eax - 0x310], cx
add eax, 2
test cx, cx
jne 0x41b6c0
lea ecx, [ebp - 0x310]
push 0x49846c
push ecx
call fcn.004644cf
push eax
push 0x104
push 0x4afe88
call fcn.004643f7
add esp, 0x14
pop edi
mov eax, 0x4afe88
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004615db
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x84c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
jmp 0x41b7f7
lea edx, [ebp - 0x844]
push edx
push 0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x41b7f1
mov ecx, dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push eax
push 0xf003f
push 0
push str.http_shellopencommand
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41b7f1
lea edx, [ebp - 0x850]
push edx
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x858]
push ecx
mov ecx, dword [ebp - 0x840]
push 0
lea edx, [ebp - 0x848]
push edx
lea eax, [ebp - 0x720]
push eax
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor eax, eax
nop
movzx ecx, word [ebp + eax - 0x108]
mov word [ebp + eax - 0x310], cx
add eax, 2
test cx, cx
jne 0x41b7a0
lea edx, [ebp - 0x310]
push 0x49846c
push edx
call fcn.004644cf
push eax
push 0x104
push 0x4afc80
call fcn.004643f7
add esp, 0x14
pop edi
mov eax, 0x4afc80
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004615db
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x844]
push eax
call esi
mov ecx, dword [ebp - 0x840]
push ecx
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004615db
mov esp, ebp
pop ebp
ret