Function at 0x419ed0
Capabilities:
Check if file exists
Get file attributes
Get file version info
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
mov eax, dword [0x43700c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x328]
push eax
xor ecx, ecx
xor esi, esi
push 0x20019
push ecx
push str.http_shell
push SysReAllocString
inc esi
mov dword [ebp - 0x328], ecx
mov dword [ebp - 0x32c], ecx
call edi
test eax, eax
jne 0x41a183
push ebx
mov ebx, 0xc8
mov dword [ebp - 0x334], esi
push ebx
push eax
lea eax, [ebp - 0xcc]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x330], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0x334]
push eax
push 0
push 0
push dword [ebp - 0x328]
call ebx
xor eax, eax
mov word [ebp - 6], ax
cmp word [ebp - 0xcc], ax
jne 0x419fa7
push 0x6f
pop eax
push 0x70
mov word [ebp - 0xcc], ax
pop eax
push 0x65
mov word [ebp - 0xca], ax
pop eax
mov word [ebp - 0xc8], ax
push 0x6e
pop eax
mov word [ebp - 0xc6], ax
xor eax, eax
mov word [ebp - 0xc4], ax
push str.Command
push 0x64
pop edx
lea ecx, [ebp - 0xcc]
call fcn.0041967c
pop ecx
lea eax, [ebp - 0x32c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0xcc]
push eax
push dword [ebp - 0x328]
call edi
push dword [ebp - 0x328]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push 0x258
lea eax, [ebp - 0x324]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [ebp - 0x32c], 0
je 0x41a03e
lea eax, [ebp - 0x330]
mov dword [ebp - 0x330], 0x258
push eax
lea eax, [ebp - 0x324]
mov dword [ebp - 0x334], esi
push eax
lea eax, [ebp - 0x334]
push eax
push 0
push 0
push dword [ebp - 0x32c]
call ebx
push dword [ebp - 0x32c]
call edi
push 0x22
xor eax, eax
pop ebx
cmp word [ebp - 0x324], bx
sete al
mov edi, eax
movzx ecx, word [ebp + edi*2 - 0x324]
test eax, eax
je 0x41a064
cmp cx, bx
je 0x41a078
mov edx, ecx
jmp 0x41a070
cmp ecx, 0x20
je 0x41a078
mov edx, ecx
cmp ecx, 9
je 0x41a078
test dx, dx
je 0x41a078
inc edi
jmp 0x41a04f
sub edi, eax
lea ecx, [ebp - 0x324]
add edi, edi
lea eax, [ecx + eax*2]
push edi
push eax
mov eax, ecx
push eax
call dword [sym.imp.VCRUNTIME140.dll_memmove]
add esp, 0xc
cmp edi, 0x258
jae 0x41a193
xor eax, eax
mov word [ebp + edi - 0x324], ax
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x324]
push eax
cmove esi, ecx
call edi
pop ecx
cmp eax, 0xc
jb 0x41a182
lea eax, [ebp - 0x324]
push str.iexplore.exe
push eax
call edi
pop ecx
lea eax, [ebp + eax*2 - 0x33c]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x41a182
push 3
pop esi
push eax
lea eax, [ebp - 0x324]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov ebx, eax
test ebx, ebx
je 0x41a182
push ebx
call fcn.0042246a
pop ecx
mov edi, eax
lea eax, [ebp - 0x324]
push edi
push ebx
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x41a177
lea eax, [ebp - 0x33c]
mov dword [ebp - 0x338], ebx
push eax
lea eax, [ebp - 0x338]
mov dword [ebp - 0x33c], ebx
push eax
push 0x42b7b4
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x41a177
mov eax, dword [ebp - 0x338]
push 2
pop ecx
mov eax, dword [eax + 8]
and eax, 0xffff0000
cmp eax, 0x60000
cmovbe esi, ecx
test edi, edi
je 0x41a182
push edi
call fcn.004224a3
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004221ab
leave
ret
call fcn.004225c9
int3