Function at 0x40bd80
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x494f17
mov eax, dword fs:[0]
push eax
sub esp, 0xd14
mov eax, dword [0x75a440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xce0], 0
lea eax, [ebp - 0xce0]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
cmp dword [ebp - 0xce0], 0
jne 0x40bde2
mov al, 1
jmp 0x40c144
mov dword [ebp - 0xce4], 0
mov eax, 1
test eax, eax
je 0x40c135
mov dword [ebp - 0xcf4], 0x200
mov ecx, dword [ebp - 0xce4]
mov dword [ebp - 0xcf8], ecx
mov edx, dword [ebp - 0xce4]
add edx, 1
mov dword [ebp - 0xce4], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xcf4]
push eax
lea ecx, [ebp - 0xc10]
push ecx
mov edx, dword [ebp - 0xcf8]
push edx
mov eax, dword [ebp - 0xce0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0xcfc], eax
cmp dword [ebp - 0xcfc], 0x103
jne 0x40be5f
jmp 0x40c135
lea ecx, [ebp - 0xc10]
push ecx
lea ecx, [ebp - 0xc40]
call fcn.004055b0
mov dword [ebp - 4], 0
lea edx, [ebp - 0xc10]
push edx
lea eax, [ebp - 0x410]
push eax
call fcn.00471861
add esp, 8
push str._shellopencommand
lea ecx, [ebp - 0x410]
push ecx
call fcn.004717f0
add esp, 8
mov dword [ebp - 0xcdc], 0
lea edx, [ebp - 0xcdc]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [ebp - 0xce0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
cmp dword [ebp - 0xcdc], 0
jne 0x40bef0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.00406ed0
nop
jmp 0x40bdec
mov dword [ebp - 0xcec], 1
mov dword [ebp - 0xce8], 0x200
lea edx, [ebp - 0xce8]
push edx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xcec]
push ecx
push 0
push 0x4976f0
mov edx, dword [ebp - 0xcdc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0xcdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [ebp - 0xce8], 0
je 0x40bf5d
cmp dword [ebp - 0xcf0], 0
jne 0x40bf5d
lea ecx, [ebp - 0x810]
test ecx, ecx
jne 0x40bf75
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.00406ed0
nop
jmp 0x40bdec
lea edx, [ebp - 0x810]
push edx
lea ecx, [ebp - 0xc58]
call fcn.004055b0
mov byte [ebp - 4], 1
lea eax, [ebp - 0xc10]
push eax
lea ecx, [ebp - 0x410]
push ecx
call fcn.00471861
add esp, 8
push str.CapabilitiesURLAssociations
lea edx, [ebp - 0x410]
push edx
call fcn.004717f0
add esp, 8
mov dword [ebp - 0xcdc], 0
lea eax, [ebp - 0xcdc]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x410]
push ecx
mov edx, dword [ebp - 0xce0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0xc28]
call fcn.00405a90
mov byte [ebp - 4], 2
cmp dword [ebp - 0xcdc], 0
jne 0x40c00c
push 0x497730
lea ecx, [ebp - 0xc28]
call fcn.00407620
nop
jmp 0x40c05b
lea eax, [ebp - 0xce8]
push eax
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0xcec]
push edx
push 0
push 0x497734
mov eax, dword [ebp - 0xcdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xcf0], eax
mov ecx, dword [ebp - 0xcdc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x810]
push edx
lea ecx, [ebp - 0xc28]
call fcn.00407620
nop
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd08], esp
lea eax, [ebp - 0xc28]
push eax
call fcn.00405500
mov dword [ebp - 0xd0c], eax
mov byte [ebp - 4], 3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd10], esp
lea edx, [ebp - 0xc58]
push edx
call fcn.00405500
mov dword [ebp - 0xd14], eax
mov byte [ebp - 4], 4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd18], esp
lea eax, [ebp - 0xc40]
push eax
call fcn.00405500
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcd8]
call fcn.00405f20
mov dword [ebp - 0xd00], eax
mov ecx, dword [ebp - 0xd00]
mov dword [ebp - 0xd04], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0xd04]
push edx
lea eax, [ebp - 0xd20]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.004047d0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcd8]
call fcn.00407060
nop
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc28]
call fcn.00406ed0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc58]
call fcn.00406ed0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.00406ed0
nop
jmp 0x40bdec
mov ecx, dword [ebp - 0xce0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c358
mov esp, ebp
pop ebp
ret