Function at 0x40ba10
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x492567
mov eax, dword fs:[0]
push eax
sub esp, 0xd14
mov eax, dword [0x66239c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xce0], 0
lea eax, [ebp - 0xce0]
push eax
push 0x20019
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0xce0], 0
jne 0x40ba71
mov al, 1
jmp 0x40bdcb
mov dword [ebp - 0xce4], 0
mov eax, 1
test eax, eax
je 0x40bdbc
mov dword [ebp - 0xcf4], 0x200
mov ecx, dword [ebp - 0xce4]
mov dword [ebp - 0xcf8], ecx
mov edx, dword [ebp - 0xce4]
add edx, 1
mov dword [ebp - 0xce4], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xcf4]
push eax
lea ecx, [ebp - 0xc10]
push ecx
mov edx, dword [ebp - 0xcf8]
push edx
mov eax, dword [ebp - 0xce0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0xcfc], eax
cmp dword [ebp - 0xcfc], 0x103
jne 0x40baee
jmp 0x40bdbc
lea ecx, [ebp - 0xc10]
push ecx
lea ecx, [ebp - 0xc40]
call fcn.00405100
mov dword [ebp - 4], 0
lea edx, [ebp - 0xc10]
push edx
lea eax, [ebp - 0x410]
push eax
call fcn.004716af
add esp, 8
push str._shellopencommand
lea ecx, [ebp - 0x410]
push ecx
call fcn.0047163e
add esp, 8
mov dword [ebp - 0xcdc], 0
lea edx, [ebp - 0xcdc]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [ebp - 0xce0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0xcdc], 0
jne 0x40bb7d
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.00406b20
jmp 0x40ba7b
mov dword [ebp - 0xcec], 1
mov dword [ebp - 0xce8], 0x200
lea edx, [ebp - 0xce8]
push edx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0xcec]
push ecx
push 0
push 0x4946e0
mov edx, dword [ebp - 0xcdc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xcf0], eax
mov eax, dword [ebp - 0xcdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xce8], 0
je 0x40bbe9
cmp dword [ebp - 0xcf0], 0
jne 0x40bbe9
lea ecx, [ebp - 0x810]
test ecx, ecx
jne 0x40bc00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.00406b20
jmp 0x40ba7b
lea edx, [ebp - 0x810]
push edx
lea ecx, [ebp - 0xc58]
call fcn.00405100
mov byte [ebp - 4], 1
lea eax, [ebp - 0xc10]
push eax
lea ecx, [ebp - 0x410]
push ecx
call fcn.004716af
add esp, 8
push str.CapabilitiesURLAssociations
lea edx, [ebp - 0x410]
push edx
call fcn.0047163e
add esp, 8
mov dword [ebp - 0xcdc], 0
lea eax, [ebp - 0xcdc]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x410]
push ecx
mov edx, dword [ebp - 0xce0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0xc28]
call fcn.00405620
mov byte [ebp - 4], 2
cmp dword [ebp - 0xcdc], 0
jne 0x40bc96
push 0x494720
lea ecx, [ebp - 0xc28]
call fcn.00407290
jmp 0x40bce4
lea eax, [ebp - 0xce8]
push eax
lea ecx, [ebp - 0x810]
push ecx
lea edx, [ebp - 0xcec]
push edx
push 0
push 0x494724
mov eax, dword [ebp - 0xcdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xcf0], eax
mov ecx, dword [ebp - 0xcdc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x810]
push edx
lea ecx, [ebp - 0xc28]
call fcn.00407290
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd08], esp
lea eax, [ebp - 0xc28]
push eax
call fcn.00405050
mov dword [ebp - 0xd0c], eax
mov byte [ebp - 4], 3
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd10], esp
lea edx, [ebp - 0xc58]
push edx
call fcn.00405050
mov dword [ebp - 0xd14], eax
mov byte [ebp - 4], 4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xd18], esp
lea eax, [ebp - 0xc40]
push eax
call fcn.00405050
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcd8]
call fcn.00405bc0
mov dword [ebp - 0xd00], eax
mov ecx, dword [ebp - 0xd00]
mov dword [ebp - 0xd04], ecx
mov byte [ebp - 4], 5
mov edx, dword [ebp - 0xd04]
push edx
lea eax, [ebp - 0xd20]
push eax
mov ecx, dword [ebp + 0x10]
call fcn.00404260
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xcd8]
call fcn.00406cb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xc28]
call fcn.00406b20
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc58]
call fcn.00406b20
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc40]
call fcn.00406b20
jmp 0x40ba7b
mov ecx, dword [ebp - 0xce0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046c32a
mov esp, ebp
pop ebp
ret