Function at 0x4600dc
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push 0x898
mov eax, 0x5083af
call fcn.004dead8
mov dword [ebp - 0x8a4], ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
xor edi, edi
mov dword [ebp - 0x890], edi
cmp al, 5
ja 0x46022e
lea eax, [ebp - 0x890]
push eax
push 0x20019
push edi
push str.http_shellopencommand
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
je 0x460131
push 8
pop eax
call fcn.004deb5b
ret
mov esi, 0x410
push esi
lea eax, [ebp - 0x830]
push edi
push eax
call fcn.004de430
add esp, 0xc
lea eax, [ebp - 0x8a0]
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x888]
push eax
push edi
push 0x50ae32
push dword [ebp - 0x890]
mov dword [ebp - 0x888], edi
mov dword [ebp - 0x8a0], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x890]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x888], 1
je 0x460198
cmp dword [ebp - 0x888], 2
jne 0x460128
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0x868]
call fcn.00402650
mov ecx, dword [ebp - 0x868]
push 0x10
pop esi
mov dword [ebp - 4], edi
mov edx, ecx
cmp dword [ebp - 0x854], esi
jae 0x46022a
lea edx, [ebp - 0x868]
mov eax, edx
add eax, dword [ebp - 0x858]
cmp dword [ebp - 0x854], esi
jae 0x4601dc
lea ecx, [ebp - 0x868]
push fcn.004e30ca
push edx
push eax
push ecx
lea eax, [ebp - 0x89c]
push eax
call fcn.004600ad
mov eax, dword [ebp - 0x868]
add esp, 0x14
cmp dword [ebp - 0x854], esi
jae 0x460207
lea eax, [ebp - 0x868]
mov ecx, dword [ebp - 0x8a4]
push eax
call fcn.0045fd1f
mov esi, eax
push edi
lea ecx, [ebp - 0x868]
push 1
call fcn.0040172d
mov eax, esi
jmp 0x46012b
mov eax, ecx
jmp 0x4601c8
lea eax, [ebp - 0x898]
push eax
push 0x20019
push edi
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpsUserChoice
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x898], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x460128
mov esi, 0x410
push esi
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.004de430
add esp, 0xc
lea eax, [ebp - 0x894]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x88c]
push eax
push edi
push str.Progid
push dword [ebp - 0x898]
mov dword [ebp - 0x88c], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x894], esi
call edi
push dword [ebp - 0x898]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea eax, [ebp - 0x420]
push eax
call fcn.004ddcc0
pop ecx
test eax, eax
jne 0x46033f
and dword [ebp - 0x888], eax
lea eax, [ebp - 0x888]
push eax
push 0x20019
push 0
push str.SoftwareClasses.html
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x890], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
and dword [ebp - 0x88c], 0
lea eax, [ebp - 0x894]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x88c]
push eax
push 0
push 0x50ae32
push dword [ebp - 0x898]
mov dword [ebp - 0x894], esi
call edi
push dword [ebp - 0x888]
call ebx
lea eax, [ebp - 0x420]
push eax
call fcn.004ddcc0
pop ecx
test eax, eax
je 0x460128
cmp dword [ebp - 0x88c], 1
je 0x460355
cmp dword [ebp - 0x88c], 2
jne 0x460128
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x84c]
call fcn.00402650
cmp dword [ebp - 0x838], 0x10
mov eax, dword [ebp - 0x84c]
mov dword [ebp - 4], 1
mov edx, eax
jae 0x460387
lea edx, [ebp - 0x84c]
mov eax, edx
add eax, dword [ebp - 0x83c]
cmp dword [ebp - 0x838], 0x10
mov ecx, dword [ebp - 0x84c]
jae 0x4603a2
lea ecx, [ebp - 0x84c]
push fcn.004e30ca
push edx
push eax
push ecx
lea eax, [ebp - 0x8a0]
push eax
call fcn.004600ad
mov eax, dword [ebp - 0x84c]
add esp, 0x14
cmp dword [ebp - 0x838], 0x10
jae 0x4603ce
lea eax, [ebp - 0x84c]
mov ecx, dword [ebp - 0x8a4]
push eax
call fcn.0045fdbf
mov dword [ebp - 0x888], eax
cmp eax, 8
jne 0x46052a
xor eax, eax
cmp dword [ebp - 0x890], eax
jne 0x46052a
lea ecx, [ebp - 0x89c]
push ecx
push 0x20019
push eax
push str.SoftwareClasses.html
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x89c], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
and dword [ebp - 0x88c], 0
lea eax, [ebp - 0x894]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x88c]
push eax
push 0
push 0x50ae32
push dword [ebp - 0x898]
mov dword [ebp - 0x894], esi
call edi
push dword [ebp - 0x89c]
call ebx
lea eax, [ebp - 0x420]
push eax
call fcn.004ddcc0
pop ecx
test eax, eax
jne 0x460477
push eax
push 1
lea ecx, [ebp - 0x84c]
call fcn.0040172d
jmp 0x460128
cmp dword [ebp - 0x88c], 1
je 0x460499
cmp dword [ebp - 0x88c], 2
je 0x460499
push 8
pop esi
push 0
lea ecx, [ebp - 0x84c]
jmp 0x46021c
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x884]
call fcn.00402650
mov ecx, dword [ebp - 0x884]
push 0x10
pop esi
mov byte [ebp - 4], 2
mov edx, ecx
cmp dword [ebp - 0x870], esi
jae 0x460535
lea edx, [ebp - 0x884]
mov eax, edx
add eax, dword [ebp - 0x874]
cmp dword [ebp - 0x870], esi
jae 0x4604de
lea ecx, [ebp - 0x884]
push fcn.004e30ca
push edx
push eax
push ecx
lea eax, [ebp - 0x8a0]
push eax
call fcn.004600ad
mov eax, dword [ebp - 0x884]
add esp, 0x14
cmp dword [ebp - 0x870], esi
jae 0x460509
lea eax, [ebp - 0x884]
mov ecx, dword [ebp - 0x8a4]
push eax
call fcn.0045fdbf
push 0
push 1
lea ecx, [ebp - 0x884]
mov dword [ebp - 0x888], eax
call fcn.0040172d
mov esi, dword [ebp - 0x888]
jmp 0x46048c
mov eax, ecx
jmp 0x4604ca