Function at 0x41ade4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcf0
xor eax, eax
mov byte [0x678829], al
mov byte [0x678719], al
cmp dword [ebp + 8], 0
jne 0x41ae06
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x41ae0d
mov dword [ebp - 0x10], str.Applications
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 0x10]
push 0x80000000
call sub.ADVAPI32.DLL_RegOpenKeyA
test eax, eax
jne 0x41b0f1
xor eax, eax
mov dword [0x186ff84], eax
jmp 0x41b0c7
cmp dword [ebp + 8], 0
jne 0x41ae65
lea edx, [ebp - 0x110]
push edx
movsx ecx, byte [0x678718]
imul eax, ecx, 0x136
add eax, 0xf480a7
push eax
call fcn.00444310
add esp, 8
test eax, eax
jne 0x41b0c1
jmp 0x41ae89
push dword [ebp + 8]
call fcn.0044438c
pop ecx
push eax
lea edx, [ebp - 0x110]
push edx
push dword [ebp + 8]
call fcn.00444608
add esp, 0xc
test eax, eax
jne 0x41b0c1
lea ecx, [ebp - 0x110]
push ecx
push str._s_shellopencommand
lea eax, [ebp - 0x310]
push eax
call fcn.00447d04
add esp, 0xc
mov dword [ebp - 0x14], 0x106
lea edx, [ebp - 0x14]
push edx
push 0x678723
lea ecx, [ebp - 0x310]
push ecx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueA
test eax, eax
je 0x41af0c
lea eax, [ebp - 0x110]
push eax
push str._s_shelleditcommand
lea edx, [ebp - 0x310]
push edx
call fcn.00447d04
add esp, 0xc
mov dword [ebp - 0x14], 0x106
lea ecx, [ebp - 0x14]
push ecx
push 0x678723
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueA
test eax, eax
je 0x41af0c
mov byte [0x678723], 0
lea edx, [ebp - 0x110]
push edx
push str._s_shellopenddeexec_application
lea ecx, [ebp - 0x310]
push ecx
call fcn.00447d04
add esp, 0xc
mov dword [ebp - 0x14], 0xa
lea eax, [ebp - 0x14]
push eax
push 0x678719
lea edx, [ebp - 0x310]
push edx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueA
test eax, eax
jne 0x41af57
cmp byte [0x678719], 0
jne 0x41b003
mov byte [0x678719], 0
push 0x678723
lea ecx, [ebp - 0x310]
push ecx
call fcn.0044435c
add esp, 8
push 0x5c
lea eax, [ebp - 0x310]
push eax
call fcn.00444491
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41b003
mov edx, dword [ebp - 8]
cmp byte [edx + 1], 0
je 0x41b003
inc dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
jmp 0x41afa3
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
je 0x41afd7
mov edx, dword [ebp - 0xc]
movsx ecx, byte [edx]
cmp ecx, 0x20
je 0x41afd7
mov eax, dword [ebp - 0xc]
movsx edx, byte [eax]
cmp edx, 0x2e
je 0x41afd7
mov ecx, dword [ebp - 0xc]
movsx eax, byte [ecx]
cmp eax, 0x5c
je 0x41afd7
mov edx, dword [ebp - 0xc]
movsx ecx, byte [edx]
cmp ecx, 0x2f
jne 0x41afa0
mov eax, dword [ebp - 0xc]
mov byte [eax], 0
mov edx, dword [ebp - 8]
cmp byte [edx], 0
je 0x41b003
push dword [ebp - 8]
call fcn.0044438c
pop ecx
cmp eax, 8
ja 0x41b003
push dword [ebp - 8]
push 0x678719
call fcn.0044435c
add esp, 8
lea ecx, [ebp - 0x110]
push ecx
push str._s_shellopenddeexec
lea eax, [ebp - 0x310]
push eax
call fcn.00447d04
add esp, 0xc
mov dword [ebp - 0x14], 0x20a
lea edx, [ebp - 0x14]
push edx
push 0x678829
lea ecx, [ebp - 0x310]
push ecx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueA
test eax, eax
jne 0x41b05a
push 0x45b1c3
push 0x678829
call fcn.0044449d
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x41b0ba
lea edx, [ebp - 0x110]
push edx
push str._s_shelleditddeexec
lea ecx, [ebp - 0x310]
push ecx
call fcn.00447d04
add esp, 0xc
mov dword [ebp - 0x14], 0x20a
lea eax, [ebp - 0x14]
push eax
push 0x678829
lea edx, [ebp - 0x310]
push edx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegQueryValueA
test eax, eax
jne 0x41b0b1
push 0x45b1dc
push 0x678829
call fcn.0044449d
add esp, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x41b0c1
mov byte [0x678829], 0
jmp 0x41b0c1
mov edx, dword [ebp - 8]
mov byte [edx + 1], 0x73
inc dword [0x186ff84]
push 0xfa
lea ecx, [ebp - 0x110]
push ecx
push dword [0x186ff84]
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegEnumKeyA
test eax, eax
je 0x41ae32
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov esp, ebp
pop ebp
ret