Function at 0x404fba
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa74
mov eax, dword [0x468080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
mov dword [ebp - 0xa70], edx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xa6c], eax
mov edi, ecx
mov dword [ebp - 0xa5c], eax
mov dword [ebp - 0xa60], eax
mov dword [ebp - 0xa68], 0x28
mov dword [ebp - 0xa74], 0x208
call fcn.0040b7bc
mov ecx, edi
mov esi, eax
call fcn.0040b9b7
lea ebx, [eax + 0x14]
lea eax, [ebx + ebx]
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov dword [ebp - 0xa64], eax
pop ecx
test eax, eax
je 0x4051f0
push 0x208
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0x644]
call fcn.0040bc07
cmp esi, 9
je 0x405234
cmp esi, 0xffffffff
je 0x405234
mov ebx, 0x208
cmp esi, 0xa
jae 0x405083
imul edx, esi, 0x30
lea ecx, [ebp - 0x644]
push ebx
mov edx, dword [edx + 0x43cf60]
call fcn.0040bc56
push ebx
mov edx, str..exe
lea ecx, [ebp - 0x644]
call fcn.0040bc56
mov edi, dword [ebp - 0xa64]
lea eax, [ebp - 0xa5c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x644]
mov ecx, 0x80000002
call fcn.0040c1f1
test eax, eax
jne 0x4050e9
movzx eax, byte [ebp - 0x2c]
xor ecx, ecx
cmp dword [ebp - 0xa58], 1
cmove eax, ecx
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xa58]
push eax
push ecx
push str.UseUrl
push dword [ebp - 0xa5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4051a4
cmp esi, 9
je 0x4051e8
cmp esi, 0xffffffff
je 0x4051e8
cmp esi, 0xa
jae 0x4051e8
imul esi, esi, 0x30
cmp dword [esi + 0x43cf8c], 0
je 0x4051e8
push ebx
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
lea ecx, [ebp - 0xa54]
call fcn.0040bc07
mov edx, dword [esi + 0x43cf8c]
lea ecx, [ebp - 0xa54]
push ebx
call fcn.0040bc56
push ebx
mov edx, str..exe
lea ecx, [ebp - 0xa54]
call fcn.0040bc56
lea eax, [ebp - 0xa5c]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0xa54]
mov ecx, 0x80000002
call fcn.0040c1f1
test eax, eax
jne 0x4051e8
movzx eax, byte [ebp - 0x2c]
xor ecx, ecx
cmp dword [ebp - 0xa58], 1
cmove eax, ecx
mov byte [ebp - 0x2c], al
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xa58]
push eax
push ecx
push str.UseUrl
push dword [ebp - 0xa5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4051e8
cmp dword [ebp - 0xa58], 1
jne 0x4051cf
mov edx, 0x43c880
lea ecx, [ebp - 0x2c]
call fcn.0040ba62
test eax, eax
jne 0x4051de
mov edx, 0x43c884
lea ecx, [ebp - 0x2c]
call fcn.0040ba62
test eax, eax
jne 0x4051de
cmp dword [ebp - 0xa58], 4
jne 0x4051e8
cmp dword [ebp - 0x2c], 0
je 0x4051e8
mov dword [ebp - 0xa6c], 1
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
cmp dword [ebp - 0xa60], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x405207
push dword [ebp - 0xa60]
call esi
and dword [ebp - 0xa60], 0
cmp dword [ebp - 0xa5c], 0
je 0x40521f
push dword [ebp - 0xa5c]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa6c]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004370bb
leave
ret
mov edx, edi
mov edi, dword [ebp - 0xa64]
push ebx
mov ecx, edi
call fcn.0040bc07
push ebx
mov edx, str._shell_
mov ecx, edi
call fcn.0040bc56
mov edx, dword [ebp - 0xa70]
mov ecx, edi
push ebx
call fcn.0040bc56
push ebx
mov edx, 0x43c86c
mov ecx, edi
call fcn.0040bc56
lea eax, [ebp - 0xa60]
mov edx, edi
push eax
push 0x20019
push ecx
mov ecx, Ordinal_1
call fcn.0040c1f1
test eax, eax
jne 0x4051e8
movzx eax, byte [ebp - 0x234]
xor ecx, ecx
cmp dword [ebp - 0xa58], 1
cmove eax, ecx
mov byte [ebp - 0x234], al
lea eax, [ebp - 0xa74]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0xa58]
push eax
push ecx
push ecx
push dword [ebp - 0xa60]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4051e8
mov edx, str..exe
lea ecx, [ebp - 0x234]
call fcn.0040bd36
mov edx, eax
test edx, edx
je 0x4051e8
xor eax, eax
mov word [edx + 8], ax
jmp 0x405328
movzx eax, word [edx - 2]
cmp eax, 0x61
jb 0x405301
cmp eax, 0x7a
jbe 0x40531a
cmp eax, 0x41
jb 0x40530b
cmp eax, 0x5a
jbe 0x40531a
cmp eax, 0x30
jb 0x405315
cmp eax, 0x39
jbe 0x40531a
cmp eax, 0x5f
jne 0x40531f
xor eax, eax
inc eax
jmp 0x405321
xor eax, eax
test eax, eax
je 0x405332
sub edx, 2
lea eax, [ebp - 0x234]
cmp edx, eax
ja 0x4052f3
mov ebx, 0x208
lea ecx, [ebp - 0x644]
push ebx
call fcn.0040bc56
jmp 0x405089