Function at 0x40db7b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x79c]
sub esp, 0x81c
mov eax, dword [0x431420]
xor eax, ebp
mov dword [ebp + 0x798], eax
push ebx
push esi
push edi
mov dword [ebp - 0x78], 0x808
xor ebx, ebx
xor edi, edi
call fcn.0040d00f
mov esi, 0x20019
test eax, eax
je 0x40dd45
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x40dbcc
xor eax, eax
jmp 0x40de1e
lea eax, [ebp - 0x74]
push eax
push esi
push ebx
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 2
jne 0x40dce1
lea eax, [ebp - 0x74]
push eax
push esi
push ebx
push str.http_shellopencommand
mov edi, SysReAllocString
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40dc4f
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40dc4f
mov eax, dword [ebp - 0x78]
lea eax, [ebp + eax - 0x70]
cmp byte [eax - 1], bl
je 0x40dc2a
mov byte [eax], bl
lea eax, [ebp - 0x70]
push str.chrome.exe
push eax
call fcn.00413aa0
pop ecx
pop ecx
test eax, eax
je 0x40dc4f
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
pop eax
jmp 0x40de1e
lea eax, [ebp - 0x74]
push eax
push esi
push ebx
push str.http_shellopenddeexecApplication
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40dcca
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40dcd1
mov eax, dword [ebp - 0x78]
lea eax, [ebp + eax - 0x70]
cmp byte [eax - 1], bl
je 0x40dc8b
mov byte [eax], bl
lea eax, [ebp - 0x70]
push str.IExplore
push eax
call fcn.00416d80
pop ecx
pop ecx
test eax, eax
jne 0x40dca4
xor edi, edi
inc edi
jmp 0x40dcbf
lea eax, [ebp - 0x70]
push str.Firefox
push eax
call fcn.00416d80
mov edi, eax
neg edi
sbb edi, edi
neg edi
add edi, 2
pop ecx
pop ecx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40dcd3
push 2
pop edi
cmp eax, edi
je 0x40dcd3
mov edi, ebx
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40de1c
cmp eax, ebx
jne 0x40dcd3
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push str.Progid
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40dcd3
mov eax, dword [ebp - 0x78]
lea eax, [ebp + eax - 0x70]
cmp byte [eax - 1], bl
je 0x40dd0f
mov byte [eax], bl
lea eax, [ebp - 0x70]
push str.FirefoxURL
push eax
call fcn.00416d80
pop ecx
pop ecx
test eax, eax
jne 0x40dd28
push 2
pop edi
jmp 0x40dcbf
lea eax, [ebp - 0x70]
push str.IE.HTTP
push eax
call fcn.00416d80
mov edi, eax
neg edi
sbb edi, edi
and edi, 2
inc edi
jmp 0x40dcbd
lea eax, [ebp - 0x74]
push eax
push esi
push ebx
push str.http_shellopencommand
mov edi, SysReAllocString
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40dd9e
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40dd9e
mov eax, dword [ebp - 0x78]
lea eax, [ebp + eax - 0x70]
cmp byte [eax - 1], bl
je 0x40dd86
mov byte [eax], bl
lea eax, [ebp - 0x70]
push str.chrome.exe
push eax
call fcn.00413aa0
pop ecx
pop ecx
test eax, eax
jne 0x40dc3e
lea eax, [ebp - 0x74]
push eax
push esi
push ebx
push str.http_shellopenddeexecApplication
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40de1a
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40de10
mov eax, dword [ebp - 0x78]
lea eax, [ebp + eax - 0x70]
cmp byte [eax - 1], bl
je 0x40ddda
mov byte [eax], bl
lea eax, [ebp - 0x70]
push str.IExplore
push eax
call fcn.00416d80
pop ecx
pop ecx
test eax, eax
jne 0x40ddf3
xor edi, edi
inc edi
jmp 0x40de12
lea eax, [ebp - 0x70]
push str.Firefox
push eax
call fcn.00416d80
mov edi, eax
neg edi
sbb edi, edi
pop ecx
neg edi
pop ecx
add edi, 2
jmp 0x40de12
mov edi, ebx
push dword [ebp - 0x74]
jmp 0x40dcd6
mov edi, ebx
mov eax, edi
mov ecx, dword [ebp + 0x798]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004141fb
add ebp, 0x79c
leave
ret