Function at 0x4034c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x148
mov eax, dword [str.itziy_doc_download]
mov ecx, dword [0x41f988]
mov dword [esp + 8], eax
mov eax, dword [0x41f990]
mov dword [esp + 0xc], ecx
mov cx, word [0x41f994]
push ebx
push esi
push edi
mov dword [esp + 0x20], eax
mov word [esp + 0x24], cx
mov ecx, 7
xor eax, eax
mov edi, 0x453520
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 7
xor eax, eax
mov edi, 0x453500
mov edx, dword [0x41f98c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push 0xf003f
lea ecx, [esp + 0x1c]
mov dword [esp + 0x24], edx
mov dl, byte [0x41f996]
push ebx
push ecx
push closesocket
mov byte [esp + 0x3a], dl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40384b
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
lea eax, [esp + 0x28]
push edx
push eax
push ebx
push ebx
push str.reginfo
push ecx
mov dword [esp + 0x24], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x10]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x40384b
mov eax, dword [esp + 0xc]
lea edi, [esp + 0x28]
or ecx, 0xffffffff
mov byte [esp + eax + 0x28], bl
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x2d
jae 0x40384b
lea edi, [esp + 0x28]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 3
jbe 0x40384b
lea ecx, [esp + 0x28]
push 0x41fa4c
push ecx
call fcn.00416030
add esp, 8
test eax, eax
je 0x40384b
mov cl, byte [esp + 0x28]
xor eax, eax
xor esi, esi
cmp cl, bl
je 0x40360b
lea ecx, [esp + 0x28]
mov dl, byte [ecx]
cmp dl, 0x2c
jne 0x403857
mov byte [eax + 0x453520], bl
xor eax, eax
mov esi, 1
inc ecx
mov dl, byte [ecx]
mov byte [eax + 0x453500], dl
mov dl, byte [ecx + 1]
inc eax
inc ecx
cmp dl, bl
jne 0x4035e1
mov byte [eax + 0x453500], bl
mov eax, 0x453520
test eax, eax
je 0x40384b
mov ecx, 0x453500
test ecx, ecx
je 0x40384b
cmp dword [esp + 0x158], ebx
jne 0x40384b
mov ecx, 0x57e4
xor eax, eax
mov edi, 0x466e40
rep stosd dword es:[edi], eax
mov ecx, 0x4e20
mov edi, 0x4535c0
rep stosd dword es:[edi], eax
or ecx, 0xffffffff
mov edi, str.GET__doc_act.php_version
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
or ecx, 0xffffffff
mov edi, 0x466e40
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x41f454
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, 0x466e40
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.fk
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x466e40
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x453580
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x466e40
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.un
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
or ecx, 0xffffffff
mov edi, 0x466e40
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, 0x453520
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, 0x466e40
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
or ecx, 0xffffffff
mov edi, str.pw
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, 0x466e40
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x453500
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x466e40
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.pccode
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x466e40
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x47d060
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4535c0
mov esi, edi
mov edx, ecx
mov edi, 0x466e40
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x466e40
and ecx, 3
push str.www.itziy.com
rep movsb byte es:[edi], byte [esi]
mov edi, str._HTTP_1.1_r_nUser_Agent:_Mozilla_4.0__compatible__MSIE_8.0__Windows_NT_5.1__Trident_4.0__.NET_CLR_2.0.50727__.NET4.0E__.NET4.0C__r_nHost:_www.itziy.com_r_n_r_n
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, 0x466e40
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00403020
add esp, 0xc
test eax, eax
jne 0x40384b
call fcn.00403870
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret
cmp esi, ebx
jne 0x4035fa
mov byte [eax + 0x453520], dl
jmp 0x403602