Function at 0x4092a0
Capabilities:
Check os version
Persist via contextmenuhandlers registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42569b
mov eax, dword fs:[0]
push eax
sub esp, 0x960
mov eax, dword [0x434304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x206
xor ebx, ebx
lea ecx, [ebp - 0x626]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x628], ax
call fcn.0041d650
push 0x118
lea edx, [ebp - 0x948]
push ebx
push edx
mov dword [ebp - 0x94c], 0x11c
call fcn.0041d650
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0x18
lea eax, [ebp - 0x94c]
push eax
mov dword [ebp - 0x964], ebx
call esi
cmp eax, ebx
jne 0x409341
lea ecx, [ebp - 0x94c]
push ecx
mov dword [ebp - 0x94c], 0x114
call esi
cmp eax, ebx
jne 0x409341
xor eax, eax
jmp 0x4095e7
cmp dword [ebp - 0x948], 6
jb 0x409353
cmp dword [ebp - 0x944], 1
jae 0x40933a
push 0x1d0
lea edx, [ebp - 0x7f8]
push ebx
mov ecx, 0xe
mov esi, str.SOFTWAREAtherosVistaAddOn
lea edi, [ebp - 0x830]
push edx
mov dword [ebp - 0x958], ebx
mov dword [ebp - 0x968], 4
rep movsd dword es:[edi], dword [esi]
call fcn.0041d650
add esp, 0xc
lea eax, [ebp - 0x960]
push eax
push 0x20019
push ebx
lea ecx, [ebp - 0x830]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4093d9
mov ecx, dword [ebp - 0x960]
lea edx, [ebp - 0x968]
push edx
lea eax, [ebp - 0x958]
push eax
push ebx
push ebx
push str.NOGUI
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4093d9
mov dword [ebp - 0x958], ebx
mov edx, dword [ebp - 0x960]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
cmp dword [ebp - 0x958], ebx
jne 0x40933a
lea esi, [ebp - 0x628]
call fcn.00408e10
test eax, eax
je 0x40933a
push 0x206
lea ecx, [ebp - 0x41e]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x420], ax
call fcn.0041d650
push 0x206
lea eax, [ebp - 0x216]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x218], dx
call fcn.0041d650
add esp, 0x18
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x409495
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.Win7UI.exe
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.00415b25
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x420]
push str.__s____1___2
push edx
call fcn.00415599
add esp, 0x18
lea eax, [ebp - 0x964]
push eax
lea ecx, [ebp - 0x954]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push str.FunctionDiscoveryItemBluetooth_shellexContextMenuHandlersB8453BE8_4D2E_4165_B37D_38EE104BAE84
push 0x80000000
call ebx
test eax, eax
jne 0x40933a
mov edx, dword [ebp - 0x954]
push edx
call edi
lea eax, [ebp - 0x964]
push eax
lea ecx, [ebp - 0x954]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.FunctionDiscoveryItemBluetoothShell
push 0x80000000
call ebx
test eax, eax
jne 0x4095e2
mov esi, dword [ebp - 0x954]
call fcn.00409050
mov edx, dword [0x434f50]
mov eax, dword [edx + 0xc]
mov ecx, 0x434f50
call eax
add eax, 0x10
mov dword [ebp - 0x950], eax
lea ecx, [ebp - 0x628]
push ecx
push str.FunctionDiscoveryItemBluetoothShell_sCommand
lea edi, [ebp - 0x950]
mov dword [ebp - 4], 0
call fcn.0040a030
mov eax, dword [ebp - 0x950]
add esp, 8
cmp dword [eax - 4], 1
jle 0x409561
mov edx, dword [eax - 0xc]
push edx
mov eax, edi
push eax
call fcn.00409d50
mov eax, dword [ebp - 0x950]
lea ecx, [ebp - 0x96c]
push ecx
lea edx, [ebp - 0x95c]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push 0x80000000
call ebx
test eax, eax
jne 0x4095ca
lea eax, [ebp - 0x420]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409591
sub eax, edx
mov edx, dword [ebp - 0x95c]
sar eax, 1
add eax, eax
push eax
lea ecx, [ebp - 0x420]
push ecx
push 1
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x95c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x950]
call fcn.00409d30
mov ecx, dword [ebp - 0x954]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041558a
mov esp, ebp
pop ebp
ret