Function at 0x413b70
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4b8b20
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x4d437c]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push ebp
push esi
mov eax, dword [0x4d437c]
xor eax, esp
push eax
lea eax, [esp + 0x7c]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push 0x80000001
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413e4e
push str.ProgId
lea ecx, [esp + 0x60]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov dword [esp + 0x84], ebx
cmp dword [esp + 0x74], 0x10
mov eax, dword [esp + 0x60]
jae 0x413bef
lea eax, [esp + 0x60]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x1c]
push ecx
push ebx
lea edx, [esp + 0x28]
push edx
push ebx
push eax
mov eax, dword [esp + 0x2c]
push eax
call esi
test eax, eax
jne 0x413e2e
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.004b76d4
add esp, 4
cmp dword [esp + 0x74], 0x10
mov ebp, eax
mov eax, dword [esp + 0x60]
jae 0x413c2f
lea eax, [esp + 0x60]
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x1c]
push ebp
lea ecx, [esp + 0x28]
push ecx
push 0
push eax
push edx
call esi
test eax, eax
jne 0x413e25
push ebp
lea ecx, [esp + 0x44]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov byte [esp + 0x84], 1
cmp dword [esp + 0x54], 4
mov esi, dword [sym.imp.MSVCP80.dll_bool___cdecl_std::operator_char__struct_std::char_traits_char___class_std::allocator_char___class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const___char_const__]
jb 0x413ca3
push 4
push 0
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x4c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::substr_unsigned_int__unsigned_int_]
push str.Fire
mov byte [esp + 0x88], 2
mov ebx, 1
push eax
mov dword [esp + 0x1c], ebx
call esi
add esp, 8
test al, al
mov byte [esp + 0x13], bl
jne 0x413ca8
mov byte [esp + 0x13], 0
test bl, 1
mov dword [esp + 0x84], 1
je 0x413cc5
lea ecx, [esp + 0x24]
and ebx, 0xfffffffe
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
cmp byte [esp + 0x13], 0
je 0x413cfd
lea ecx, [esp + 0x40]
mov byte [esp + 0x84], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x5c]
mov dword [esp + 0x84], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, 3
jmp 0x413e53
cmp dword [esp + 0x54], 6
jb 0x413d3a
push 6
push 0
lea ecx, [esp + 0x2c]
push ecx
lea ecx, [esp + 0x4c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::substr_unsigned_int__unsigned_int_]
push str.Chrome
mov byte [esp + 0x88], 3
or ebx, 2
push eax
mov dword [esp + 0x1c], ebx
call esi
add esp, 8
test al, al
mov byte [esp + 0x13], 1
jne 0x413d3f
mov byte [esp + 0x13], 0
test bl, 2
mov dword [esp + 0x84], 1
je 0x413d5c
lea ecx, [esp + 0x24]
and ebx, 0xfffffffd
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
cmp byte [esp + 0x13], 0
je 0x413d94
lea ecx, [esp + 0x40]
mov byte [esp + 0x84], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x5c]
mov dword [esp + 0x84], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, 1
jmp 0x413e53
cmp dword [esp + 0x54], 9
jb 0x413dd1
push 9
push 0
lea edx, [esp + 0x2c]
push edx
lea ecx, [esp + 0x4c]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::substr_unsigned_int__unsigned_int_]
push str.MSEdgeHTM
mov byte [esp + 0x88], 4
or ebx, 4
push eax
mov dword [esp + 0x1c], ebx
call esi
add esp, 8
test al, al
mov byte [esp + 0x13], 1
jne 0x413dd6
mov byte [esp + 0x13], 0
test bl, 4
mov dword [esp + 0x84], 1
je 0x413df0
lea ecx, [esp + 0x24]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
lea ecx, [esp + 0x40]
mov byte [esp + 0x84], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
cmp byte [esp + 0x13], 0
je 0x413e25
lea ecx, [esp + 0x5c]
mov dword [esp + 0x84], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, 2
jmp 0x413e53
push ebp
call fcn.004b7ab6
add esp, 4
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x5c]
mov dword [esp + 0x84], 0xffffffff
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov eax, 4
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.004b76e6
add esp, 0x78
ret