Function at 0x4495d0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4cd03d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x234
push ebx
push ebp
push esi
push edi
push 0x206
xor ebp, ebp
lea ecx, [esp + 0x3a]
xor eax, eax
push ebp
push ecx
mov word [esp + 0x40], ax
call fcn.004a30a0
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push 0x20019
push ebp
push str.http_shellopencommand
push bind
mov dword [esp + 0x2c], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x449659
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x38]
push ecx
push ebp
push ebp
push ebp
push edx
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
push ecx
mov edi, 0x4e659c
call fcn.00406720
mov edi, dword [esp + 0x254]
lea edx, [esp + 0x20]
push edx
mov dword [esp + 0x250], ebp
call fcn.00406720
lea eax, [esp + 0x1c]
push eax
mov edi, str.___
mov byte [esp + 0x250], 1
call fcn.00406720
lea ecx, [esp + 0x30]
push ecx
lea edi, [esp + 0x38]
mov byte [esp + 0x250], 2
call fcn.00406720
lea edx, [esp + 0x1c]
push edx
lea ecx, [esp + 0x28]
push ecx
push eax
mov byte [esp + 0x258], 3
call fcn.00406830
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x2c]
push ecx
push eax
mov byte [esp + 0x258], 4
call fcn.00406830
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x30]
push ecx
push eax
mov byte [esp + 0x258], 5
call fcn.00406830
mov byte [esp + 0x24c], 7
mov eax, dword [esp + 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
cmp eax, ebp
je 0x449755
mov esi, eax
add eax, 8
push eax
call edi
cmp eax, ebp
jne 0x449749
cmp esi, ebp
je 0x449749
mov eax, dword [esi]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp eax, ebp
je 0x44972a
push eax
call ebx
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x44973a
push eax
call fcn.0049e96f
add esp, 4
push esi
call fcn.0049e96f
add esp, 4
mov dword [esp + 0x28], ebp
jmp 0x44975b
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esp + 0x28], ebp
jmp 0x44975b
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [esp + 0x24c], 8
mov esi, dword [esp + 0x24]
cmp esi, ebp
je 0x44979f
lea edx, [esi + 8]
push edx
call edi
cmp eax, ebp
jne 0x44979b
cmp esi, ebp
je 0x44979b
mov eax, dword [esi]
cmp eax, ebp
je 0x449782
push eax
call ebx
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x449792
push eax
call fcn.0049e96f
add esp, 4
push esi
call fcn.0049e96f
add esp, 4
mov dword [esp + 0x24], ebp
mov byte [esp + 0x24c], 9
mov esi, dword [esp + 0x30]
cmp esi, ebp
je 0x4497e3
lea eax, [esi + 8]
push eax
call edi
cmp eax, ebp
jne 0x4497df
cmp esi, ebp
je 0x4497df
mov eax, dword [esi]
cmp eax, ebp
je 0x4497c6
push eax
call ebx
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x4497d6
push eax
call fcn.0049e96f
add esp, 4
push esi
call fcn.0049e96f
add esp, 4
mov dword [esp + 0x30], ebp
mov byte [esp + 0x24c], 0xa
mov esi, dword [esp + 0x1c]
cmp esi, ebp
je 0x44981f
lea ecx, [esi + 8]
push ecx
call edi
cmp eax, ebp
jne 0x44981f
mov eax, dword [esi]
cmp eax, ebp
je 0x449806
push eax
call ebx
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x449816
push eax
call fcn.0049e96f
add esp, 4
push esi
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x24c], 0xb
mov esi, dword [esp + 0x20]
cmp esi, ebp
je 0x44985b
lea edx, [esi + 8]
push edx
call edi
cmp eax, ebp
jne 0x44985b
mov eax, dword [esi]
cmp eax, ebp
je 0x449842
push eax
call ebx
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x449852
push eax
call fcn.0049e96f
add esp, 4
push esi
call fcn.0049e96f
add esp, 4
mov byte [esp + 0x24c], 0xc
mov esi, dword [esp + 0x14]
cmp esi, ebp
je 0x449897
lea eax, [esi + 8]
push eax
call edi
cmp eax, ebp
jne 0x449897
mov eax, dword [esi]
cmp eax, ebp
je 0x44987e
push eax
call ebx
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x44988e
push eax
call fcn.0049e96f
add esp, 4
push esi
call fcn.0049e96f
add esp, 4
mov eax, dword [esp + 0x2c]
cmp eax, ebp
je 0x4498a3
mov eax, dword [eax]
jmp 0x4498a5
xor eax, eax
push eax
call fcn.004493c0
mov dword [esp + 0x24c], 0xffffffff
mov esi, dword [esp + 0x2c]
mov bl, al
cmp esi, ebp
je 0x4498f4
lea ecx, [esi + 8]
push ecx
call edi
test eax, eax
jne 0x4498f4
cmp esi, ebp
je 0x4498f4
mov eax, dword [esi]
cmp eax, ebp
je 0x4498db
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x4498eb
push eax
call fcn.0049e96f
add esp, 4
push esi
call fcn.0049e96f
add esp, 4
mov ecx, dword [esp + 0x244]
pop edi
pop esi
pop ebp
mov al, bl
mov dword fs:[0], ecx
pop ebx
add esp, 0x240
ret 4