Function at 0x404900
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xfa8
mov edx, dword [0x438a9c]
push ebx
push esi
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x7e4]
push eax
push ecx
push 0
push 0
mov esi, 0x7d0
push str.Extensions
push edx
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404947
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xfa8
ret 4
mov ebx, dword [esp + 0xfb8]
or ecx, 0xffffffff
mov edi, ebx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, esi
jb 0x40496a
pop edi
pop esi
pop ebx
add esp, 0xfa8
ret 4
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x10], esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov eax, ecx
mov esi, edi
mov edi, edx
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov ebp, dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
and ecx, 3
push 0x30000000
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x20]
push edx
push eax
call ebp
lea ecx, [esp + 0x18]
push 0x43487c
push ecx
call fcn.0040d090
add esp, 8
test eax, eax
je 0x4049fe
lea edi, [eax + 1]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x43487c
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
call fcn.0040d090
add esp, 8
test eax, eax
jne 0x4049c4
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x434878
push edx
lea esi, [esp + 0x7f0]
mov dword [esp + 0x18], 0
mov edi, ecx
call fcn.0040d970
add esp, 8
test eax, eax
jne 0x404aa9
lea eax, [esp + 0x18]
push edi
push eax
push esi
call fcn.00417c50
add esp, 0xc
test eax, eax
jne 0x404a59
mov al, byte [edi + esi]
cmp al, 0x20
je 0x404bb6
test al, al
je 0x404bb6
push 0x434874
push esi
call fcn.0040d090
lea ecx, [edi + esi]
add esp, 8
cmp ecx, eax
jbe 0x404a92
push 0x434874
push esi
call fcn.0040d090
sub eax, esi
lea edx, [esp + 0x20]
push eax
push edx
push esi
call fcn.00417c50
add esp, 0x14
test eax, eax
je 0x404bb6
push 0x434870
push esi
call fcn.0040d090
mov esi, eax
add esp, 8
test esi, esi
je 0x404aa9
inc esi
jne 0x404a33
push 0x3f
push ebx
call fcn.0040cfd0
add esp, 8
test eax, eax
je 0x404bbe
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x18]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x30000000
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0x1c]
and ecx, 3
mov dword [esp + 0x18], 0x7d0
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
push edx
push eax
call ebp
lea ecx, [esp + 0x18]
push 0x3f
push ecx
call fcn.0040cfd0
lea edx, [esp + 0x20]
push 0x2e
push edx
mov byte [eax], 0
lea esi, [esp + 0x7f8]
call fcn.0040d780
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x404bbe
inc ebx
push 0x43486c
push ebx
call fcn.0040d970
add esp, 8
test eax, eax
jne 0x404bbe
cmp byte [ebx], 0
je 0x404bbe
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
push edi
push ebx
push esi
call fcn.00417c50
add esp, 0xc
test eax, eax
jne 0x404b6c
mov al, byte [edi + esi]
cmp al, 0x20
je 0x404bb6
test al, al
je 0x404bb6
push 0x434874
push esi
call fcn.0040d090
lea ecx, [edi + esi]
add esp, 8
cmp ecx, eax
jbe 0x404b9d
push 0x434874
push esi
call fcn.0040d090
sub eax, esi
push eax
push ebx
push esi
call fcn.00417c50
add esp, 0x14
test eax, eax
je 0x404bb6
push 0x434870
push esi
call fcn.0040d090
mov esi, eax
add esp, 8
test esi, esi
je 0x404bbe
inc esi
je 0x404bbe
jmp 0x404b52
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xfa8
ret 4