Function at 0x417ca0
Capabilities:
Delete registry value

Disassembly:
mov eax, 0x1120
call fcn.004536f0
mov eax, dword [0x49ab20]
xor eax, esp
mov dword [esp + 0x111c], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [esp + 0x1c], str..doc
mov dword [esp + 0x20], str..docx
mov dword [esp + 0x24], str..xls
mov dword [esp + 0x28], str..xlsx
mov dword [esp + 0x14], 1
mov dword [esp + 0x18], 0
mov edi, edi
push 0x800
lea eax, [esp + 0x130]
push 0
push eax
mov dword [esp + 0x1c], 0x800
call fcn.00451660
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + ecx*4 + 0x28]
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x130]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push esi
push SysReAllocString
call edi
test eax, eax
jne 0x41808d
push str.Shell
lea edx, [esp + 0x130]
push edx
call ebx
cmp dword [esp + 0x1134], 0
je 0x417e0a
xor eax, eax
push 0xfe
push eax
lea ecx, [esp + 0x36]
push ecx
mov word [esp + 0x38], ax
call fcn.00451660
add esp, 0xc
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
lea edx, [esp + 0x13c]
push edx
push SysReAllocString
mov dword [esp + 0x28], 0x100
call edi
test eax, eax
jne 0x41808d
push str.Open
lea eax, [esp + 0x30]
push eax
call ebp
test eax, eax
je 0x417e23
push 0x20
push str.Open
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
lea eax, [esp + 0x30]
push eax
push 1
push 0
lea ecx, [esp + 0x13c]
push ecx
push SysReAllocString
call fcn.00417960
add esp, 0x18
test eax, eax
je 0x41808d
jmp 0x417e23
push 1
push 0
lea edx, [esp + 0x134]
push edx
push SysReAllocString
call fcn.00417a90
add esp, 0x10
push str.Opencommand
lea eax, [esp + 0x130]
push eax
call ebx
cmp dword [esp + 0x1134], 0
je 0x417fef
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [esp + 0x936]
push edx
mov word [esp + 0x938], cx
call fcn.00451660
add esp, 0xc
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x930]
push ecx
lea edx, [esp + 0x1c]
push edx
push 0
lea eax, [esp + 0x13c]
push eax
push SysReAllocString
mov dword [esp + 0x28], 0x800
call edi
test eax, eax
jne 0x41808d
lea ecx, [esp + 0x92c]
push 0x47822c
push ecx
call fcn.00453889
add esp, 8
test eax, eax
je 0x417f40
push str..doc
xor edx, edx
push esi
mov word [eax], dx
call ebp
test eax, eax
je 0x417ef4
push str..docx
push esi
call ebp
test eax, eax
je 0x417ef4
push str..xls
push esi
call ebp
test eax, eax
je 0x417ee5
push str..xlsx
push esi
call ebp
test eax, eax
jne 0x417f03
push str.___1_
lea eax, [esp + 0x930]
push eax
jmp 0x417f01
push str.__t__n___1_
lea ecx, [esp + 0x930]
push ecx
call ebx
lea edx, [esp + 0x92c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
add eax, eax
push eax
lea eax, [esp + 0x930]
push eax
push ecx
push 0
lea edx, [esp + 0x13c]
push edx
push SysReAllocString
call fcn.00417960
add esp, 0x18
test eax, eax
je 0x41808d
push 0x800
lea eax, [esp + 0x930]
push 0
push eax
mov dword [esp + 0x1c], 0x800
call fcn.00451660
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x930]
push edx
lea eax, [esp + 0x1c]
push eax
push str.command
lea ecx, [esp + 0x13c]
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x41808d
lea edx, [esp + 0x92c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [esp + 0x14]
add eax, eax
push eax
lea eax, [esp + 0x930]
push eax
push ecx
push str.command
lea edx, [esp + 0x13c]
push edx
push SysReAllocString
call fcn.00417960
add esp, 0x18
test eax, eax
je 0x41808d
push str.command
lea eax, [esp + 0x130]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test eax, eax
jne 0x41808d
jmp 0x418021
push 1
push 0
lea ecx, [esp + 0x134]
push ecx
push SysReAllocString
call fcn.00417a90
push 1
push str.command
lea edx, [esp + 0x144]
push edx
push SysReAllocString
call fcn.00417a90
add esp, 0x20
lea eax, [esp + 0x12c]
push 0x5c
push eax
call fcn.0045231c
add esp, 8
test eax, eax
je 0x41808d
push str.ddeexec
lea edx, [esp + 0x130]
xor ecx, ecx
push edx
mov word [eax], cx
call ebx
cmp dword [esp + 0x1134], 0
je 0x418074
push 0
push 0
push 1
push 0
lea eax, [esp + 0x13c]
push eax
push SysReAllocString
call fcn.00417960
add esp, 0x18
jmp 0x41808d
push 1
push 0
lea ecx, [esp + 0x134]
push ecx
push SysReAllocString
call fcn.00417a90
add esp, 0x10
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, 4
jb 0x417d00
mov ecx, dword [esp + 0x112c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004522e0
add esp, 0x1120
ret 4