Function at 0x6227d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x67803e
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x73bb00]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x3b0]
mov dword [ebp - 0x42c], ecx
push eax
call fcn.00626220
lea eax, [ebp - 0x380]
mov dword [ebp - 4], 0
push esi
push eax
call fcn.00626220
lea eax, [ebp - 0x398]
mov byte [ebp - 4], 1
push edi
push eax
call fcn.00626220
add esp, 0x18
mov edi, eax
mov edx, dword [ebp - 0x370]
mov esi, bind
mov ecx, esi
mov byte [ebp - 4], 2
sub ecx, edx
cmp ecx, 1
jb 0x623077
cmp dword [ebp - 0x36c], 7
lea eax, [ebp - 0x380]
push 1
cmova eax, dword [ebp - 0x380]
lea ecx, [ebp - 0x3f8]
push 0x6ec1d8
push edx
push eax
lea eax, [ebp - 0x380]
push eax
push dword [ebp - 0x41c]
call fcn.0061ba50
push edi
lea eax, [ebp - 0x3f8]
mov byte [ebp - 4], 3
push eax
push dword [ebp - 0x41c]
lea ecx, [ebp - 0x368]
call fcn.0061b8a0
mov ecx, dword [ebp - 0x3e4]
mov byte [ebp - 4], 5
cmp ecx, 7
jbe 0x6228fc
mov edx, dword [ebp - 0x3f8]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x6228f2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x62307c
push ecx
push edx
call fcn.00632721
add esp, 8
mov ecx, dword [ebp - 0x384]
mov byte [ebp - 4], 6
cmp ecx, 7
jbe 0x622940
mov edx, dword [ebp - 0x398]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x622936
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x62307c
push ecx
push edx
call fcn.00632721
add esp, 8
mov edx, dword [ebp - 0x370]
xor eax, eax
mov edi, dword [ebp - 0x3a0]
sub esi, edx
mov dword [ebp - 0x388], 0
mov dword [ebp - 0x384], 7
mov word [ebp - 0x398], ax
cmp esi, edi
jb 0x623081
cmp dword [ebp - 0x36c], 7
lea ecx, [ebp - 0x380]
push edi
cmova ecx, dword [ebp - 0x380]
lea eax, [ebp - 0x3b0]
cmp dword [ebp - 0x39c], 7
cmova eax, dword [ebp - 0x3b0]
push eax
push edx
push ecx
lea eax, [ebp - 0x380]
push eax
push dword [ebp - 0x41c]
lea ecx, [ebp - 0x350]
call fcn.0061ba50
lea eax, [ebp - 0x398]
mov byte [ebp - 4], 7
push ebx
push eax
call fcn.00626220
add esp, 8
lea eax, [ebp - 0x414]
mov byte [ebp - 4], 8
push eax
push 0xf003f
push 0
push str.SOFTWAREClasses
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x622a0b
push eax
push str.Error_opening_registry_key
push str.shell_register_extension
call fcn.00626170
add esp, 0xc
xor bl, bl
jmp 0x622ee7
cmp dword [ebp - 0x33c], 7
lea ecx, [ebp - 0x418]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x350]
cmova eax, dword [ebp - 0x350]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push dword [ebp - 0x414]
call ebx
test eax, eax
je 0x622a6e
push eax
push str.Error_creating_registry_key
push str.shell_register_extension
call fcn.00626170
add esp, 0xc
push dword [ebp - 0x414]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor bl, bl
jmp 0x622ee7
mov eax, dword [ebp - 0x358]
cmp dword [ebp - 0x354], 7
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [eax*2 + 2]
push ecx
lea eax, [ebp - 0x368]
cmova eax, dword [ebp - 0x368]
push eax
push 1
push 0
push 0x6ec030
push dword [ebp - 0x418]
call esi
test eax, eax
je 0x622ab9
push eax
push str.Error_setting_registry_value
push str.shell_register_extension
jmp 0x622b30
mov eax, dword [ebp - 0x358]
cmp dword [ebp - 0x354], 7
lea ecx, [eax*2 + 2]
push ecx
lea eax, [ebp - 0x368]
cmova eax, dword [ebp - 0x368]
push eax
push 1
push 0
push str.FriendlyTypeName
push dword [ebp - 0x418]
call esi
test eax, eax
je 0x622afe
push eax
push str.Error_setting_registry_value
push str.shell_register_extension
jmp 0x622b30
push 0
lea eax, [ebp - 0x428]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.DefaultIcon
push dword [ebp - 0x418]
call ebx
test eax, eax
je 0x622b55
push eax
push str.Error_creating_registry_key
push str.register_protocol
call fcn.00626170
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0xc
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x414]
call esi
xor bl, bl
jmp 0x622ee7
lea eax, [ebp - 0x398]
push eax
lea eax, [ebp - 0x3f8]
push 0x6ec19c
push eax
call fcn.0061a900
push 0x6ec194
push eax
lea eax, [ebp - 0x3e0]
mov byte [ebp - 4], 9
push eax
call fcn.0061a890
add esp, 0x18
lea ecx, [ebp - 0x3f8]
mov byte [ebp - 4], 0xb
call fcn.0042a0e0
mov eax, dword [ebp - 0x3d0]
cmp dword [ebp - 0x3cc], 7
lea ecx, [eax*2 + 2]
push ecx
lea eax, [ebp - 0x3e0]
cmova eax, dword [ebp - 0x3e0]
push eax
push 1
push 0
push 0x6ec030
push dword [ebp - 0x428]
call esi
push dword [ebp - 0x428]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
call edi
test esi, esi
je 0x622c07
push esi
push str.Error_setting_registry_value
push str.register_protocol
call fcn.00626170
add esp, 0xc
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x414]
call edi
xor bl, bl
jmp 0x622edc
push 0
lea eax, [ebp - 0x424]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x6ec1a0
push dword [ebp - 0x418]
call ebx
push dword [ebp - 0x418]
mov esi, eax
call edi
test esi, esi
je 0x622c5a
push esi
push str.Error_creating_registry_key
push str.shell_register_extension
call fcn.00626170
add esp, 0xc
push dword [ebp - 0x414]
call edi
xor bl, bl
jmp 0x622edc
lea eax, [ebp - 0x430]
mov dword [ebp - 0x430], 0x228
push eax
lea eax, [ebp - 0x338]
push eax
push 0
push 2
push 0x6ec030
push 0
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, eax
lea eax, [ebp - 0x398]
push eax
lea eax, [ebp - 0x410]
push 0x6ec19c
push eax
call fcn.0061a900
push str.____1_
push eax
lea eax, [ebp - 0x3c8]
mov byte [ebp - 4], 0xc
push eax
call fcn.0061a890
add esp, 0x18
lea ecx, [ebp - 0x410]
mov byte [ebp - 4], 0xe
call fcn.0042a0e0
test esi, esi
mov esi, dword [ebp - 0x3b4]
jne 0x622d1f
cmp esi, 7
lea eax, [ebp - 0x3c8]
lea ecx, [ebp - 0x338]
cmova eax, dword [ebp - 0x3c8]
nop dword [eax + eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x622d16
test dx, dx
je 0x622d12
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x622d16
add ecx, 4
add eax, 4
test dx, dx
jne 0x622cf0
xor eax, eax
jmp 0x622d1b
sbb eax, eax
or eax, 1
test eax, eax
je 0x622d8c
mov eax, dword [ebp - 0x3b8]
cmp esi, 7
lea ecx, [eax*2 + 2]
push ecx
lea eax, [ebp - 0x3c8]
cmova eax, dword [ebp - 0x3c8]
push eax
push 1
push 0
push 0x6ec030
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x424]
mov esi, eax
call edi
test esi, esi
je 0x622d83
push esi
push str.Error_setting_registry_value
push str.shell_register_extension
call fcn.00626170
add esp, 0xc
push dword [ebp - 0x414]
call edi
xor bl, bl
jmp 0x622ed1
mov eax, dword [ebp - 0x42c]
mov byte [eax], 1
cmp dword [ebp - 0x39c], 7
lea ecx, [ebp - 0x420]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
lea eax, [ebp - 0x3b0]
cmova eax, dword [ebp - 0x3b0]
push 0
push eax
push dword [ebp - 0x414]
call ebx
push dword [ebp - 0x414]
mov esi, eax
call edi
test esi, esi
je 0x622de7
push esi
push str.Error_creating_registry_key
push str.shell_register_extension
call fcn.00626170
add esp, 0xc
xor bl, bl
jmp 0x622ed1
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x100
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 2
push 0x6ec030
push 0
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov esi, dword [ebp - 0x33c]
mov ebx, dword [ebp - 0x350]
test eax, eax
jne 0x622e71
cmp esi, 7
lea eax, [ebp - 0x350]
lea ecx, [ebp - 0x110]
cmova eax, ebx
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x622e5e
test dx, dx
je 0x622e5a
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x622e5e
add ecx, 4
add eax, 4
test dx, dx
jne 0x622e38
xor eax, eax
jmp 0x622e63
sbb eax, eax
or eax, 1
test eax, eax
jne 0x622e71
push dword [ebp - 0x420]
call edi
jmp 0x622ecf
mov eax, dword [ebp - 0x340]
cmp esi, 7
lea ecx, [eax*2 + 2]
push ecx
lea eax, [ebp - 0x350]
cmova eax, ebx
push eax
push 1
push 0
push 0x6ec030
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x420]
mov esi, eax
call edi
test esi, esi
je 0x622ec6
push esi
push str.Error_setting_registry_value
push str.shell_register_extension
call fcn.00626170
add esp, 0xc
xor bl, bl
jmp 0x622ed1
mov eax, dword [ebp - 0x42c]
mov byte [eax], 1
mov bl, 1
lea ecx, [ebp - 0x3c8]
call fcn.0042a0e0
lea ecx, [ebp - 0x3e0]
call fcn.0042a0e0
mov ecx, dword [ebp - 0x384]
cmp ecx, 7
jbe 0x622f27
mov edx, dword [ebp - 0x398]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x622f1d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x623086
push ecx
push edx
call fcn.00632721
add esp, 8
mov ecx, dword [ebp - 0x33c]
cmp ecx, 7
jbe 0x622f67
mov edx, dword [ebp - 0x350]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x622f5d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x623086
push ecx
push edx
call fcn.00632721
add esp, 8
mov ecx, dword [ebp - 0x354]
xor eax, eax
mov dword [ebp - 0x340], 0
mov dword [ebp - 0x33c], 7
mov word [ebp - 0x350], ax
cmp ecx, 7
jbe 0x622fc4
mov edx, dword [ebp - 0x368]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x622fba
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x623086
push ecx
push edx
call fcn.00632721
add esp, 8
mov ecx, dword [ebp - 0x36c]
xor eax, eax
mov dword [ebp - 0x358], 0
mov dword [ebp - 0x354], 7
mov word [ebp - 0x368], ax
cmp ecx, 7
jbe 0x62301d
mov edx, dword [ebp - 0x380]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x623013
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x623086
push ecx
push edx
call fcn.00632721
add esp, 8
mov ecx, dword [ebp - 0x39c]
cmp ecx, 7
jbe 0x623059
mov edx, dword [ebp - 0x3b0]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x62304f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x623086
push ecx
push edx
call fcn.00632721
add esp, 8
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0063292f
mov esp, ebp
pop ebp
ret
call fcn.00418610
call fcn.0063f01f
call fcn.00418610
call fcn.0063f01f
int3