Function at 0x403840
Capabilities:
Get installed programs
Persist via contextmenuhandlers registry key
Set registry value

Disassembly:
sub esp, 0xd68
mov eax, dword [0x433480]
xor eax, esp
mov dword [esp + 0xd64], eax
push ebx
push ebp
push esi
push edi
push str.IsWow64Process
push 0x427894
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40388b
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
xor eax, eax
cmp dword [esp + 0x14], eax
push 0x435980
setne al
inc eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x44]
push str._sgvim.exe
push eax
call fcn.004054e0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0xc
cmp dword [0x433f94], 0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
je 0x403ba7
push str.Creating__Edit_with_Vim__popup_menu_entry_n
call fcn.00404f30
add esp, 4
mov edx, str._sGvimExt32gvimext.dll
xor ecx, ecx
mov dword [esp + 0x20], ecx
nop word [eax + eax]
test ecx, ecx
mov eax, str._sGvimExt64gvimext.dll
push 0x435980
cmove eax, edx
push eax
lea eax, [esp + 0x14c]
push eax
call fcn.004054e0
push str.51EEE242_AD87_11d3_9C1E_0090278BBD99
lea eax, [esp + 0x35c]
push str.CLSID_s
push eax
call fcn.004054e0
add esp, 0x18
mov dword [esp + 0x18], 0
cmp dword [esp + 0x20], 0
mov eax, 0x100
mov esi, 0x200
cmovne esi, eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x1c]
or esi, 0x20006
push eax
push 0
push esi
push 0
push 0
push 0
lea eax, [esp + 0x368]
push eax
push 0x80000000
call ebp
test eax, eax
jne 0x403cd0
push 0x14
push str.Vim_Shell_Extension
push 1
push eax
push eax
push dword [esp + 0x2c]
call edi
push dword [esp + 0x18]
mov dword [esp + 0x18], eax
call ebx
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x403cd0
push str.51EEE242_AD87_11d3_9C1E_0090278BBD99
lea eax, [esp + 0x350]
push str.CLSID_sInProcServer32
push eax
call fcn.004054e0
add esp, 0xc
mov dword [esp + 0x1c], 0
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push esi
push 0
push 0
push 0
lea eax, [esp + 0x368]
push eax
push 0x80000000
call ebp
test eax, eax
jne 0x403cd0
lea ecx, [esp + 0x144]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4039f0
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x148]
push eax
push 1
push 0
push 0
push dword [esp + 0x30]
call edi
push dword [esp + 0x1c]
mov dword [esp + 0x18], eax
call ebx
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x403cd0
mov dword [esp + 0x10], eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0
push 0
push 0
lea eax, [esp + 0x368]
push eax
push 0x80000000
call ebp
mov edi, eax
test edi, edi
jne 0x403cd0
push 0xa
push str.Apartment
push 1
push eax
push str.ThreadingModel
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
mov edi, eax
call ebx
test edi, edi
jne 0x403cd0
lea eax, [esp + 0x38]
mov dword [esp + 0x10], edi
push eax
lea eax, [esp + 0x14]
push eax
push edi
push esi
push edi
push edi
push edi
push str._shellexContextMenuHandlersgvim
push 0x80000000
call ebp
mov edi, eax
test edi, edi
jne 0x403cd0
push 0x27
push str.51EEE242_AD87_11d3_9C1E_0090278BBD99
push 1
push eax
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
mov edi, eax
call ebx
test edi, edi
jne 0x403cd0
lea eax, [esp + 0x28]
mov dword [esp + 0x1c], edi
push eax
lea eax, [esp + 0x20]
push eax
push edi
push esi
push edi
push edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push 0x80000002
call ebp
mov edi, eax
test edi, edi
jne 0x403cd0
push 0x14
push str.Vim_Shell_Extension
push 1
push eax
push str.51EEE242_AD87_11d3_9C1E_0090278BBD99
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x1c]
mov edi, eax
call ebx
test edi, edi
jne 0x403cd0
lea eax, [esp + 0x2c]
mov dword [esp + 0x18], edi
push eax
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push edi
push edi
push edi
push str.SoftwareVimGvim
push 0x80000002
call ebp
mov esi, eax
test esi, esi
jne 0x403b81
lea ecx, [esp + 0x40]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403b50
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x44]
push eax
push 1
push 0
push str.path
push dword [esp + 0x2c]
call edi
push dword [esp + 0x18]
mov esi, eax
call ebx
jmp 0x403b87
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
jne 0x403cd0
mov ecx, dword [esp + 0x20]
mov edx, str._sGvimExt32gvimext.dll
inc ecx
mov dword [esp + 0x20], ecx
cmp ecx, dword [esp + 0x24]
jl 0x4038f0
cmp dword [0x4347bc], 0
je 0x403d0a
push str.Creating__Open_with_...__list_entry_n
call fcn.00404f30
add esp, 4
xor esi, esi
mov dword [esp + 0x14], esi
nop word [eax + eax]
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x148]
push str.__s_____1_
push eax
call fcn.004054e0
add esp, 0xc
mov dword [esp + 0x20], 0
test esi, esi
mov eax, 0x100
mov ebx, 0x200
cmovne ebx, eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x24]
or ebx, 0x20006
push eax
push 0
push ebx
push 0
push 0
push 0
push str.Applicationsgvim.exe_shelleditcommand
push 0x80000000
call ebp
mov esi, eax
test esi, esi
jne 0x403cd0
lea ecx, [esp + 0x144]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403c40
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x148]
push eax
push 1
push 0
push 0
push dword [esp + 0x34]
call edi
push dword [esp + 0x20]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x403cd0
mov esi, 0x43340c
cmp esi, 0x433418
jge 0x403ceb
lea eax, [esp + 0x28]
mov dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x14]
push eax
push 0
push ebx
push 0
push 0
push 0
push dword [esi]
push 0x80000000
call ebp
mov edi, eax
test edi, edi
jne 0x403cc9
push 1
push 0x42738e
push 1
push eax
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 4
test edi, edi
je 0x403c76
xor eax, eax
mov ecx, dword [esp + 0xd74]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040609c
add esp, 0xd68
ret
mov esi, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc esi
mov dword [esp + 0x14], esi
cmp esi, dword [esp + 0x24]
jl 0x403bd0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Creating_an_uninstall_entry_n
call fcn.00404f30
lea eax, [esp + 0x558]
push str.Vim_9.1
push eax
call fcn.004054e0
cmp dword [0x435a7c], 0
mov ecx, str._suninstall_gui.exe
mov eax, str._suninstall.exe
cmove eax, ecx
push 0x435980
push eax
lea eax, [esp + 0x770]
push eax
call fcn.004054e0
push 0x435980
lea eax, [esp + 0x980]
push str._sgvim.exe_0
push eax
call fcn.004054e0
lea eax, [esp + 0xb90]
push str.9.1.0409
push eax
call fcn.004054e0
add esp, 0x2c
mov dword [esp + 0x20], 0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallVim_9.1
push 0x80000002
call ebp
mov esi, eax
test esi, esi
jne 0x403cd0
lea ecx, [esp + 0x554]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403db8
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x558]
push eax
push 1
push 0
push str.DisplayName
push dword [esp + 0x34]
call edi
push dword [esp + 0x20]
mov esi, eax
call ebx
test esi, esi
jne 0x403cd0
lea eax, [esp + 0x28]
mov dword [esp + 0x10], esi
push eax
lea eax, [esp + 0x14]
push eax
push esi
push 0x20106
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallVim_9.1
push 0x80000002
call ebp
mov esi, eax
test esi, esi
jne 0x403cd0
lea ecx, [esp + 0x75c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403e23
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x760]
push eax
push 1
push 0
push str.UninstallString
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
mov esi, eax
call ebx
test esi, esi
jne 0x403cd0
lea eax, [esp + 0x38]
mov dword [esp + 0x1c], esi
push eax
lea eax, [esp + 0x20]
push eax
push esi
push 0x20106
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallVim_9.1
push 0x80000002
call ebp
mov esi, eax
test esi, esi
jne 0x403cd0
lea ecx, [esp + 0x964]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403e90
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x968]
push eax
push 1
push 0
push str.DisplayIcon
push dword [esp + 0x30]
call edi
push dword [esp + 0x1c]
mov esi, eax
call ebx
test esi, esi
jne 0x403cd0
lea eax, [esp + 0x34]
mov dword [esp + 0x18], esi
push eax
lea eax, [esp + 0x1c]
push eax
push esi
push 0x20106
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallVim_9.1
push 0x80000002
call ebp
mov esi, eax
test esi, esi
jne 0x403cd0
lea ecx, [esp + 0xb6c]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403f00
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0xb70]
push eax
push 1
push 0
push str.DisplayVersion
push dword [esp + 0x2c]
call edi
push dword [esp + 0x18]
mov esi, eax
call ebx
test esi, esi
jne 0x403cd0
lea eax, [esp + 0x30]
mov dword [esp + 0x14], esi
push eax
lea eax, [esp + 0x18]
push eax
push esi
push 0x20106
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallVim_9.1
push 0x80000002
call ebp
mov esi, eax
test esi, esi
jne 0x403f7a
push 0x10
push str.The_Vim_Project
push 1
push eax
push str.Publisher
push dword [esp + 0x28]
call edi
push dword [esp + 0x14]
mov esi, eax
call ebx
xor eax, eax
test esi, esi
sete al
jmp 0x403cd2