Function at 0x406772
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xdb8
mov eax, 0x42f59a
call fcn.0042ed1b
mov dword [ebp - 0xd7c], edx
mov esi, ecx
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0xdb0], ebx
mov dword [ebp - 0xda0], edi
mov byte [ebp - 0xd4a], cl
mov dword [ebp - 0xd70], ecx
mov byte [ebp - 0xd49], cl
mov byte [ebp - 0xd4b], cl
mov byte [ebp - 0xd68], cl
mov dword [ebp - 0xd58], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xdb8], ecx
mov dword [ebp - 0xdb4], ecx
mov dword [ebp - 0xd5c], ecx
mov dword [ebp - 0xd54], ecx
mov dword [ebp - 0xd64], ecx
mov dword [ebp - 0xd60], ecx
mov dword [ebp - 0xd84], ecx
mov dword [ebp - 0xd88], ecx
mov dword [ebp - 0xd80], ecx
mov dword [ebp - 0xd98], ecx
mov byte [ebp - 4], 0xa
xor eax, eax
mov word [ebp - 0x4c], ax
mov edx, 0x851
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x20]
push eax
push str.Start_Verb_Registration:
push ecx
mov dword [ebp - 0xd8c], ecx
mov dword [ebp - 0xdbc], ecx
mov dword [ebp - 0xdac], ecx
mov ecx, 0x170b011
push 0x64
mov dword [ebp - 0xda4], 0x28
mov dword [ebp - 0xdc4], 0x208
mov dword [ebp - 0x20], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov dword [ebp - 0x1c], str.Param
mov dword [ebp - 0x18], ebx
call main
mov edx, str.print
mov ecx, ebx
call fcn.0040b9a2
test eax, eax
mov dword [ebp - 0xd90], eax
lea eax, [ebp - 0xd94]
mov edx, str.shell
push eax
lea eax, [ebp - 0xd84]
sete byte [ebp - 0xd6c]
push eax
sub esp, 0x14
mov ecx, esi
call main
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
test eax, eax
jne 0x40719f
mov ecx, dword [ebp - 0xd84]
lea eax, [ebp - 0xd94]
push eax
lea eax, [ebp - 0xd58]
mov edx, ebx
push eax
sub esp, 0x14
call main
test eax, eax
jne 0x40719f
mov ecx, dword [ebp - 0xd58]
lea eax, [ebp - 0xd94]
push eax
lea eax, [ebp - 0xd64]
mov edx, str.command
push eax
sub esp, 0x14
call main
test eax, eax
jne 0x40719f
mov ecx, dword [ebp - 0xd64]
lea eax, [ebp - 0xd8c]
push eax
lea eax, [ebp - 0xdac]
xor edx, edx
push eax
call main
test eax, eax
je 0x407190
mov edi, dword [ebp - 0xdac]
test edi, edi
je 0x406931
mov edx, str.msohtmed.exe
mov ecx, edi
call main
xor ecx, ecx
jmp 0x406935
xor ecx, ecx
mov eax, ecx
test eax, eax
je 0x406b5f
mov bl, cl
mov dword [ebp - 0xd8c], ecx
mov dword [ebp - 0xda8], ecx
mov dword [ebp - 0xd50], ecx
mov dword [ebp - 0xd74], ecx
mov ecx, edi
call fcn.00405c5d
mov edi, eax
lea ecx, [ebp - 0xd48]
push 2
mov dword [ebp - 0xd9c], edi
call main
test eax, eax
je 0x406acd
lea edx, [ebp - 0xd48]
mov ecx, edi
call fcn.0040b9a2
test eax, eax
jne 0x406ac8
lea eax, [ebp - 0xd8c]
mov edi, 0x20019
push eax
push edi
push ecx
mov edx, 0x434390
mov ecx, Ordinal_1
call main
test eax, eax
jne 0x406acd
lea eax, [ebp - 0xda8]
mov edx, str.42042206_2D85_11D3_8CFF_005004838597
push eax
push edi
push ecx
mov ecx, dword [ebp - 0xd8c]
call main
test eax, eax
jne 0x406acd
lea eax, [ebp - 0xd50]
mov edx, str.Version
push eax
push edi
push ecx
mov ecx, dword [ebp - 0xda8]
call main
test eax, eax
jne 0x406acd
xor edi, edi
xor edx, edx
jmp 0x406aad
cmp dword [ebp - 0xd74], 0
je 0x406a11
push dword [ebp - 0xd74]
call esi
and dword [ebp - 0xd74], 0
lea eax, [ebp - 0xd74]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd50]
lea edx, [ebp - 0x24]
call main
test eax, eax
jne 0x406aaa
movzx eax, byte [ebp - 0x528]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0xdc0], 0x208
inc edx
cmp dword [ebp - 0xd78], edx
cmove eax, ecx
mov byte [ebp - 0x528], al
lea eax, [ebp - 0xdc0]
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0xd78]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd74]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x406aaa
mov ecx, dword [ebp - 0xd9c]
lea edx, [ebp - 0x528]
call fcn.0040b9a2
test eax, eax
je 0x406aaa
push 0xa
pop edx
lea ecx, [ebp - 0x24]
call main
cmp eax, 0x10
jae 0x406ac8
inc edi
mov edx, edi
mov ecx, dword [ebp - 0xd50]
lea eax, [ebp - 0x24]
push 0xa
push eax
call main
test eax, eax
je 0x406a00
jmp 0x406acd
xor eax, eax
lea ebx, [eax + 1]
xor ecx, ecx
mov al, bl
inc ecx
xor al, cl
xor ecx, ecx
mov byte [ebp - 0xd4a], al
test bl, bl
mov eax, dword [ebp - 0xd6c]
movzx eax, al
cmove ecx, eax
cmp dword [ebp - 0xd74], 0
mov bl, cl
mov dword [ebp - 0xd6c], ebx
je 0x406b03
push dword [ebp - 0xd74]
call esi
xor edi, edi
mov dword [ebp - 0xd74], edi
cmp dword [ebp - 0xd50], edi
je 0x406b1b
push dword [ebp - 0xd50]
call esi
mov dword [ebp - 0xd50], edi
cmp dword [ebp - 0xda8], edi
je 0x406b31
push dword [ebp - 0xda8]
call esi
mov dword [ebp - 0xda8], edi
cmp dword [ebp - 0xd8c], edi
je 0x406b59
push dword [ebp - 0xd8c]
call esi
mov dword [ebp - 0xd6c], ebx
mov bl, byte [ebp - 0xd4a]
mov byte [ebp - 0xd4a], bl
mov edi, dword [ebp - 0xdac]
xor ebx, ebx
cmp word [edi], bx
je 0x406b91
mov edx, str.fpxpress.exe
mov ecx, edi
call main
test eax, eax
jne 0x406b91
mov edx, str.winword.exe
mov ecx, edi
call main
test eax, eax
je 0x406b9a
xor eax, eax
inc eax
mov byte [ebp - 0xd4a], al
jmp 0x406bb4
xor eax, eax
inc eax
mov byte [ebp - 0xd4a], al
cmp dword [ebp + 0x10], ebx
je 0x406bb4
cmp dword [ebp - 0xd90], ebx
jne 0x406bb4
mov edi, str.SharePointDesigner.Editor.Document
cmp dword [ebp - 0xd7c], ebx
je 0x406bb9
mov edi, str.Word.Document
push 0x104
mov edx, edi
lea ecx, [ebp - 0x730]
call main
push 0x104
mov edx, 0x432860
lea ecx, [ebp - 0x730]
call main
xor eax, eax
lea edx, [ebp - 0x730]
mov dword [ebp - 0xd50], eax
lea eax, [ebp - 0xd50]
push eax
push 0x20019
push ecx
mov ecx, Ordinal_1
call main
test eax, eax
jne 0x406ce2
movzx eax, byte [ebp - 0x118]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0xd9c], 0xc8
inc edx
cmp dword [ebp - 0xd78], edx
cmove eax, ecx
mov byte [ebp - 0x118], al
lea eax, [ebp - 0xd9c]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0xd78]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd50]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x406ce2
lea ecx, [ebp - 0x118]
push 0x64
cmp dword [ebp - 0xd90], eax
je 0x406c89
mov edx, str._shell_
call main
mov edx, dword [ebp - 0xdb0]
lea ecx, [ebp - 0x118]
push 0x64
jmp 0x406c8e
mov edx, str._shellopen
call main
cmp dword [ebp - 0xd60], 0
je 0x406ca4
push dword [ebp - 0xd60]
call esi
xor eax, eax
lea edx, [ebp - 0x118]
mov dword [ebp - 0xd60], eax
lea eax, [ebp - 0xd60]
push eax
push 0x20019
push ecx
mov ecx, Ordinal_1
call main
mov ecx, dword [ebp - 0xd68]
test eax, eax
push 1
movzx ecx, cl
pop eax
cmove ecx, eax
mov dword [ebp - 0xd68], ecx
jmp 0x406ce8
mov ecx, dword [ebp - 0xd68]
test cl, cl
jne 0x406d0b
test ebx, ebx
jne 0x406d0b
mov eax, str.SharePointDesigner.Editor.Document
cmp edi, eax
jne 0x406d00
mov edi, str.Word.Document
jmp 0x406d0b
cmp dword [ebp - 0xd7c], 0
jne 0x406d30
mov edi, eax
cmp dword [ebp - 0xd50], 0
je 0x406d1c
push dword [ebp - 0xd50]
call esi
xor eax, eax
inc ebx
mov dword [ebp - 0xd50], eax
cmp ebx, 2
jb 0x406bb9
jmp 0x406d41
cmp dword [ebp - 0xd50], 0
je 0x406d41
push dword [ebp - 0xd50]
call esi
push dword [ebp - 0xd7c]
lea edx, [ebp - 0xd80]
lea ecx, [ebp - 0xd88]
call main
mov ebx, dword [ebp - 0xd6c]
test bl, bl
je 0x406e58
cmp byte [ebp - 0xd4a], 0
mov edi, dword [ebp - 0xdb0]
je 0x406e47
xor eax, eax
mov edx, edi
mov dword [ebp - 0xd68], eax
lea eax, [ebp - 0xd68]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd88]
call main
test eax, eax
jne 0x406e36
mov dword [ebp - 0xd6c], eax
mov edx, 0x433a90
lea eax, [ebp - 0xd6c]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd68]
call main
test eax, eax
jne 0x406e25
movzx eax, byte [ebp - 0xb40]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0xd9c], 0x410
inc edx
cmp dword [ebp - 0xd78], edx
cmove eax, ecx
mov byte [ebp - 0xb40], al
lea eax, [ebp - 0xd9c]
push eax
lea eax, [ebp - 0xb40]
push eax
lea eax, [ebp - 0xd78]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd6c]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x406e25
cmp word [ebp - 0xb40], ax
movzx ebx, bl
cmovne ebx, eax
cmp dword [ebp - 0xd6c], 0
je 0x406e36
push dword [ebp - 0xd6c]
call esi
cmp dword [ebp - 0xd68], 0
je 0x406e47
push dword [ebp - 0xd68]
call esi
test bl, bl
je 0x406e58
mov ecx, dword [ebp - 0xd88]
mov edx, edi
call fcn.0040957f
mov edi, dword [ebp - 0xdb0]
lea eax, [ebp - 0xd94]
mov ecx, dword [ebp - 0xd88]
mov edx, edi
push eax
lea eax, [ebp - 0xd5c]
push eax
sub esp, 0x14
call main
test eax, eax
jne 0x40718a
lea eax, [ebp - 0xd54]
mov edx, edi
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd80]
call main
test eax, eax
jne 0x4072eb
lea eax, [ebp - 0xdb8]
mov edx, str.command
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd54]
call main
test eax, eax
jne 0x4072eb
test bl, bl
jne 0x407298
lea eax, [ebp - 0xd98]
mov edx, 0x433a90
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd5c]
call main
test eax, eax
jne 0x4072b7
movzx eax, byte [ebp - 0x320]
xor edx, edx
xor ecx, ecx
inc edx
cmp dword [ebp - 0xd78], edx
cmove eax, ecx
xor ebx, ebx
mov byte [ebp - 0x320], al
lea eax, [ebp - 0xdc4]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0xd78]
push eax
push ebx
push ebx
push dword [ebp - 0xd98]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x4072b9
cmp word [ebp - 0x320], bx
je 0x4072b9
mov al, bl
cmp dword [ebp - 0xd90], 0
mov ebx, dword [sym.imp.advapi32.dll_RegSetValueExW]
jne 0x406fd2
cmp dword [ebp - 0xd70], 0
jne 0x406f6b
test al, al
je 0x406fd2
push dword [ebp - 0xd7c]
mov ecx, dword [ebp - 0xd58]
lea eax, [ebp - 0xda4]
push eax
lea eax, [ebp - 0x4c]
mov edx, edi
push eax
xor eax, eax
push eax
call main
cmp dword [ebp - 0xd70], 0
je 0x406faf
push dword [ebp - 0xda4]
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
inc eax
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd5c]
call ebx
cmp byte [ebp - 0xd49], 0
je 0x406fd2
push dword [ebp - 0xda4]
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
inc eax
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd54]
call ebx
cmp byte [ebp - 0xd4b], 0
je 0x407048
xor eax, eax
mov dword [ebp - 0xd70], eax
mov ebx, dword [ebp - 0xd7c]
lea eax, [ebp - 0xd70]
push eax
push 0x2001f
mov eax, str.SOFTWAREMicrosoftSharedHTML
mov byte [ebp - 4], 0xb
test ebx, ebx
mov edx, str.SOFTWAREMicrosoftSharedMHTML
push ecx
cmove edx, eax
mov ecx, reloc.appvisvsubsystems32.dll_Ordinal_1
call main
test eax, eax
jne 0x407027
mov ecx, dword [ebp - 0xd70]
mov edx, str.Default_Editor
call fcn.0040957f
mov edx, ebx
mov ecx, reloc.appvisvsubsystems32.dll_Ordinal_1
call fcn.00407f8b
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0xd70], 0
je 0x407048
push dword [ebp - 0xd70]
call esi
xor ebx, ebx
lea ecx, [ebp - 0xdbc]
cmp dword [ebp - 0xd90], ebx
setne bl
mov edx, ebx
call main
cmp word [ebp - 0x4c], 0
jne 0x407086
push dword [ebp - 0xd7c]
mov ecx, dword [ebp - 0xd58]
lea eax, [ebp - 0xda4]
push eax
lea eax, [ebp - 0x4c]
mov edx, edi
push eax
push ebx
call main
cmp dword [ebp - 0xd58], 0
je 0x407097
push dword [ebp - 0xd58]
call esi
xor ebx, ebx
mov dword [ebp - 0xd58], ebx
cmp dword [ebp - 0xd64], ebx
je 0x4070af
push dword [ebp - 0xd64]
call esi
mov ecx, dword [ebp - 0xd84]
mov edx, edi
mov dword [ebp - 0xd64], ebx
call fcn.0040957f
mov ecx, dword [ebp - 0xd84]
lea eax, [ebp - 0xd94]
push eax
lea eax, [ebp - 0xd58]
mov edx, edi
push eax
sub esp, 0x14
call main
mov edi, dword [ebp - 0xdbc]
test eax, eax
jne 0x40717f
push dword [ebp - 0xda4]
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
inc eax
push eax
push ebx
push ebx
push dword [ebp - 0xd58]
mov ebx, dword [sym.imp.advapi32.dll_RegSetValueExW]
call ebx
test eax, eax
jne 0x40717f
mov ecx, dword [ebp - 0xd58]
lea eax, [ebp - 0xd94]
push eax
lea eax, [ebp - 0xd64]
mov edx, str.command
push eax
sub esp, 0x14
call main
test eax, eax
jne 0x40717f
mov ecx, edi
call fcn.0040b82d
add eax, eax
push eax
push edi
xor eax, eax
inc eax
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd64]
call ebx
test eax, eax
jne 0x40717f
cmp dword [ebp - 0xd90], eax
jne 0x407176
push dword [ebp - 0xd7c]
mov edx, dword [ebp - 0xd5c]
mov ecx, 0x80000002
call fcn.0040792a
test eax, eax
je 0x40717f
xor eax, eax
inc eax
mov dword [ebp - 0xda0], eax
test edi, edi
je 0x40718a
mov ecx, edi
call fcn.00402061
mov edi, dword [ebp - 0xda0]
mov ecx, dword [ebp - 0xdac]
test ecx, ecx
je 0x40719f
call fcn.00402061
cmp dword [ebp - 0xd98], 0
je 0x4071b0
push dword [ebp - 0xd98]
call esi
xor ebx, ebx
mov dword [ebp - 0xd98], ebx
cmp dword [ebp - 0xd80], ebx
je 0x4071c8
push dword [ebp - 0xd80]
call esi
mov dword [ebp - 0xd80], ebx
cmp dword [ebp - 0xd88], ebx
je 0x4071de
push dword [ebp - 0xd88]
call esi
mov dword [ebp - 0xd88], ebx
cmp dword [ebp - 0xd84], ebx
je 0x4071f4
push dword [ebp - 0xd84]
call esi
mov dword [ebp - 0xd84], ebx
cmp dword [ebp - 0xd60], ebx
je 0x40720a
push dword [ebp - 0xd60]
call esi
mov dword [ebp - 0xd60], ebx
cmp dword [ebp - 0xd64], ebx
je 0x407220
push dword [ebp - 0xd64]
call esi
mov dword [ebp - 0xd64], ebx
cmp dword [ebp - 0xd54], ebx
je 0x407236
push dword [ebp - 0xd54]
call esi
mov dword [ebp - 0xd54], ebx
cmp dword [ebp - 0xd5c], ebx
je 0x40724c
push dword [ebp - 0xd5c]
call esi
mov dword [ebp - 0xd5c], ebx
cmp dword [ebp - 0xdb4], ebx
je 0x407262
push dword [ebp - 0xdb4]
call esi
mov dword [ebp - 0xdb4], ebx
cmp dword [ebp - 0xdb8], ebx
je 0x407278
push dword [ebp - 0xdb8]
call esi
mov dword [ebp - 0xdb8], ebx
cmp dword [ebp - 0xd58], ebx
je 0x40728e
push dword [ebp - 0xd58]
call esi
mov eax, edi
call fcn.0042ecda
ret 0xc
cmp byte [ebp - 0xd4a], 0
jne 0x4072b7
mov edx, dword [ebp - 0xd5c]
xor eax, eax
mov ecx, dword [ebp - 0xd58]
push eax
call main
jmp 0x4072d9
xor ebx, ebx
mov ecx, dword [ebp - 0xd60]
test ecx, ecx
je 0x4072d9
mov edx, dword [ebp - 0xd5c]
push ebx
call main
mov dword [ebp - 0xd70], 1
mov byte [ebp - 0xd4b], 1
mov al, byte [ebp - 0xd49]
jmp 0x406f4f
cmp dword [ebp - 0xd54], 0
je 0x407312
mov ecx, dword [ebp - 0xd80]
mov edx, edi
call fcn.0040957f
cmp dword [ebp - 0xd54], 0
je 0x407312
push dword [ebp - 0xd54]
call esi
mov ecx, dword [ebp - 0xd80]
xor eax, eax
mov dword [ebp - 0xd54], eax
mov edx, edi
lea eax, [ebp - 0xd94]
push eax
lea eax, [ebp - 0xd54]
push eax
sub esp, 0x14
call main
test eax, eax
jne 0x40718a
lea eax, [ebp - 0xdb4]
mov edx, str.command
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd5c]
call main
test eax, eax
jne 0x40738f
test bl, bl
jne 0x407393
mov ecx, dword [ebp - 0xd60]
test ecx, ecx
je 0x4072e0
mov edx, dword [ebp - 0xd54]
push eax
call main
xor ecx, ecx
inc ecx
mov al, cl
mov byte [ebp - 0xd49], al
jmp 0x406f4f
test bl, bl
je 0x40739c
cmp byte [ebp - 0xd4a], 0
je 0x4073d3
cmp dword [ebp - 0xd90], 0
jne 0x4073d3
mov ecx, dword [ebp - 0xd60]
test ecx, ecx
je 0x4073ea
push dword [ebp - 0xd54]
mov edx, dword [ebp - 0xd5c]
call main
xor ecx, ecx
inc ecx
mov al, cl
mov byte [ebp - 0xd49], cl
mov dword [ebp - 0xd70], ecx
jmp 0x4073f3
push dword [ebp - 0xd54]
mov edx, dword [ebp - 0xd5c]
mov ecx, dword [ebp - 0xd58]
call main
mov al, byte [ebp - 0xd49]
xor ecx, ecx
inc ecx
mov byte [ebp - 0xd4b], cl
jmp 0x406f4f