Function at 0x4052b0
Capabilities:
Delete registry key
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x290
mov eax, dword [0x41800c]
mov ebx, dword [ebp + 8]
mov esi, 0x80070057
xor eax, ebp
cmp ebx, 2
mov dword [esp + 0x288], eax
jl 0x4053f0
mov edi, dword [ebp + 0xc]
cmp dword [edi + 4], 0
je 0x4053f0
push 2
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x4053ee
push str.uninstall
push dword [edi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x4053b3
push str.unregister_task
push dword [edi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x4053b3
mov ecx, 0x414aa7
mov edx, str.DisableDefaultBrowserAgent
call fcn.00401050
mov esi, 0x800704ec
test al, al
jne 0x4053e6
push 0x4156f4
push dword [edi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x405408
push str.update_task
push dword [edi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x405422
push str.do_task
push dword [edi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
mov esi, 0x80070057
test eax, eax
jne 0x4053e6
mov ecx, 0x414a8b
mov edx, str.DisableTelemetry
call fcn.00401050
xor esi, esi
test al, al
jne 0x4053e6
call fcn.00403040
jmp 0x4053e4
mov esi, 0x80070057
cmp ebx, 3
jl 0x4053e6
cmp dword [edi + 8], 0
je 0x4053e6
push str.uninstall
push dword [edi + 4]
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
add esp, 8
test eax, eax
je 0x405566
mov ecx, dword [edi + 8]
call fcn.00402ad0
mov esi, eax
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x4053f0
mov esi, eax
mov ecx, dword [esp + 0x288]
xor ecx, ebp
call fcn.00413150
mov eax, esi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, 0x80070057
cmp ebx, 3
jl 0x4053e6
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x4053e6
xor edx, edx
call fcn.00401530
jmp 0x4053e4
mov esi, 0x80070057
cmp ebx, 3
jl 0x4053e6
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x4053e6
lea eax, [esp + 0x5c]
mov dword [esp + 0x5c], 0
push eax
push 0x414020
push 1
push 0
push 0x414030
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4056a0
mov eax, dword [esp + 0x5c]
xorps xmm0, xmm0
movaps xmmword [esp + 0x60], xmm0
movaps xmmword [esp + 0x40], xmm0
movaps xmmword [esp + 0x30], xmm0
movaps xmmword [esp + 0x20], xmm0
mov ecx, dword [eax]
sub esp, 0x44
movsd xmm0, qword [esp + 0xa4]
movsd xmm1, qword [esp + 0xac]
movsd qword [esp + 0x3c], xmm1
movsd qword [esp + 0x34], xmm0
movsd xmm0, qword [esp + 0x84]
movsd xmm1, qword [esp + 0x8c]
movsd qword [esp + 0x2c], xmm1
movsd qword [esp + 0x24], xmm0
movsd xmm0, qword [esp + 0x74]
movsd xmm1, qword [esp + 0x7c]
movsd qword [esp + 0x1c], xmm1
movsd qword [esp + 0x14], xmm0
movsd xmm0, qword [esp + 0x64]
movsd xmm1, qword [esp + 0x6c]
movsd qword [esp + 0xc], xmm1
movsd qword [esp + 4], xmm0
mov dword [esp], eax
call dword [ecx + 0x28]
test eax, eax
js 0x4056f5
mov dword [esp + 0x78], 0
push 0x415798
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edi, eax
mov eax, dword [esp + 0x78]
mov esi, dword [esp + 0x5c]
mov dword [esp + 0x78], 0
test eax, eax
je 0x405525
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi]
lea ecx, [esp + 0x78]
push ecx
push edi
push esi
call dword [eax + 0x1c]
test eax, eax
jns 0x4057b0
mov ecx, ebx
xor edx, edx
call fcn.00401530
mov esi, eax
test edi, edi
je 0x40554f
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [esp + 0x78]
test eax, eax
je 0x40570c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x40570c
lea ecx, [esp + 0x7c]
call fcn.004070b0
mov ebx, dword [esp + 0x7c]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
je 0x405792
lea eax, [esp + 0x60]
mov dword [esp + 0x60], 0
push eax
push 0x20107
push 0
push str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405792
mov esi, dword [esp + 0x60]
mov dword [esp + 0x40], 0
lea eax, [esp + 0x40]
push 0
push 0
push 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x405787
mov eax, dword [esp + 0x40]
mov ecx, 0xffffffff
mov dword [esp + 4], ebx
inc eax
mov dword [esp], eax
mov dword [esp + 0x40], eax
add eax, eax
cmovae ecx, eax
mov dword [esp + 8], ecx
push ecx
call fcn.00412853
add esp, 4
mov ebx, eax
push dword [esp + 8]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [esp]
mov dword [esp + 0x30], 0
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push 0
push 0
push 0
push 0
push eax
push ebx
push 0
mov dword [esp + 0x1c], esi
jmp 0x405662
mov eax, dword [esp + 0x30]
mov esi, dword [esp]
inc eax
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x20], ecx
push 0
push 0
push 0
push 0
lea ecx, [esp + 0x30]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x405723
mov esi, dword [esp + 4]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
push eax
push esi
push ebx
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x40563f
push ebx
mov esi, dword [esp + 4]
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 0x30]
jmp 0x40564b
mov esi, eax
push 0x4155ca
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
je 0x40570c
mov edi, eax
lea ebx, [esp + 0x7c]
push 0x20a
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
sub esp, 0x10
mov dword [esp + 0x10], esi
mov dword [esp], ebx
mov dword [esp + 0x18], 0xc9
mov dword [esp + 0x14], str.UpdateTask
call fcn.00401000
add esp, 0x1c
lea eax, [esp + 0x60]
mov dword [esp + 0x60], ebx
jmp 0x405875
mov esi, eax
push 0x4155ca
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
test eax, eax
jne 0x405838
mov eax, dword [esp + 0x5c]
test eax, eax
je 0x4053e6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x4053e6
lea eax, [esp + 0x30]
push 0
push 0
push 0
push 0
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x405777
cmp dword [esp], 0
je 0x405759
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x30], 0
mov dword [esp], 0
jne 0x405777
push str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push ebx
call fcn.0041285c
add esp, 4
mov esi, dword [esp]
mov ebx, dword [esp + 4]
test esi, esi
je 0x405792
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov dword [esp + 0x7c], 0
je 0x4053dc
push ebx
call fcn.0041285c
add esp, 4
jmp 0x4053dc
lea esi, [esp + 0x7c]
mov edx, 0x4158b8
mov dword [esp + 0x90], 7
mov dword [esp + 0x8c], 0
mov word [esp + 0x7c], 0
mov ecx, esi
call fcn.00408e10
push ebx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
mov ecx, esi
mov edx, ebx
push eax
call fcn.00406ec0
add esp, 4
cmp dword [esp + 0x90], 7
jbe 0x405801
mov esi, dword [esp + 0x7c]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, dword [esp + 0x78]
mov dword [esp + 0x1c], 0
lea edx, [esp + 0x1c]
mov ecx, dword [esi]
push edx
mov dword [esp + 4], eax
push eax
push esi
call dword [ecx + 0x34]
test eax, eax
jns 0x405896
mov ecx, ebx
xor edx, edx
call fcn.00401530
mov esi, eax
jmp 0x40594b
mov edi, eax
lea ebx, [esp + 0x7c]
push 0x20a
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
sub esp, 0x10
mov dword [esp + 0x10], esi
mov dword [esp], ebx
mov dword [esp + 0x18], 0xcb
mov dword [esp + 0x14], str.UpdateTask
call fcn.00401000
add esp, 0x1c
mov dword [esp + 0x78], ebx
lea eax, [esp + 0x78]
push 0
push eax
push 0
push 1
push 0
push esi
push 0
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x40570c
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], 0
lea edx, [esp + 0x18]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x4c]
test eax, eax
jns 0x4058be
mov ecx, ebx
xor edx, edx
call fcn.00401530
mov esi, eax
jmp 0x40593d
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], 0
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x24]
test eax, eax
jns 0x4058e6
mov ecx, ebx
xor edx, edx
call fcn.00401530
mov esi, eax
jmp 0x40592f
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], 0
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push edx
push 1
push eax
call dword [ecx + 0x20]
test eax, eax
js 0x405916
mov eax, dword [esp + 0x10]
lea edx, [esp + 0xc]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x38]
test eax, eax
jns 0x40597e
mov ecx, ebx
xor edx, edx
call fcn.00401530
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40592f
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x40593d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40594b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x405959
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esp], 0
je 0x405968
push dword [esp]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [esp + 0x7c]
call fcn.00408db0
test edi, edi
jne 0x405548
jmp 0x40554f
mov eax, dword [esp + 0xc]
mov ecx, ebx
mov edx, eax
mov ebx, eax
call fcn.00401530
mov esi, eax
test ebx, ebx
je 0x405921
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x405921