Function at 0x4047f0
Capabilities:
Accept command line arguments
Query or enumerate registry value

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x58
call fcn.00403fc0
lea ebx, [ebp - 0x48]
call fcn.00401560
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea esi, [ebp - 0x38]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x28], 0
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREWOW6432NodeMicrosoftEdgeUpdateClientState56EB18F8_B008_4CBD_B6D2_8C97FE7E9062
mov dword [esp], 0x80000002
mov dword [ebp - 0x50], eax
call eax
sub esp, 0x14
test eax, eax
je 0x404ae4
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREPoliciesMicrosoftEdgeUpdate
mov dword [esp], 0x80000002
call dword [ebp - 0x50]
sub esp, 0x14
test eax, eax
je 0x404a8d
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREClientsStartMenuInternetMicrosoft_Edge
mov dword [esp], 0x80000002
call dword [ebp - 0x50]
sub esp, 0x14
test eax, eax
je 0x404a71
mov dword [esp + 4], 0
mov dword [esp], str.C:WindowsSystemAppsMicrosoft.MicrosoftEdge_8wekyb3d8bbweMicrosoftEdge.exe
call dword [sym.imp.msvcrt.dll__waccess]
cmp eax, 0xffffffff
je 0x4048e0
mov dword [0x408020], 1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [esp + 4], esi
mov dword [esp], eax
call dword [sym.imp.SHELL32.DLL_CommandLineToArgvW]
sub esp, 8
test eax, eax
mov ebx, eax
je 0x404c5e
mov eax, dword [ebp - 0x38]
xor edi, edi
mov esi, dword [sym.imp.msvcrt.dll__wcsnicmp]
test eax, eax
jg 0x40493e
jmp 0x4049c9
mov dword [esp + 8], 6
mov dword [esp + 4], str.group
mov eax, dword [ebx + edi*4]
mov dword [esp], eax
call esi
test eax, eax
je 0x404970
mov eax, dword [ebp - 0x38]
add edi, 1
cmp eax, edi
jle 0x4049c0
mov dword [esp + 8], 6
mov dword [esp + 4], str.delay
mov eax, dword [ebx + edi*4]
mov dword [esp], eax
call esi
test eax, eax
jne 0x404914
mov eax, dword [ebx + edi*4]
add eax, 0xc
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wtoi]
mov dword [0x408060], eax
jmp 0x404914
mov eax, dword [ebx + edi*4]
mov dword [esp + 4], 0x406712
lea ecx, [eax + 0xc]
mov dword [esp], ecx
mov dword [ebp - 0x4c], ecx
call sub.msvcrt.dll_wcsstr
mov ecx, dword [ebp - 0x4c]
test eax, eax
je 0x4049a2
mov dword [esp], ecx
mov dword [esp + 4], 0x406712
call sub.msvcrt.dll_wcstok
mov ecx, eax
mov dword [esp + 4], ecx
add edi, 1
mov dword [esp], 0x408700
call sub.msvcrt.dll_wcscpy
mov eax, dword [ebp - 0x38]
cmp eax, edi
jg 0x40493e
cmp eax, 1
je 0x404b4c
cmp eax, 1
jle 0x404a65
mov dword [esp + 4], str.edge
mov eax, dword [ebx + 4]
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
mov dword [esp], eax
call esi
test eax, eax
je 0x404c72
mov dword [esp + 4], str.edgelegacy
mov eax, dword [ebx + 4]
mov dword [esp], eax
call esi
test eax, eax
je 0x404cc3
mov dword [esp + 4], 0x407738
mov eax, dword [ebx + 4]
mov dword [esp], eax
call esi
test eax, eax
je 0x404ca8
mov dword [esp + 4], str.iexplore
mov eax, dword [ebx + 4]
mov dword [esp], eax
call esi
test eax, eax
je 0x404ca8
mov dword [esp + 4], str.chrome
mov eax, dword [ebx + 4]
mov dword [esp], eax
call esi
test eax, eax
je 0x404c8d
cmp dword [ebp - 0x38], 2
je 0x404b3b
mov eax, dword [ebx + 4]
mov edx, dword [ebx + 8]
call fcn.00403510
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret
mov eax, dword [ebp - 0x48]
mov dword [0x408030], 1
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
jmp 0x4048bc
lea eax, [ebp - 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x28], 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.Allowsxs
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x404ad2
mov eax, dword [ebp - 0x38]
mov dword [0x408050], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
jmp 0x40488b
lea eax, [ebp - 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x28], 4
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], str.BrowserReplacement
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
sub esp, 0x18
test eax, eax
jne 0x404b29
mov eax, dword [ebp - 0x38]
mov dword [0x408040], eax
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
jmp 0x40485a
mov dword [esp], str.error:_unknown_shortcut._supply_browser_with_a_hive___for_example_hklm_firefox.exe._n
call sub.msvcrt.dll_wprintf_s
jmp 0x404a65
mov dword [esp], str._nSetDefaultBrowser_v1.5_n_nCopyright_2020_by_Christoph_Kolbicz__https:__kolbi.cz_n_nusage:_SetDefaultBrowser_hive_browser_nexample:_SetDefaultBrowser_HKLM_IEXPLORE.EXE_n_nshortcuts:__no_hive_needed__will_use_HKLM__chrome__ie__iexplore_and_edge_n
lea ebx, [ebp - 0x28]
call sub.msvcrt.dll_wprintf_s
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREClientsStartMenuInternet
mov dword [esp], 0x80000002
call dword [ebp - 0x50]
sub esp, 0x14
test eax, eax
jne 0x404bd6
mov dword [esp], str._nInstalled_browsers:_n_n
call sub.msvcrt.dll_wprintf_s
cmp dword [0x408020], 0
je 0x404c32
cmp dword [0x408030], 0
jne 0x404c3f
mov dword [esp], str.HKLM_Microsoft_Edge_Legacy_n__name:_Microsoft_Edge_Legacy_n__path:_C:WindowsSystemAppsMicrosoft.MicrosoftEdge_8wekyb3d8bbweMicrosoftEdge.exe_n
call sub.msvcrt.dll_wprintf_s
mov eax, dword [ebp - 0x28]
mov edx, 0x80000002
call fcn.00401700
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
jmp 0x404be2
mov dword [esp], str.error:_cannot_open_HKLM_StartMenuInternet_n
call sub.msvcrt.dll_wprintf_s
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], 0
mov dword [esp + 4], str.SOFTWAREClientsStartMenuInternet
mov dword [esp], 0x80000001
call dword [ebp - 0x50]
sub esp, 0x14
test eax, eax
jne 0x404a65
mov eax, dword [ebp - 0x28]
mov edx, 0x80000001
call fcn.00401700
mov eax, dword [ebp - 0x28]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
jmp 0x404a65
cmp dword [0x408030], 0
je 0x404bba
cmp dword [0x408050], 0
je 0x404bba
cmp dword [0x408040], 0
jne 0x404bba
jmp 0x404bae
mov dword [esp], str.error:_unable_to_parse_the_command_line._n
call sub.msvcrt.dll_wprintf_s
or eax, 0xffffffff
jmp 0x404a65
mov edx, str.Microsoft_Edge
mov eax, str.hklm
call fcn.00403510
mov dword [esp], 0
call sub.msvcrt.dll_exit
mov edx, str.Google_Chrome
mov eax, str.hklm
call fcn.00403510
mov dword [esp], 0
call sub.msvcrt.dll_exit
mov edx, str.iexplore.exe
mov eax, str.hklm
call fcn.00403510
mov dword [esp], 0
call sub.msvcrt.dll_exit
mov edx, str.Microsoft_Edge_Legacy
mov eax, str.hklm
call fcn.00403510
mov dword [esp], 0
call sub.msvcrt.dll_exit
nop
nop
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.00401500
mov dword [esp], 0x401550
call fcn.00403770
leave
ret