Function at 0x1000a28a
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
push 0x83c
mov eax, 0x100318d0
call fcn.10030db7
mov eax, ecx
mov dword [ebp - 0x81c], eax
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x838], ecx
mov byte [ebp - 0x811], cl
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x824], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x830], ecx
mov dword [ebp - 0x82c], ecx
mov dword [ebp - 0x820], ecx
test eax, eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x830]
mov ecx, str.SOFTWAREMicrosoftSharedHTML
push eax
mov esi, str.SOFTWAREMicrosoftSharedMHTML
cmove esi, ecx
push 0x20019
push ecx
mov edx, esi
mov ecx, 0x80000001
call fcn.10026806
mov edi, str.Default_Editor
test eax, eax
jne 0x1000a314
mov ecx, dword [ebp - 0x830]
mov edx, edi
call fcn.1000b7bc
lea eax, [ebp - 0x824]
mov edx, esi
push eax
push 0x20019
push ecx
mov ecx, 0x80000002
call fcn.10026806
test eax, eax
jne 0x1000a33e
mov ecx, dword [ebp - 0x824]
mov edx, edi
call fcn.1000b7bc
lea eax, [ebp - 0x82c]
mov esi, 0x20019
push eax
push esi
push ecx
mov ecx, dword [ebp - 0x824]
mov edx, str.Old_Default_Editor
call fcn.10026806
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
test eax, eax
jne 0x1000a383
lea eax, [ebp - 0x820]
mov edx, str.shell
push eax
push esi
push ecx
mov ecx, dword [ebp - 0x82c]
call fcn.10026806
test eax, eax
je 0x1000a39d
lea ecx, [ebp - 0x820]
call fcn.10026806
test eax, eax
je 0x1000a5f7
mov byte [ebp - 0x811], 1
mov ecx, dword [ebp - 0x81c]
call fcn.10026806
mov dword [ebp - 0x840], eax
test eax, eax
je 0x1000a40a
mov bl, byte [ebp - 0x811]
mov esi, eax
xor edi, edi
push 0x3b
pop edx
mov ecx, esi
call fcn.1000d79e
mov dword [ebp - 0x834], eax
test eax, eax
je 0x1000a3d5
xor ecx, ecx
mov word [eax], cx
cmp word [esi], di
je 0x1000a3f1
movzx eax, bl
mov edx, esi
push eax
push dword [ebp - 0x820]
call fcn.1000a68c
mov eax, dword [ebp - 0x834]
mov esi, eax
add eax, 2
neg esi
sbb esi, esi
and esi, eax
jne 0x1000a3bc
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x828]
xor esi, esi
lea edx, [ebp - 0x818]
push esi
push dword [ebp - 0x81c]
mov ecx, 0x80000002
mov dword [ebp - 0x818], esi
call fcn.10026806
test eax, eax
je 0x1000a43e
push str.KnownIDs
push dword [ebp - 0x818]
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
cmp dword [ebp - 0x818], esi
je 0x1000a44e
push dword [ebp - 0x818]
call edi
mov edi, dword [ebp - 0x81c]
mov edx, edi
mov ecx, esi
call fcn.1000a0dd
inc esi
cmp esi, 9
jb 0x1000a454
mov esi, edi
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
jne 0x1000a5bc
xor ecx, ecx
lea eax, [ebp - 0x848]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x818]
mov dword [ebp - 0x83c], ecx
push eax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x834], ecx
push eax
push ecx
jmp 0x1000a59f
xor eax, eax
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x818]
push eax
push 0x2001f
push ecx
lea edx, [ebp - 0x810]
mov ecx, 0x80000000
call fcn.10026806
test eax, eax
jne 0x1000a562
mov dword [ebp - 0x81c], eax
lea eax, [ebp - 0x81c]
mov byte [ebp - 4], 5
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x818]
mov edx, 0x10036a1c
call fcn.10026806
test eax, eax
jne 0x1000a551
mov ecx, dword [ebp - 0x81c]
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x828]
xor edx, edx
push eax
call fcn.10026806
test eax, eax
je 0x1000a658
mov ebx, dword [ebp - 0x828]
test ebx, ebx
je 0x1000a532
mov edx, str.msohtmed.exe
mov ecx, ebx
call fcn.10026806
jmp 0x1000a534
xor eax, eax
test eax, eax
je 0x1000a551
movzx eax, byte [ebp - 0x811]
lea edx, [ebp - 0x810]
push eax
push dword [ebp - 0x820]
call fcn.1000a68c
cmp dword [ebp - 0x81c], 0
je 0x1000a562
push dword [ebp - 0x81c]
call edi
mov byte [ebp - 4], 3
cmp dword [ebp - 0x818], 0
je 0x1000a577
push dword [ebp - 0x818]
call edi
mov eax, dword [ebp - 0x834]
lea ecx, [ebp - 0x848]
push ecx
inc eax
xor ecx, ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x834], eax
push ecx
lea ecx, [ebp - 0x810]
push ecx
push eax
push 0x80000000
mov dword [ebp - 0x818], 0x400
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
test eax, eax
je 0x1000a49f
mov ecx, esi
call fcn.1000a749
mov ecx, dword [ebp - 0x824]
mov edx, str.Old_Default_Editor
call fcn.1000b7bc
mov dword [ebp - 0x838], 1
mov ecx, dword [ebp - 0x840]
test ecx, ecx
je 0x1000a5ec
call fcn.100033fc
test ebx, ebx
je 0x1000a5f7
mov ecx, ebx
call fcn.100033fc
cmp dword [ebp - 0x820], 0
je 0x1000a608
push dword [ebp - 0x820]
call edi
xor ebx, ebx
mov dword [ebp - 0x820], ebx
cmp dword [ebp - 0x82c], ebx
je 0x1000a620
push dword [ebp - 0x82c]
call edi
mov dword [ebp - 0x82c], ebx
cmp dword [ebp - 0x830], ebx
je 0x1000a636
push dword [ebp - 0x830]
call edi
mov dword [ebp - 0x830], ebx
cmp dword [ebp - 0x824], ebx
je 0x1000a64c
push dword [ebp - 0x824]
call edi
mov eax, dword [ebp - 0x838]
call fcn.10030d76
ret
cmp dword [ebp - 0x81c], 0
je 0x1000a669
push dword [ebp - 0x81c]
call edi
xor eax, eax
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x818], eax
je 0x1000a681
push dword [ebp - 0x818]
call edi
mov ebx, dword [ebp - 0x828]
jmp 0x1000a5dd