Function at 0x10004a00
Capabilities:
Check os version
Delete registry key
Delete registry value
Persist via contextmenuhandlers registry key
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002f706
mov eax, dword fs:[0]
push eax
mov eax, 0x1798
call fcn.10018330
mov eax, dword [0x100430b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1784], ecx
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x1f8]
mov ecx, 0x1e
mov dword [ebp - 0x1780], eax
mov eax, dword [ebp + 0xc]
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x17a0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x178c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x179c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1788], eax
mov eax, dword [ebp + 0x28]
push 0x4e
mov dword [ebp - 0x1794], eax
lea eax, [ebp - 0x17e]
push 0
push eax
movsw word es:[edi], word [esi]
call fcn.1001ac20
push 0xc8
lea eax, [ebp - 0x3c8]
push 0
push eax
call fcn.1001ac20
push 0xc8
lea eax, [ebp - 0x300]
push 0
push eax
call fcn.1001ac20
push 0xc8
lea eax, [ebp - 0x490]
push 0
push eax
call fcn.1001ac20
push 0x190
lea eax, [ebp - 0x7b0]
push 0
push eax
call fcn.1001ac20
push 0x190
lea eax, [ebp - 0xe68]
push 0
push eax
call fcn.1001ac20
add esp, 0x48
lea eax, [ebp - 0x1638]
push 0x7d0
push 0
push eax
call fcn.1001ac20
push 0x190
lea eax, [ebp - 0x940]
push 0
push eax
call fcn.1001ac20
push 0x190
lea eax, [ebp - 0x620]
push 0
push eax
call fcn.1001ac20
push 0x190
lea eax, [ebp - 0xad0]
push 0
push eax
call fcn.1001ac20
push 0x100
lea eax, [ebp - 0x130]
push 0
push eax
call fcn.1001ac20
mov esi, dword [ebp - 0x1780]
lea eax, [ebp - 0x130]
push esi
push dword [ebp - 0x17a0]
push str._s_s
push eax
call fcn.10006e10
add esp, 0x4c
xor ecx, ecx
movzx eax, word [ebp + ecx - 0x1f8]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x3ca], ax
test ax, ax
jne 0x10004b75
mov edx, esi
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004b90
lea edi, [ebp - 0x3c8]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004ba6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x3c8]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004bd0
mov ecx, 8
mov esi, str.OpenWithProgids
rep movsd dword es:[edi], dword [esi]
xor ecx, ecx
movsw word es:[edi], word [esi]
nop dword [eax]
movzx eax, word [ebp + ecx - 0x1f8]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x302], ax
test ax, ax
jne 0x10004bf0
mov edx, dword [ebp - 0x1780]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004c10
lea edi, [ebp - 0x300]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004c26
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x300]
add ecx, 0xfffffffe
nop dword [eax]
mov ax, word [ecx + 2]
lea ecx, [ecx + 2]
test ax, ax
jne 0x10004c50
mov eax, dword [str.UserChoice]
mov dword [ecx], eax
mov eax, dword [0x10031344]
mov dword [ecx + 4], eax
mov eax, dword [0x10031348]
mov dword [ecx + 8], eax
mov eax, dword [0x1003134c]
mov dword [ecx + 0xc], eax
mov eax, dword [0x10031350]
mov dword [ecx + 0x10], eax
mov eax, dword [0x10031354]
mov dword [ecx + 0x14], eax
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0x1f8]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x492], ax
test ax, ax
jne 0x10004c90
mov edx, dword [ebp - 0x1780]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004cb0
lea edi, [ebp - 0x490]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004cc6
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x490]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004cf0
mov edx, dword [ebp - 0x1780]
mov ecx, 7
mov esi, str.OpenWithList
rep movsd dword es:[edi], dword [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004d10
lea edi, [ebp - 0x1f8]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004d26
mov eax, dword [ebp - 0x1784]
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp dword [eax + 0x14], 8
rep movsb byte es:[edi], byte [esi]
jb 0x10004d50
mov ecx, dword [eax]
jmp 0x10004d52
mov ecx, eax
lea edx, [ebp - 0x7b0]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10004d60
lea edi, [ebp - 0x7b0]
add edi, 0xfffffffe
nop word [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004d80
mov ecx, 9
mov edx, dword [ebp - 0x1780]
mov esi, str.SoftwareClasses_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004da2
lea edi, [ebp - 0x7b0]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004dc0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xor ecx, ecx
nop dword [eax]
movzx eax, word [ebp + ecx - 0x7b0]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0xe6a], ax
test ax, ax
jne 0x10004de0
lea edi, [ebp - 0xe68]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004e01
mov eax, dword [ebp - 0x1784]
mov ecx, 8
mov esi, str.OpenWithProgids
rep movsd dword es:[edi], dword [esi]
cmp dword [eax + 0x14], 8
movsw word es:[edi], word [esi]
jb 0x10004e2b
mov ecx, dword [eax]
jmp 0x10004e2d
mov ecx, eax
lea edx, [ebp - 0x1638]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10004e33
lea edi, [ebp - 0x1638]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004e50
mov ecx, 9
lea edx, [ebp - 0x130]
mov esi, str.SoftwareClasses_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004e72
lea edi, [ebp - 0x1638]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004e90
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x1638]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004eb3
mov eax, dword [ebp - 0x1784]
mov ecx, 6
mov esi, str.DefaultIcon
rep movsd dword es:[edi], dword [esi]
cmp dword [eax + 0x14], 8
movsw word es:[edi], word [esi]
jb 0x10004edd
mov ecx, dword [eax]
jmp 0x10004edf
mov ecx, eax
lea edx, [ebp - 0x940]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10004ee5
lea edi, [ebp - 0x940]
add edi, 0xfffffffe
nop
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004f00
mov ecx, 9
lea edx, [ebp - 0x130]
mov esi, str.SoftwareClasses_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004f22
lea edi, [ebp - 0x940]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004f40
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x940]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004f63
mov eax, dword [ebp - 0x1784]
mov ecx, 0xa
mov esi, str._shellopencommand
rep movsd dword es:[edi], dword [esi]
cmp dword [eax + 0x14], 8
jb 0x10004f8b
mov ecx, dword [eax]
jmp 0x10004f8d
mov ecx, eax
lea edx, [ebp - 0x620]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10004f93
lea edi, [ebp - 0x620]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004fb0
mov ecx, 9
lea edx, [ebp - 0x130]
mov esi, str.SoftwareClasses_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004fd2
lea edi, [ebp - 0x620]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004ff0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x620]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005013
mov eax, dword [ebp - 0x1784]
mov ecx, 0xf
mov esi, str._shellexContextMenuHandlers_
rep movsd dword es:[edi], dword [esi]
cmp dword [eax + 0x14], 8
jb 0x1000503b
mov ecx, dword [eax]
jmp 0x1000503d
mov ecx, eax
lea edx, [ebp - 0xad0]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x10005043
lea edi, [ebp - 0xad0]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005060
mov ecx, 9
lea edx, [ebp - 0x130]
mov esi, str.SoftwareClasses_
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10005082
lea edi, [ebp - 0xad0]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax + eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100050a0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0xad0]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100050c3
mov ecx, 0xa
mov esi, str._shellexDropHandler
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp + 0x24], al
je 0x100057a8
mov edx, dword [ebp - 0x1788]
mov esi, edx
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x100050f0
lea edi, [ebp - 0x620]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10005106
mov ecx, edx
lea eax, [ebp - 0x130]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, edx
lea eax, [ebp - 0x300]
and ecx, 3
push str.ProgId
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 0x1784]
mov ecx, esi
push eax
push SysReAllocString
call fcn.10003af0
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test al, al
je 0x1000528b
lea eax, [ebp - 0x17a4]
mov dword [ebp - 0x1790], 0
push eax
push 0
lea eax, [ebp - 0x1790]
mov dword [ebp - 0x17a4], 0
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x3c8]
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x1000528b
lea eax, [ebp - 0x130]
mov ecx, esi
push eax
push 0x10031d24
lea eax, [ebp - 0x7b0]
push eax
push SysStringLen
call fcn.10003af0
test al, al
je 0x1000528b
lea eax, [ebp - 0x1790]
mov dword [ebp - 0x17a4], 0
push eax
push 0
lea eax, [ebp - 0x17a4]
mov dword [ebp - 0x1790], 0
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xe68]
push eax
push SysStringLen
call edi
test eax, eax
jne 0x1000528b
push dword [ebp - 0x179c]
lea eax, [ebp - 0x1638]
mov ecx, esi
push 0x10031d24
push eax
push SysStringLen
call fcn.10003af0
test al, al
je 0x1000528b
push dword [ebp - 0x178c]
lea eax, [ebp - 0x940]
mov ecx, esi
push 0x10031d24
push eax
push SysStringLen
call fcn.10003af0
test al, al
je 0x1000528b
push 0
push 0
lea eax, [ebp - 0x620]
mov ecx, esi
push eax
push SysStringLen
call fcn.10003ab0
test al, al
je 0x1000528b
push dword [ebp - 0x1788]
lea eax, [ebp - 0xad0]
mov ecx, esi
push 0x10031d24
push eax
push SysStringLen
call fcn.10003af0
test al, al
je 0x1000528b
mov eax, dword [ebp - 0x1794]
mov byte [eax], 0
jmp 0x10005979
mov eax, dword [ebp - 0x1794]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov byte [eax], 1
lea eax, [ebp - 0x300]
push eax
push SysReAllocString
call esi
lea eax, [ebp - 0x3c8]
push eax
push SysReAllocString
call esi
lea eax, [ebp - 0x490]
push eax
push SysReAllocString
call esi
lea eax, [ebp - 0x1f8]
push eax
push SysReAllocString
call esi
lea eax, [ebp - 0x1f8]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea eax, [ebp - 0x1784]
mov dword [ebp - 0x1798], 1
push eax
push 0
lea eax, [ebp - 0x1798]
mov dword [ebp - 0x1784], 0
push eax
push 0x10031d24
push dword [ebp - 0x1780]
push SysReAllocString
call edi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x10005441
push dword [ebp - 0x1784]
call fcn.1001be46
push dword [ebp - 0x1784]
mov dword [ebp - 0x1794], eax
push 0
push eax
call fcn.1001ac20
add esp, 0x10
mov dword [ebp - 0x1798], 1
lea eax, [ebp - 0x1784]
push eax
mov eax, dword [ebp - 0x1794]
push eax
lea eax, [ebp - 0x1798]
push eax
push 0x10031d24
push dword [ebp - 0x1780]
push SysReAllocString
call edi
mov edi, dword [ebp - 0x1794]
test edi, edi
je 0x10005443
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005390
sub ecx, edx
sar ecx, 1
je 0x10005443
lea ecx, [ebp - 0x130]
mov eax, edi
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100053d6
test dx, dx
je 0x100053d2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100053d6
add eax, 4
add ecx, 4
test dx, dx
jne 0x100053b0
xor eax, eax
jmp 0x100053db
sbb eax, eax
or eax, 1
test eax, eax
je 0x10005443
push 0x208
lea eax, [ebp - 0xcd8]
push 0
push eax
call fcn.1001ac20
push dword [ebp - 0x17a0]
lea eax, [ebp - 0xcd8]
push str._sBackup
push eax
call fcn.10006e10
mov ecx, edi
add esp, 0x18
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005411
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
lea eax, [ebp - 0xcd8]
push eax
push dword [ebp - 0x1780]
push SysReAllocString
call esi
jmp 0x10005443
xor edi, edi
lea ecx, [ebp - 0x130]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005450
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x130]
push eax
push 1
push 0x10031d24
lea eax, [ebp - 0x7b0]
push eax
push SysStringLen
call esi
push 0
push 0
push 0
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0xe68]
push eax
push SysStringLen
call esi
mov ecx, dword [ebp - 0x179c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100054a7
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp - 0x179c]
lea eax, [ebp - 0x1638]
push 1
push 0x10031d24
push eax
push SysStringLen
call esi
mov ecx, dword [ebp - 0x178c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100054e2
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp - 0x178c]
lea eax, [ebp - 0x940]
push 1
push 0x10031d24
push eax
push SysStringLen
call esi
push 0
push 0
push 1
push 0
lea eax, [ebp - 0x620]
push eax
push SysStringLen
call esi
mov ecx, dword [ebp - 0x1788]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005533
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp - 0x1788]
lea eax, [ebp - 0xad0]
push 1
push 0x10031d24
push eax
push SysStringLen
call esi
push 0
push 0
push 0
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x3c8]
push eax
push SysReAllocString
call esi
lea ecx, [ebp - 0x130]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005590
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x130]
push eax
push 1
push str.ProgId
lea eax, [ebp - 0x300]
push eax
push SysReAllocString
call esi
push 0x110
lea eax, [ebp - 0x1778]
push 0
push eax
call fcn.1001ac20
add esp, 0xc
mov dword [ebp - 0x177c], 0x114
lea eax, [ebp - 0x177c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x1778], 6
jb 0x10005765
cmp dword [ebp - 0x1774], 2
jb 0x1000596c
push 0x40
xorps xmm0, xmm0
mov byte [ebp - 0x30], 0
lea eax, [ebp - 0x238]
movq qword [ebp - 0x1f], xmm0
push 0
push eax
movups xmmword [ebp - 0x2f], xmm0
mov dword [ebp - 0x17], 0
mov word [ebp - 0x13], 0
mov byte [ebp - 0x11], 0
call fcn.1001ac20
add esp, 0xc
call fcn.10004980
mov ecx, eax
call fcn.10008a10
push eax
lea ecx, [ebp - 0x1668]
call fcn.100035e0
xor eax, eax
mov dword [ebp - 4], 0
push 0xffffffffffffffff
push eax
mov word [ebp - 0x1650], ax
lea ecx, [ebp - 0x1650]
lea eax, [ebp - 0x1668]
mov dword [ebp - 0x163c], 7
push eax
mov dword [ebp - 0x1640], 0
call fcn.10006800
push str.Assohash.dll
lea ecx, [ebp - 0x1650]
mov byte [ebp - 4], 1
call fcn.10003a30
cmp dword [ebp - 0x163c], 8
lea eax, [ebp - 0x1650]
cmovae eax, dword [ebp - 0x1650]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x100056e8
push str.HashAssociation
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100056e8
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x130]
push ecx
push dword [ebp - 0x1780]
call eax
add esp, 0xc
lea ecx, [ebp - 0x30]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100056f0
sub ecx, edx
je 0x1000574a
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10003a80
lea ecx, [ebp - 0x130]
add esp, 8
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005717
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x238]
push eax
push 1
push str.Hash
lea eax, [ebp - 0x300]
push eax
push SysReAllocString
call esi
lea ecx, [ebp - 0x1650]
call fcn.10003880
lea ecx, [ebp - 0x1668]
call fcn.10003880
jmp 0x1000596c
lea ecx, [ebp - 0x130]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005770
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x130]
push eax
push 1
push 0x10031d24
lea eax, [ebp - 0x1f8]
push eax
push SysStringLen
call esi
jmp 0x1000596c
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0x300]
push eax
push SysReAllocString
call esi
lea eax, [ebp - 0x3c8]
push eax
push SysReAllocString
call esi
lea eax, [ebp - 0x490]
push eax
push SysReAllocString
call esi
lea eax, [ebp - 0x1f8]
push eax
push SysReAllocString
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea eax, [ebp - 0x1f8]
push eax
push SysReAllocString
call esi
lea eax, [ebp - 0x130]
push eax
push SysReAllocString
call esi
push 0x208
lea eax, [ebp - 0xcd8]
mov dword [ebp - 0x178c], 1
push 0
push eax
mov dword [ebp - 0x1788], 0
call fcn.1001ac20
push dword [ebp - 0x17a0]
lea eax, [ebp - 0xcd8]
push str._sBackup
push eax
call fcn.10006e10
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x1788]
add esp, 0x18
push eax
push 0
lea eax, [ebp - 0x178c]
push eax
lea eax, [ebp - 0xcd8]
push eax
push dword [ebp - 0x1780]
push SysReAllocString
call esi
test eax, eax
jne 0x10005979
push dword [ebp - 0x1788]
call fcn.1001be46
push dword [ebp - 0x1788]
mov edi, eax
push 0
push edi
call fcn.1001ac20
add esp, 0x10
mov dword [ebp - 0x178c], 1
lea eax, [ebp - 0x1788]
push eax
push edi
lea eax, [ebp - 0x178c]
push eax
lea eax, [ebp - 0xcd8]
push eax
push dword [ebp - 0x1780]
push SysReAllocString
call esi
test edi, edi
je 0x10005979
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100058d3
sub ecx, edx
sar ecx, 1
je 0x1000596c
lea ecx, [ebp - 0x130]
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10005916
test dx, dx
je 0x10005912
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10005916
add eax, 4
add ecx, 4
test dx, dx
jne 0x100058f0
xor eax, eax
jmp 0x1000591b
sbb eax, eax
or eax, 1
test eax, eax
je 0x10005954
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005924
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push 0x10031d24
push dword [ebp - 0x1780]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0xcd8]
push eax
push dword [ebp - 0x1780]
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test edi, edi
je 0x10005979
push edi
call fcn.1001be41
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10018315
mov esp, ebp
pop ebp
ret 0x24