Function at 0x403d06
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x488
push esi
push edi
mov ecx, 0x12
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov dword [ebp - 0x50], 0
push 0x4152d4
push 0x41108c
push 0x411094
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00401afd
add esp, 0x10
push str.Explorer.exe
push 0x4152e8
push 0x411094
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00401afd
add esp, 0x10
lea eax, [ebp - 0x50]
push eax
push 0xf003f
push 0
push 0x4110b0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403f01
mov byte [ebp - 0x264], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x263]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x154], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x153]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x268], 0x104
mov dword [ebp - 0x15c], 0x104
mov dword [ebp - 0x158], 1
mov dword [ebp - 0x160], 0
lea edx, [ebp - 0x15c]
push edx
lea eax, [ebp - 0x154]
push eax
lea ecx, [ebp - 0x158]
push ecx
push 0
lea edx, [ebp - 0x268]
push edx
lea eax, [ebp - 0x264]
push eax
mov ecx, dword [ebp - 0x160]
push ecx
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x403ef7
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.MSVCRT.dll__strupr]
add esp, 4
mov dword [ebp - 0x270], 1
mov dword [ebp - 0x26c], 0
jmp 0x403e50
mov ecx, dword [ebp - 0x26c]
add ecx, 1
mov dword [ebp - 0x26c], ecx
cmp dword [ebp - 0x26c], 3
jge 0x403eaa
mov edx, dword [ebp - 0x26c]
mov eax, dword [edx*4 + 0x41521c]
push eax
lea ecx, [ebp - 0x154]
push ecx
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
je 0x403e85
mov dword [ebp - 0x270], 0
push 0x4152f0
lea edx, [ebp - 0x264]
push edx
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 8
test eax, eax
jne 0x403ea8
mov dword [ebp - 0x270], 1
jmp 0x403e41
cmp dword [ebp - 0x270], 1
jne 0x403ecf
push 0
push 0x4152fc
push 1
push 0
lea eax, [ebp - 0x264]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x15c], 0x104
mov dword [ebp - 0x268], 0x104
mov edx, dword [ebp - 0x160]
add edx, 1
mov dword [ebp - 0x160], edx
jmp 0x403ddd
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x50]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x4c]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x403ff7
mov byte [ebp - 0x484], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x483]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x374], 0
mov ecx, pe_nt_image_headers32
xor eax, eax
lea edi, [ebp - 0x373]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x488], 0x104
mov dword [ebp - 0x37c], 0x104
mov dword [ebp - 0x378], 1
mov dword [ebp - 0x380], 0
lea ecx, [ebp - 0x37c]
push ecx
lea edx, [ebp - 0x374]
push edx
lea eax, [ebp - 0x378]
push eax
push 0
lea ecx, [ebp - 0x488]
push ecx
lea edx, [ebp - 0x484]
push edx
mov eax, dword [ebp - 0x380]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x403fd4
push 0
push 0x415300
push 1
push 0
lea edx, [ebp - 0x484]
push edx
mov eax, dword [ebp - 0x50]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x403f7c
mov dword [ebp - 0x37c], 0x104
mov dword [ebp - 0x488], 0x104
mov ecx, dword [ebp - 0x380]
add ecx, 1
mov dword [ebp - 0x380], ecx
mov edx, dword [ebp - 0x50]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret