Function at 0x422560
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x43d150]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x21c], 4
xor eax, eax
mov word [ebp - 0x220], ax
lea ecx, [ebp - 0x214]
push ecx
push 0x437428
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4226ce
mov dword [ebp - 0x21c], 4
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push str.Type
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4225f2
cmp dword [ebp - 4], 1
je 0x4225f0
movzx eax, word [ebp - 0x220]
or eax, 1
mov word [ebp - 0x220], ax
jmp 0x422603
movzx ecx, word [ebp - 0x220]
or ecx, 2
mov word [ebp - 0x220], cx
mov dword [ebp - 0x21c], 4
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push str.ErrorControl
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x422650
cmp dword [ebp - 4], 1
je 0x42264e
movzx eax, word [ebp - 0x220]
or eax, 4
mov word [ebp - 0x220], ax
jmp 0x422661
movzx ecx, word [ebp - 0x220]
or ecx, 8
mov word [ebp - 0x220], cx
mov dword [ebp - 0x21c], 4
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push str.Start
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4226ae
cmp dword [ebp - 4], 3
je 0x4226ac
movzx eax, word [ebp - 0x220]
or eax, 0x10
mov word [ebp - 0x220], ax
jmp 0x4226bf
movzx ecx, word [ebp - 0x220]
or ecx, 0x20
mov word [ebp - 0x220], cx
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4226df
movzx eax, word [ebp - 0x220]
or eax, 0x40
mov word [ebp - 0x220], ax
lea ecx, [ebp - 0x214]
push ecx
push 0x4374c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x422792
mov dword [ebp - 0x21c], 0x100
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0x43755c
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x422770
mov eax, dword [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x210]
push ecx
call fcn.00421f20
add esp, 8
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 0xffffffff
jne 0x42276e
movzx edx, word [ebp - 0x220]
or edx, 0x80
mov word [ebp - 0x220], dx
jmp 0x422783
movzx eax, word [ebp - 0x220]
or eax, 0x100
mov word [ebp - 0x220], ax
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4227a6
movzx edx, word [ebp - 0x220]
or edx, 0x200
mov word [ebp - 0x220], dx
lea eax, [ebp - 0x214]
push eax
push str.SOFTWAREMicrosoftInternet_ExplorerActiveX_CompatibilityE787FD25_8D7C_4693_AE67_9406BC6E22DF
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4227e0
push 0x43763c
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x214]
push eax
push str.SOFTWAREMicrosoftInternet_ExplorerActiveX_CompatibilityBAEA0695_03A4_43BB_8495_C7025E1A8F42
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x42281a
push 0x437704
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, word [ebp - 0x220]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040cf89
mov esp, ebp
pop ebp
ret