Function at 0x4025a0
Capabilities:
Delete registry value
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov eax, str.mailtoDefaultIcon
xor esi, esi
push edi
test eax, eax
mov dword [esp + 0x10], esi
mov eax, 0x407798
je 0x4025c3
mov eax, str.mailtoDefaultIcon
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push esi
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x40263d
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push esi
push esi
push str.BAK_mailto_DefaultIcon
push ecx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40263d
lea edx, [esp + 0x18]
push edx
call ebx
mov ecx, dword [esp + 0x10]
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 2
push esi
push esi
push ecx
call edi
mov edx, dword [esp + 0x10]
push str.BAK_mailto_DefaultIcon
push edx
call ebp
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x402650
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], esi
mov eax, str.mailto_shellopencommand
test eax, eax
mov eax, 0x407798
je 0x402663
mov eax, str.mailto_shellopencommand
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push esi
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4026cb
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push esi
push esi
push str.BAK_mailto_command
push ecx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4026cb
lea edx, [esp + 0x18]
push edx
call ebx
mov ecx, dword [esp + 0x10]
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 2
push esi
push esi
push ecx
call edi
mov edx, dword [esp + 0x10]
push str.BAK_mailto_command
push edx
call ebp
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x4026de
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], esi
mov eax, str.SOFTWAREClientsMail
test eax, eax
mov eax, 0x407798
je 0x4026f1
mov eax, str.SOFTWAREClientsMail
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push esi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402759
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push esi
push esi
push str.BAK_mail_softname
push ecx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402759
lea edx, [esp + 0x18]
push edx
call ebx
mov ecx, dword [esp + 0x10]
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 2
push esi
push esi
push ecx
call edi
mov edx, dword [esp + 0x10]
push str.BAK_mail_softname
push edx
call ebp
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x40276c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], esi
mov eax, str.SOFTWAREClientsMail
test eax, eax
mov eax, 0x407798
je 0x40277f
mov eax, str.SOFTWAREClientsMail
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push esi
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4027e7
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push esi
push esi
push str.BAK_CUser_mail_softname
push ecx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4027e7
lea edx, [esp + 0x18]
push edx
call ebx
mov ecx, dword [esp + 0x10]
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 2
push esi
push esi
push ecx
call edi
mov edx, dword [esp + 0x10]
push str.BAK_CUser_mail_softname
push edx
call ebp
mov eax, dword [esp + 0x10]
pop edi
cmp eax, esi
pop esi
pop ebp
pop ebx
je 0x4027fa
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x10c
ret