Function at 0x409ca6
Capabilities:
Check os version
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1420
call fcn.00410ea0
push ebx
push esi
xor ebx, ebx
push edi
lea eax, [ebp - 8]
push ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push eax
push ebx
push 0xf003f
mov esi, 0x41c4f4
push ebx
push esi
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push 0x80000002
call edi
test eax, eax
jne 0x409d6c
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push esi
push ebx
push str.0055C089_8582_441B_A0BF_17B458C2A3A8
push dword [ebp - 8]
call edi
test eax, eax
jne 0x409d5b
push 5
mov esi, str.IDM_Helper
pop ecx
lea edi, [ebp - 0x6c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x6c]
push eax
movsw word es:[edi], word [esi]
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x6c]
push eax
push 1
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
push edi
push ebx
push ebx
push dword [ebp - 4]
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push str.NoExplorer
push dword [ebp - 4]
mov dword [ebp - 0xc], edi
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
jmp 0x409d61
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x409d72
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x1020]
push eax
lea eax, [ebp - 0x1220]
push eax
lea eax, [ebp - 0x1420]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x41c928
call sub.MSVCRT.dll__wsplitpath
add esp, 0x14
lea eax, [ebp - 0x1020]
push eax
lea eax, [ebp - 0x1220]
push eax
lea eax, [ebp - 0x810]
push 0x4156e4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x1420]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x2ec]
push 0x4156e4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x2ec]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x14
cmp eax, 1
jle 0x409e01
cmp word [ebp + eax*2 - 0x2ee], 0x5c
lea eax, [ebp + eax*2 - 0x2ee]
jne 0x409e01
mov word [eax], bx
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push 0x41c4f4
push ebx
push str.SoftwareMicrosoftInternet_ExplorerLow_Rights
push 0x80000002
call edi
test eax, eax
jne 0x40a02f
push dword [ebp - 4]
mov dword [ebp - 0xc], 3
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push 0x41c4f4
push ebx
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicy
push 0x80000002
call edi
test eax, eax
jne 0x409f76
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push 0x41c4f4
push ebx
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicyE0DACC63_037F_46EE_AC02_E4C7B0FBFEB4
push 0x80000002
call edi
test eax, eax
jne 0x409ef0
lea eax, [ebp - 0x810]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x810]
push eax
push 1
push ebx
push str.AppName
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x2ec]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2ec]
push eax
push 1
push ebx
push str.AppPath
push dword [ebp - 4]
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push str.Policy
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push 0x41c4f4
push ebx
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicy1902485B_CE75_42C1_BA2D_57E660793D9A
push 0x80000001
call edi
test eax, eax
jne 0x409f76
push str.IEMonitor.exe
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.IEMonitor.exe
push 1
push ebx
push str.AppName
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x2ec]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2ec]
push eax
push 1
push ebx
push str.AppPath
push dword [ebp - 4]
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push str.Policy
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push 0x41c4f4
push ebx
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsDragDrop
push 0x80000002
call edi
test eax, eax
jne 0x40a02f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push 0x41c4f4
push ebx
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsDragDropF6E1B27E_F2DA_4919_9DBD_CAB90A1D662B
push 0x80000002
call edi
test eax, eax
jne 0x40a02f
lea eax, [ebp - 0x810]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x810]
push eax
push 1
push ebx
push str.AppName
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x2ec]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2ec]
push eax
push 1
push ebx
push str.AppPath
push dword [ebp - 4]
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push str.Policy
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.IDMan.CIDMLinkTransmitter
push 0x80000000
call edi
test eax, eax
jne 0x40a099
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.CLSID
push dword [ebp - 8]
call edi
test eax, eax
jne 0x40a090
push str.AC746233_E9D3_49CD_862F_068F7B7CCCA4
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.AC746233_E9D3_49CD_862F_068F7B7CCCA4
push 1
push ebx
push ebx
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.CLSIDAC746233_E9D3_49CD_862F_068F7B7CCCA4
push 0x80000000
call edi
test eax, eax
jne 0x40a164
push str.IDMan.CIDMLinkTransmitter
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.IDMan.CIDMLinkTransmitter
push 1
push ebx
push ebx
push dword [ebp - 8]
call esi
push str.AC746233_E9D3_49CD_862F_068F7B7CCCA4
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.AC746233_E9D3_49CD_862F_068F7B7CCCA4
push 1
push ebx
push str.AppID
push dword [ebp - 8]
call esi
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.LocalServer32
push dword [ebp - 8]
call edi
test eax, eax
jne 0x40a15b
push 0x41c928
lea eax, [ebp - 0xa18]
push str.__s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xa18]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xa18]
push eax
push 1
push ebx
push ebx
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.AC746233_E9D3_49CD_862F_068F7B7CCCA4
lea eax, [ebp - 0xe20]
push str.AppID_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0xe20]
push ebx
push eax
push 0x80000000
call edi
test eax, eax
jne 0x40a201
push str.IDMan
mov dword [ebp - 0xc], 1
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.IDMan
push 1
push ebx
push ebx
push dword [ebp - 8]
call esi
push str.Interactive_User
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.Interactive_User
push 1
push ebx
push str.RunAs
push dword [ebp - 8]
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push str.ROTFlags
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.AC746233_E9D3_49CD_862F_068F7B7CCCA4
lea eax, [ebp - 0xe20]
push str.SOFTWAREClassesAppID_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0xe20]
push ebx
push eax
push 0x80000002
call edi
test eax, eax
jne 0x40a29e
push str.IDMan
mov dword [ebp - 0xc], 1
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.IDMan
push 1
push ebx
push ebx
push dword [ebp - 8]
call esi
push str.Interactive_User
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.Interactive_User
push 1
push ebx
push str.RunAs
push dword [ebp - 8]
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push str.ROTFlags
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x608]
push str._sIDManTypeInfo.tlb
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x608]
push 1
push eax
call dword [sym.imp.OLEAUT32.dll_SystemTimeToVariantTime]
test eax, eax
jne 0x40a2e6
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x608]
push str._sIDMGetAll.dll
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x608]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x40a32f
push str.DllRegisterServer
push eax
call esi
cmp eax, ebx
je 0x40a326
call eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x608]
push str._sIDMIECC.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x608]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x40a376
push str.DllRegisterServer
push eax
call esi
cmp eax, ebx
je 0x40a36d
call eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x608]
push str._sdownlWithIDM.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x608]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x40a3bd
push str.DllRegisterServer
push eax
call esi
cmp eax, ebx
je 0x40a3b4
call eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x608]
push str._sidmfsa.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x608]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x40a404
push str.DllRegisterServer
push eax
call esi
cmp eax, ebx
je 0x40a3fb
call eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00403110
test eax, eax
je 0x40a651
cmp dword [0x41de60], ebx
jne 0x40a651
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push 0xf013f
mov esi, 0x41c4f4
push ebx
push esi
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push 0x80000002
call edi
test eax, eax
jne 0x40a4c6
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf013f
push ebx
push esi
push ebx
push str.0055C089_8582_441B_A0BF_17B458C2A3A8
push dword [ebp - 8]
call edi
test eax, eax
jne 0x40a4bd
push 5
mov esi, str.IDM_Helper
pop ecx
lea edi, [ebp - 0x6c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x6c]
push eax
movsw word es:[edi], word [esi]
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x6c]
push eax
push 1
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
push edi
push ebx
push ebx
push dword [ebp - 4]
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push str.NoExplorer
push dword [ebp - 4]
mov dword [ebp - 0xc], edi
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, 0x41c4f4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0xc20]
push str._s___sIDMIECC64.dll_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x3c
lea eax, [ebp - 0xe4]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
mov dword [ebp - 0xe4], 0x3c
mov dword [ebp - 0xe0], 0x40
mov dword [ebp - 0xd8], str.open
mov dword [ebp - 0xd4], str.regsvr32.exe
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], 3
mov dword [ebp - 0xc4], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xdc], eax
lea eax, [ebp - 0xc20]
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0xe4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0xc20]
push str._s___sIDMGetAll64.dll_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x3c
lea eax, [ebp - 0xa8]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
mov dword [ebp - 0xa8], 0x3c
mov dword [ebp - 0xa4], 0x40
mov dword [ebp - 0x9c], str.open
mov dword [ebp - 0x98], str.regsvr32.exe
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], 3
mov dword [ebp - 0x88], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xc20]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0xc20]
push str._s___sdownlWithIDM64.dll_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x3c
lea eax, [ebp - 0x4c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
mov dword [ebp - 0x40], str.open
mov dword [ebp - 0x3c], str.regsvr32.exe
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0xc20]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x40a656
mov esi, 0x41c4f4
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push str.SoftwareMozilla
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40a697
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push esi
push ebx
push str.SoftwareMozilla
push 0x80000002
call edi
test eax, eax
jne 0x40a6a0
push dword [ebp - 4]
jmp 0x40a69a
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00403110
test eax, eax
je 0x40a6f3
lea eax, [ebp - 8]
push eax
push 0x20119
push ebx
push str.SoftwareMozilla
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40a6ea
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf013f
push ebx
push esi
push ebx
push str.SoftwareMozilla
push 0x80000002
call edi
test eax, eax
jne 0x40a6f3
push dword [ebp - 4]
jmp 0x40a6ed
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x400]
mov dword [ebp - 0x400], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a83f
cmp dword [ebp - 0x3f0], 2
jne 0x40a83f
cmp dword [ebp - 0x3fc], 6
jb 0x40a83f
call fcn.00409aa9
cmp dword [ebp - 0x3f8], ebx
ja 0x40a746
cmp dword [ebp - 0x3fc], 6
jbe 0x40a83f
push 0x3c
lea eax, [ebp - 0x4c]
push ebx
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x2ec]
add esp, 0xc
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
mov dword [ebp - 0x40], str.open
mov dword [ebp - 0x3c], str.idmBroker.exe
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x38], str._RegServer
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push esi
push ebx
push str.CLSID0055C089_8582_441B_A0BF_17B458C2A3A8Implemented_Categories
push 0x80000000
call edi
test eax, eax
jne 0x40a7ea
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push esi
push ebx
push str.59FB2056_D625_48D0_A944_1A85B5AB2640
push dword [ebp - 8]
call edi
test eax, eax
jne 0x40a7e1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00403110
test eax, eax
je 0x40a83f
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push 0xf013f
push ebx
push esi
push ebx
push str.CLSID0055C089_8582_441B_A0BF_17B458C2A3A8Implemented_Categories
push 0x80000000
call edi
test eax, eax
jne 0x40a83f
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf013f
push ebx
push esi
push ebx
push str.59FB2056_D625_48D0_A944_1A85B5AB2640
push dword [ebp - 8]
call edi
test eax, eax
jne 0x40a836
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
pop ebx
leave
ret