Function at 0x1000342b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3cc]
sub esp, 0x44c
mov eax, dword [0x10071ef0]
xor eax, ebp
mov dword [ebp + 0x3c8], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x206
lea eax, [ebp + 0x19e]
push ebx
push eax
mov word [ebp + 0x19c], bx
call sub.MSVCR80.dll_memset
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.
mov esi, 0x104
lea eax, [ebp + 0x19c]
push esi
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
mov eax, dword [ebp + 0x3d4]
push dword [eax*4 + 0x1006d514]
lea eax, [ebp + 0x19c]
push esi
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0x24
push 8
pop ecx
xor eax, eax
lea edi, [ebp + 0x3a6]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp + 0x3a4], bx
mov dword [ebp - 0x7c], 0x24
mov byte [ebp - 0x6d], bl
call fcn.100054fb
test eax, eax
mov edi, SysReAllocStringLen
je 0x10003567
push 0x206
lea eax, [ebp - 0x6a]
push ebx
push eax
mov word [ebp - 0x6c], bx
call sub.MSVCR80.dll_memset
lea eax, [ebp + 0x19c]
push eax
lea eax, [ebp - 0x6c]
push esi
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
push str.OpenWithProgids
lea eax, [ebp - 0x6c]
push esi
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0x24
lea eax, [ebp - 0x78]
push eax
push 0xf013f
push ebx
lea eax, [ebp - 0x6c]
push eax
push edi
mov dword [ebp - 0x78], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x78], ebx
je 0x10003551
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push str.DAEMON.Tools.Lite
push dword [ebp - 0x78]
mov dword [ebp - 0x80], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x10003544
cmp eax, ebx
jne 0x10003548
mov byte [ebp - 0x6d], 1
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10044d70
lea eax, [ebp + 0x19c]
push esi
push eax
call dword [sym.imp.MSVCR80.dll_wcscat_s]
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
mov esi, 0x20019
push esi
push ebx
lea eax, [ebp + 0x19c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x74], ebx
jne 0x100035a9
push ebx
lea eax, [ebp - 0x74]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
lea eax, [ebp + 0x19c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 0x74], ebx
jne 0x100035a9
xor al, al
jmp 0x1000365b
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x3a4]
push eax
push ebx
push ebx
push str.Progid
push dword [ebp - 0x74]
call esi
mov edi, eax
cmp edi, ebx
jne 0x10003603
lea eax, [ebp + 0x3a4]
push eax
push str.DAEMON.Tools.Lite
call dword [sym.imp.MSVCR80.dll_wcscmp]
neg eax
sbb al, al
inc al
cmp byte [ebp + 0x3d8], bl
pop ecx
pop ecx
mov byte [ebp - 0x6d], al
jne 0x1000364f
cmp word [ebp + 0x3a4], bx
je 0x100035fe
cmp al, bl
je 0x1000364b
mov byte [ebp - 0x6d], bl
jmp 0x1000364f
cmp edi, 0xea
jne 0x10003613
cmp byte [ebp + 0x3d8], bl
je 0x1000364b
call fcn.100054fb
test eax, eax
jne 0x1000364f
cmp edi, 2
jne 0x1000364f
cmp byte [ebp + 0x3d8], bl
jne 0x1000364f
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x3a4]
push eax
push ebx
push ebx
push 0x10044d48
push dword [ebp - 0x74]
call esi
cmp eax, ebx
je 0x1000364b
cmp eax, 0xea
jne 0x1000364f
mov byte [ebp - 0x6d], 1
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 0x6d]
mov ecx, dword [ebp + 0x3c8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003e70b
add ebp, 0x3cc
leave
ret