Function at 0x401660
Capabilities:
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x2a4
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push str.SccAddIn.SourceCodeControlAddIn
mov dword [esp + 0x24], ecx
push 0x80000000
call ebx
xor ecx, ecx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
sete cl
mov ebp, ecx
test ebp, ebp
je 0x4016cd
push str.2F998FDA_3487_11CE_BCB6_00AA00688899
call edi
mov edx, dword [esp + 0x10]
push eax
push str.2F998FDA_3487_11CE_BCB6_00AA00688899
push 1
push str.CLSID
push edx
call esi
mov edx, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
sete cl
push edx
and ebp, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x4017d4
push str.2F998FDA_3487_11CE_BCB6_00AA00688899
push str.CLSID
lea eax, [esp + 0x2c]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
push edx
push 0x80000000
call ebx
xor ecx, ecx
test eax, eax
sete cl
and ebp, ecx
je 0x4017d0
push str.Source_Code_Control_Add_In
call edi
push eax
push str.Source_Code_Control_Add_In
lea edx, [esp + 0x2c]
push 1
push edx
push 0x80000000
call esi
mov edx, dword [esp + 0x2b8]
xor ecx, ecx
test eax, eax
push str.ssvb.dll
lea eax, [esp + 0xa8]
sete cl
push edx
push eax
and ebp, ecx
call fcn.004012b0
add esp, 0xc
lea ecx, [esp + 0xa4]
push ecx
call edi
lea edx, [esp + 0xa4]
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push str.InProcServer32
push eax
call esi
xor ecx, ecx
push str.SccAddIn.SourceCodeControlAddIn
test eax, eax
sete cl
and ebp, ecx
call edi
mov edx, dword [esp + 0x10]
push eax
push str.SccAddIn.SourceCodeControlAddIn
push 1
push str.ProgID
push edx
call esi
xor ecx, ecx
push str.SccAddIn.SourceCodeControlAddIn
test eax, eax
sete cl
and ebp, ecx
call edi
mov edx, dword [esp + 0x10]
push eax
push str.SccAddIn.SourceCodeControlAddIn
push 1
push str.VersionIndependentProgID
push edx
call esi
mov edx, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
sete cl
push edx
and ebp, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
jne 0x4017e4
mov ecx, dword [esp + 0x1c]
push 0x30
push 0xfa6
call fcn.00401b20
lea eax, [esp + 0x10]
push eax
push str.VBScc
push 0x80000000
call ebx
xor ebx, ebx
test eax, eax
sete bl
test ebx, ebx
je 0x401a6f
push str.Source_Code_Control_Add_In
call edi
push eax
push str.Source_Code_Control_Add_In
push 1
push str.VBScc
push 0x80000000
call esi
xor ecx, ecx
push str.D36C6852_3C6E_11CF_A880_00AA00A14D34
test eax, eax
sete cl
and ebx, ecx
call edi
mov edx, dword [esp + 0x10]
push eax
push str.D36C6852_3C6E_11CF_A880_00AA00A14D34
push 1
push str.CLSID
push edx
call esi
mov edx, dword [esp + 0x10]
xor ecx, ecx
test eax, eax
sete cl
push edx
and ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x401a6f
push str.D36C6852_3C6E_11CF_A880_00AA00A14D34
push str.CLSID
lea eax, [esp + 0x2c]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xor ecx, ecx
test eax, eax
sete cl
and ebx, ecx
je 0x401a6b
push str.Source_Code_Control_Add_In
call edi
push eax
push str.Source_Code_Control_Add_In
lea edx, [esp + 0x2c]
push 1
push edx
push 0x80000000
call esi
lea edx, [esp + 0x14]
xor ecx, ecx
push edx
push 0x20019
test eax, eax
push 0
push str.SoftwareMicrosoftVisualStudio6.0SetupMicrosoft_Visual_Basic
sete cl
push 0x80000002
and ebx, ecx
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40193a
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1a8]
push eax
push ecx
push 0
push 0
push str.ProductDir
push edx
mov dword [esp + 0x30], 0x109
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x1a8]
push str._vbscc.dll
lea edx, [esp + 0xa8]
push ecx
push edx
jmp 0x4019d6
lea eax, [esp + 0x14]
push eax
push 0x20019
push 0
push str.VisualBasic.Project_shellopencommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4019e6
lea ecx, [esp + 0x20]
lea edx, [esp + 0x1a8]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x24]
push 0x41edc0
push eax
mov dword [esp + 0x38], 0x109
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x1a8]
push 0x5c
push edx
call fcn.00401310
add esp, 8
cmp eax, 0xffffffff
je 0x4019e6
inc eax
lea ecx, [esp + 0x1a8]
push eax
lea eax, [esp + 0x1ac]
push eax
push ecx
call fcn.004012d0
add esp, 0xc
lea edx, [esp + 0x1a8]
lea eax, [esp + 0xa4]
push str.vbscc.dll
push edx
push eax
call fcn.004012b0
add esp, 0xc
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x18]
test eax, eax
je 0x401a60
lea ecx, [esp + 0xa4]
push ecx
call edi
lea edx, [esp + 0xa4]
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push str.InProcServer32
push eax
call esi
xor ecx, ecx
push str.VBScc
test eax, eax
sete cl
and ebx, ecx
call edi
mov edx, dword [esp + 0x10]
push eax
push str.VBScc
push 1
push str.ProgID
push edx
call esi
xor ecx, ecx
push str.VBScc
test eax, eax
sete cl
and ebx, ecx
call edi
mov edx, dword [esp + 0x10]
push eax
push str.VBScc
push 1
push str.VersionIndependentProgID
push edx
call esi
xor ecx, ecx
test eax, eax
sete cl
and ebx, ecx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x401a7f
mov ecx, dword [esp + 0x1c]
push 0x30
push 0xfa7
call fcn.00401b20
test ebp, ebp
je 0x401a99
test ebx, ebx
je 0x401a99
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2a4
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2a4
ret 4