Function at 0x408178
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
push 0x84c
mov eax, 0x4337ef
call fcn.00432eed
mov eax, ecx
mov dword [ebp - 0x83c], eax
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x844], ecx
mov byte [ebp - 0x815], cl
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x828], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], ecx
mov dword [ebp - 0x834], ecx
mov dword [ebp - 0x824], ecx
test eax, eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x838]
mov ecx, str.SOFTWAREMicrosoftSharedHTML
push eax
mov esi, str.SOFTWAREMicrosoftSharedMHTML
cmove esi, ecx
push 0x20019
push ecx
mov edx, esi
mov ecx, reloc.AppVIsvSubsystems32.dll_Ordinal_1
call fcn.0040c5c8
mov edi, str.Default_Editor
test eax, eax
jne 0x408202
mov ecx, dword [ebp - 0x838]
mov edx, edi
call fcn.0040976b
lea eax, [ebp - 0x828]
mov edx, esi
push eax
push 0x20019
push ecx
mov ecx, 0x80000002
call fcn.0040c5c8
test eax, eax
jne 0x40822c
mov ecx, dword [ebp - 0x828]
mov edx, edi
call fcn.0040976b
lea eax, [ebp - 0x834]
mov esi, 0x20019
push eax
push esi
push ecx
mov ecx, dword [ebp - 0x828]
mov edx, str.Old_Default_Editor
call fcn.0040c5c8
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x408271
lea eax, [ebp - 0x824]
mov edx, str.shell
push eax
push esi
push ecx
mov ecx, dword [ebp - 0x834]
call fcn.0040c5c8
test eax, eax
je 0x40828b
lea ecx, [ebp - 0x824]
call fcn.00408ba9
test eax, eax
je 0x408580
mov byte [ebp - 0x815], 1
mov ecx, dword [ebp - 0x83c]
call fcn.00409e35
mov dword [ebp - 0x840], eax
test eax, eax
je 0x4082f8
mov bl, byte [ebp - 0x815]
mov esi, eax
xor edi, edi
push 0x3b
pop edx
mov ecx, esi
call fcn.0040bda3
mov dword [ebp - 0x82c], eax
test eax, eax
je 0x4082c3
xor ecx, ecx
mov word [eax], cx
cmp word [esi], di
je 0x4082df
movzx eax, bl
mov edx, esi
push eax
push dword [ebp - 0x824]
call fcn.00408615
mov eax, dword [ebp - 0x82c]
mov esi, eax
add eax, 2
neg esi
sbb esi, esi
and esi, eax
jne 0x4082aa
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x830]
xor esi, esi
lea edx, [ebp - 0x81c]
push esi
push dword [ebp - 0x83c]
mov ecx, 0x80000002
mov dword [ebp - 0x81c], esi
call fcn.00406277
test eax, eax
je 0x40832c
push str.KnownIDs
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x81c], esi
je 0x40833c
push dword [ebp - 0x81c]
call edi
mov edi, dword [ebp - 0x83c]
mov edx, edi
mov ecx, esi
call fcn.00407fcb
inc esi
cmp esi, 9
jb 0x408342
test edi, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x4084f1
xor ecx, ecx
lea eax, [ebp - 0x858]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x81c]
mov dword [ebp - 0x848], ecx
push eax
lea eax, [ebp - 0x814]
mov dword [ebp - 0x82c], ecx
push eax
mov esi, ecx
push ecx
jmp 0x4084d4
xor eax, eax
mov dword [ebp - 0x81c], eax
lea eax, [ebp - 0x81c]
push eax
push 0x2001f
push ecx
lea edx, [ebp - 0x814]
mov ecx, Ordinal_1
call fcn.0040c5c8
test eax, eax
jne 0x40849d
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 5
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x81c]
mov edx, 0x4377b8
call fcn.0040c5c8
test eax, eax
jne 0x40848c
mov ecx, dword [ebp - 0x820]
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x830]
xor edx, edx
push eax
call fcn.004098ff
test eax, eax
je 0x4085e1
mov ebx, dword [ebp - 0x830]
test ebx, ebx
je 0x408465
mov ecx, str.msohtmed.exe
call fcn.0040bd8c
dec eax
mov ecx, ebx
mov dword [ebp - 0x84c], eax
jmp 0x408455
push dword [ebp - 0x84c]
lea eax, [esi + 2]
mov edx, 0x438386
mov ecx, eax
mov dword [ebp - 0x850], eax
call fcn.0040bf47
test eax, eax
jne 0x408469
mov ecx, dword [ebp - 0x850]
cmp word [ecx], ax
je 0x408486
push 0x6d
pop edx
call fcn.0040bdf6
mov esi, eax
test esi, esi
jne 0x40842b
jmp 0x408469
xor eax, eax
mov esi, eax
test esi, esi
je 0x408486
movzx eax, byte [ebp - 0x815]
lea edx, [ebp - 0x814]
push eax
push dword [ebp - 0x824]
call fcn.00408615
mov esi, dword [ebp - 0x82c]
cmp dword [ebp - 0x820], 0
je 0x40849d
push dword [ebp - 0x820]
call edi
mov byte [ebp - 4], 3
cmp dword [ebp - 0x81c], 0
je 0x4084b2
push dword [ebp - 0x81c]
call edi
lea eax, [ebp - 0x858]
inc esi
push eax
xor eax, eax
mov dword [ebp - 0x82c], esi
push eax
push eax
push eax
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x814]
push eax
push esi
push Ordinal_1
mov dword [ebp - 0x81c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40838d
mov ecx, dword [ebp - 0x83c]
call fcn.004086d2
mov ecx, dword [ebp - 0x828]
mov edx, str.Old_Default_Editor
call fcn.0040976b
mov dword [ebp - 0x844], 1
mov ecx, dword [ebp - 0x840]
test ecx, ecx
je 0x408525
call fcn.00401cf4
test ebx, ebx
je 0x408580
lea esi, [ebx - 0xc]
cmp esi, ebx
jae 0x408580
mov eax, dword [esi]
xor edx, edx
add eax, ebx
mov ecx, edx
mov dword [ebp - 0x840], eax
xor eax, eax
inc eax
test al, al
je 0x408553
cmp byte [ecx + esi + 4], 0xab
sete al
inc ecx
cmp ecx, 8
jb 0x408541
mov ebx, dword [ebp - 0x840]
mov ecx, edx
test al, al
je 0x408573
mov dl, byte [ecx + ebx]
cmp dl, 0xab
sete al
inc ecx
cmp ecx, 8
jb 0x40855b
cmp dl, 0xab
je 0x408579
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 0x824], 0
je 0x408591
push dword [ebp - 0x824]
call edi
xor ebx, ebx
mov dword [ebp - 0x824], ebx
cmp dword [ebp - 0x834], ebx
je 0x4085a9
push dword [ebp - 0x834]
call edi
mov dword [ebp - 0x834], ebx
cmp dword [ebp - 0x838], ebx
je 0x4085bf
push dword [ebp - 0x838]
call edi
mov dword [ebp - 0x838], ebx
cmp dword [ebp - 0x828], ebx
je 0x4085d5
push dword [ebp - 0x828]
call edi
mov eax, dword [ebp - 0x844]
call fcn.00432ea2
ret
cmp dword [ebp - 0x820], 0
je 0x4085f2
push dword [ebp - 0x820]
call edi
xor eax, eax
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x81c], eax
je 0x40860a
push dword [ebp - 0x81c]
call edi
mov ebx, dword [ebp - 0x830]
jmp 0x408516