Function at 0x40ee10
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x44d8d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x43c
mov eax, dword [0x46514c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x14], eax
xor ebx, ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x454], ebx
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x4d]
mov byte [esp + 0x4c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x45c]
lea ecx, [esp + 0x14]
push eax
mov byte [esp + 0x458], 1
mov dword [esp + 0x20], 0x400
call fcn.0043ff85
mov ecx, dword [esp + 0x14]
push str..doc
push ecx
call fcn.0042344d
add esp, 8
test eax, eax
je 0x40eeb2
mov edx, dword [esp + 0x14]
push str..docx
push edx
call fcn.0042344d
add esp, 8
mov dword [esp + 0x30], 2
test eax, eax
jne 0x40eeba
mov dword [esp + 0x30], 1
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push ecx
push SysReAllocStringLen
call esi
cmp eax, ebx
jne 0x40f50d
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x4c]
push edx
push eax
push ebx
push ebx
push 0x46a8c8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov edi, eax
call ebp
cmp edi, ebx
mov dword [esp + 0x10], ebx
jne 0x40f50d
push str._shell
lea ecx, [esp + 0x3c]
call fcn.0043fe6a
mov edi, eax
mov eax, dword [0x46514c]
lea ecx, [esp + 0x4c]
push ecx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x458], 2
mov dword [esp + 0x2c], eax
call fcn.0043ff85
lea edx, [esp + 0x28]
push edi
lea eax, [esp + 0x48]
push edx
push eax
mov byte [esp + 0x460], 3
call fcn.0044002b
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x458], 4
call fcn.0043ff35
lea ecx, [esp + 0x44]
mov byte [esp + 0x454], 3
call fcn.0043fdfc
lea ecx, [esp + 0x28]
mov byte [esp + 0x454], 2
call fcn.0043fdfc
lea ecx, [esp + 0x38]
mov byte [esp + 0x454], 1
call fcn.0043fdfc
mov edx, dword [esp + 0x14]
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x4c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
push edx
push SysReAllocStringLen
call esi
cmp eax, ebx
mov dword [esp + 0x1c], 0x400
jne 0x40f50d
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x4c]
push eax
push ecx
push ebx
push ebx
push ebx
push edx
call edi
mov eax, dword [esp + 0x10]
push eax
call ebp
mov ecx, dword [0x46514c]
lea edx, [esp + 0x4c]
mov dword [esp + 0x18], ecx
push edx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], ebx
call fcn.0043ff85
mov eax, dword [esp + 0x18]
push str.Open
push eax
call fcn.0042344d
add esp, 8
lea ecx, [esp + 0x18]
test eax, eax
setne byte [esp + 0x2f]
call fcn.0043fdfc
cmp byte [esp + 0x2f], bl
je 0x40f0b5
push str.Open
lea ecx, [esp + 0x1c]
call fcn.0043fe6a
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
push 0x20006
push ebx
push ecx
push SysReAllocStringLen
call esi
cmp eax, ebx
mov dword [esp + 0x1c], 0x400
jne 0x40f099
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax - 8]
push ecx
push eax
push 1
push ebx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x40f099
mov byte [esp + 0x454], 1
lea ecx, [esp + 0x18]
jmp 0x40f508
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], ebx
mov byte [esp + 0x454], 1
call fcn.0043fdfc
lea ecx, [esp + 0x14]
push str.Opencommand
lea edx, [esp + 0x38]
push ecx
push edx
call fcn.00440091
mov ecx, dword [esp + 0x34]
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push ecx
push SysReAllocStringLen
mov byte [esp + 0x468], 6
call esi
cmp eax, ebx
jne 0x40f1b8
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x4c]
push edx
push eax
push ebx
push ebx
push ebx
push ecx
mov dword [esp + 0x34], 0x400
call edi
mov edx, dword [esp + 0x10]
mov edi, eax
push edx
call ebp
cmp edi, ebx
jne 0x40f4fc
mov ecx, dword [0x46514c]
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x4c]
mov dword [esp + 0x18], ecx
push edx
lea ecx, [esp + 0x1c]
mov byte [esp + eax + 0x50], bl
call fcn.0043ff85
lea ecx, [esp + 0x18]
mov byte [esp + 0x454], 7
call fcn.004402d5
push str..EXE_
lea ecx, [esp + 0x1c]
call fcn.004395e4
cmp eax, 0xffffffff
jne 0x40f172
mov byte [esp + 0x454], 6
lea ecx, [esp + 0x18]
jmp 0x40f4f7
add eax, 5
lea ecx, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0043956c
push eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x458], 8
call fcn.0043ff35
lea ecx, [esp + 0x20]
mov byte [esp + 0x454], 7
call fcn.0043fdfc
lea ecx, [esp + 0x18]
mov byte [esp + 0x454], 6
call fcn.0043fdfc
lea ecx, [esp + 0x14]
push 0x463e7c
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.00440091
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x458], 9
call fcn.0043ff35
lea ecx, [esp + 0x20]
mov byte [esp + 0x454], 6
call fcn.0043fdfc
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x4c]
rep stosd dword es:[edi], eax
mov eax, dword [0x46514c]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x30]
mov byte [esp + 0x454], 0xa
cmp eax, 1
jne 0x40f24a
lea ecx, [esp + 0x24]
push str.__t__n___1_
lea edx, [esp + 0x24]
push ecx
push edx
call fcn.00440091
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x458], 0xb
call fcn.0043ff35
mov byte [esp + 0x454], 0xa
lea ecx, [esp + 0x20]
jmp 0x40f27c
lea eax, [esp + 0x24]
push str.___1_
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.00440091
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x458], 0xc
call fcn.0043ff35
mov byte [esp + 0x454], 0xa
lea ecx, [esp + 0x20]
call fcn.0043fdfc
lea edx, [esp + 0x14]
push 0x463c48
lea eax, [esp + 0x24]
push edx
push eax
call fcn.00440091
mov eax, dword [eax]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
push eax
push SysReAllocStringLen
call esi
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.0043fdfc
cmp edi, ebx
mov dword [esp + 0x1c], 0x400
jne 0x40f2e5
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax - 8]
push ecx
push eax
push 1
push ebx
push 0x46a8c8
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
jne 0x40f4eb
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x14]
push str.ddeexec
lea edx, [esp + 0x2c]
push ecx
push edx
mov dword [esp + 0x1c], ebx
call fcn.00440091
mov eax, dword [0x46514c]
mov dword [esp + 0x44], eax
mov dword [esp + 0x38], eax
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x4c]
mov byte [esp + 0x454], 0xf
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x10]
push eax
push 0xf003f
push ebx
push ecx
push SysReAllocStringLen
call esi
cmp eax, ebx
mov dword [esp + 0x1c], 0x400
jne 0x40f3c7
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x44]
push edx
call fcn.0043ff85
lea eax, [esp + 0x14]
push str.ddeexec1234
lea ecx, [esp + 0x24]
push eax
push ecx
call fcn.00440091
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x458], 0x10
call fcn.0043ff35
lea ecx, [esp + 0x20]
mov byte [esp + 0x454], 0xf
call fcn.0043fdfc
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x48]
push edx
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x40]
push ebx
push 0x46a8c8
push edx
call fcn.0040f550
mov eax, dword [esp + 0x48]
push eax
call ebp
mov dword [esp + 0x48], ebx
mov ecx, dword [esp + 0x10]
push ecx
call ebp
lea edx, [esp + 0x14]
push 0x463c48
lea eax, [esp + 0x40]
push edx
push eax
mov dword [esp + 0x1c], ebx
call fcn.00440091
push eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x458], 0x11
call fcn.0043ff35
lea ecx, [esp + 0x3c]
mov byte [esp + 0x454], 0xf
call fcn.0043fdfc
mov edx, dword [esp + 0x28]
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x4c]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push ebx
push edx
push SysReAllocStringLen
call esi
cmp eax, ebx
mov dword [esp + 0x1c], 0x400
jne 0x40f4ad
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x40]
push ecx
push edx
push ebx
push str.command
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x40f4ad
mov ecx, dword [esp + 0x10]
push str.command
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [0x46514c]
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], edx
call fcn.0043ff85
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
mov ecx, dword [eax - 8]
push ecx
mov ecx, dword [esp + 0x40]
push eax
push ecx
push ebx
push str.command4321
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x30]
call fcn.0043fdfc
mov eax, dword [esp + 0x10]
push eax
call ebp
lea ecx, [esp + 0x38]
mov dword [esp + 0x10], ebx
mov byte [esp + 0x454], 0xe
call fcn.0043fdfc
lea ecx, [esp + 0x44]
mov byte [esp + 0x454], 0xd
call fcn.0043fdfc
lea ecx, [esp + 0x28]
mov byte [esp + 0x454], 0xa
call fcn.0043fdfc
mov byte [esp + 0x454], 6
lea ecx, [esp + 0x40]
call fcn.0043fdfc
mov byte [esp + 0x454], 1
lea ecx, [esp + 0x34]
call fcn.0043fdfc
lea ecx, [esp + 0x24]
mov byte [esp + 0x454], bl
call fcn.0043fdfc
lea ecx, [esp + 0x14]
mov dword [esp + 0x454], 0xffffffff
call fcn.0043fdfc
mov ecx, dword [esp + 0x44c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x448
ret 4