Function at 0x4096b4
Capabilities:
Check os version
Create process on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1420
call fcn.004105c0
push ebx
push esi
xor ebx, ebx
push edi
lea eax, [ebp - 8]
push ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push eax
push ebx
push 0xf003f
mov esi, 0x41b124
push ebx
push esi
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push 0x80000002
call edi
test eax, eax
jne 0x40977a
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push esi
push ebx
push str.0055C089_8582_441B_A0BF_17B458C2A3A8
push dword [ebp - 8]
call edi
test eax, eax
jne 0x409769
push 5
mov esi, str.IDM_Helper
pop ecx
lea edi, [ebp - 0x6c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x6c]
push eax
movsw word es:[edi], word [esi]
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x6c]
push eax
push 1
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
push edi
push ebx
push ebx
push dword [ebp - 4]
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push str.NoExplorer
push dword [ebp - 4]
mov dword [ebp - 0xc], edi
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
jmp 0x40976f
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x409780
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x1020]
push eax
lea eax, [ebp - 0x1220]
push eax
lea eax, [ebp - 0x1420]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x41b558
call sub.MSVCRT.dll__wsplitpath
add esp, 0x14
lea eax, [ebp - 0x1020]
push eax
lea eax, [ebp - 0x1220]
push eax
lea eax, [ebp - 0x810]
push 0x4146e4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x1420]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x2ec]
push 0x4146e4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x2ec]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x14
cmp eax, 1
jle 0x40980f
cmp word [ebp + eax*2 - 0x2ee], 0x5c
lea eax, [ebp + eax*2 - 0x2ee]
jne 0x40980f
mov word [eax], bx
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push 0x41b124
push ebx
push str.SoftwareMicrosoftInternet_ExplorerLow_Rights
push 0x80000002
call edi
test eax, eax
jne 0x409a3d
push dword [ebp - 4]
mov dword [ebp - 0xc], 3
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push 0x41b124
push ebx
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicy
push 0x80000002
call edi
test eax, eax
jne 0x409984
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push 0x41b124
push ebx
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicyE0DACC63_037F_46EE_AC02_E4C7B0FBFEB4
push 0x80000002
call edi
test eax, eax
jne 0x4098fe
lea eax, [ebp - 0x810]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x810]
push eax
push 1
push ebx
push str.AppName
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x2ec]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2ec]
push eax
push 1
push ebx
push str.AppPath
push dword [ebp - 4]
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push str.Policy
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push 0x41b124
push ebx
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicy1902485B_CE75_42C1_BA2D_57E660793D9A
push 0x80000001
call edi
test eax, eax
jne 0x409984
push str.IEMonitor.exe
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.IEMonitor.exe
push 1
push ebx
push str.AppName
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x2ec]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2ec]
push eax
push 1
push ebx
push str.AppPath
push dword [ebp - 4]
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push str.Policy
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push 0x41b124
push ebx
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsDragDrop
push 0x80000002
call edi
test eax, eax
jne 0x409a3d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push 0x41b124
push ebx
push str.SoftwareMicrosoftInternet_ExplorerLow_RightsDragDropF6E1B27E_F2DA_4919_9DBD_CAB90A1D662B
push 0x80000002
call edi
test eax, eax
jne 0x409a3d
lea eax, [ebp - 0x810]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x810]
push eax
push 1
push ebx
push str.AppName
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x2ec]
push eax
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2ec]
push eax
push 1
push ebx
push str.AppPath
push dword [ebp - 4]
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push str.Policy
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.IDMan.CIDMLinkTransmitter
push 0x80000000
call edi
test eax, eax
jne 0x409aa7
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.CLSID
push dword [ebp - 8]
call edi
test eax, eax
jne 0x409a9e
push str.AC746233_E9D3_49CD_862F_068F7B7CCCA4
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.AC746233_E9D3_49CD_862F_068F7B7CCCA4
push 1
push ebx
push ebx
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.CLSIDAC746233_E9D3_49CD_862F_068F7B7CCCA4
push 0x80000000
call edi
test eax, eax
jne 0x409b72
push str.IDMan.CIDMLinkTransmitter
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.IDMan.CIDMLinkTransmitter
push 1
push ebx
push ebx
push dword [ebp - 8]
call esi
push str.AC746233_E9D3_49CD_862F_068F7B7CCCA4
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.AC746233_E9D3_49CD_862F_068F7B7CCCA4
push 1
push ebx
push str.AppID
push dword [ebp - 8]
call esi
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.LocalServer32
push dword [ebp - 8]
call edi
test eax, eax
jne 0x409b69
push 0x41b558
lea eax, [ebp - 0xa18]
push str.__s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xa18]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xa18]
push eax
push 1
push ebx
push ebx
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.AC746233_E9D3_49CD_862F_068F7B7CCCA4
lea eax, [ebp - 0xe20]
push str.AppID_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0xe20]
push ebx
push eax
push 0x80000000
call edi
test eax, eax
jne 0x409c0f
push str.IDMan
mov dword [ebp - 0xc], 1
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.IDMan
push 1
push ebx
push ebx
push dword [ebp - 8]
call esi
push str.Interactive_User
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.Interactive_User
push 1
push ebx
push str.RunAs
push dword [ebp - 8]
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push str.ROTFlags
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.AC746233_E9D3_49CD_862F_068F7B7CCCA4
lea eax, [ebp - 0xe20]
push str.SOFTWAREClassesAppID_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0xe20]
push ebx
push eax
push 0x80000002
call edi
test eax, eax
jne 0x409cac
push str.IDMan
mov dword [ebp - 0xc], 1
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.IDMan
push 1
push ebx
push ebx
push dword [ebp - 8]
call esi
push str.Interactive_User
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
push str.Interactive_User
push 1
push ebx
push str.RunAs
push dword [ebp - 8]
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push str.ROTFlags
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x608]
push str._sIDManTypeInfo.tlb
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
lea eax, [ebp - 0x608]
push 1
push eax
call dword [sym.imp.OLEAUT32.dll_SystemTimeToVariantTime]
test eax, eax
jne 0x409cf4
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x608]
push str._sIDMGetAll.dll
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x608]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x409d3d
push str.DllRegisterServer
push eax
call esi
cmp eax, ebx
je 0x409d34
call eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x608]
push str._sIDMIECC.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x608]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x409d84
push str.DllRegisterServer
push eax
call esi
cmp eax, ebx
je 0x409d7b
call eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x608]
push str._sdownlWithIDM.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x608]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x409dcb
push str.DllRegisterServer
push eax
call esi
cmp eax, ebx
je 0x409dc2
call eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0x608]
push str._sidmfsa.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x608]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x409e12
push str.DllRegisterServer
push eax
call esi
cmp eax, ebx
je 0x409e09
call eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call fcn.00403037
test eax, eax
je 0x40a053
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push 0xf013f
mov esi, 0x41b124
push ebx
push esi
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
push 0x80000002
call edi
test eax, eax
jne 0x409ec8
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf013f
push ebx
push esi
push ebx
push str.0055C089_8582_441B_A0BF_17B458C2A3A8
push dword [ebp - 8]
call edi
test eax, eax
jne 0x409ebf
push 5
mov esi, str.IDM_Helper
pop ecx
lea edi, [ebp - 0x6c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x6c]
push eax
movsw word es:[edi], word [esi]
call sub.MSVCRT.dll_wcslen
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x6c]
push eax
push 1
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
push edi
push ebx
push ebx
push dword [ebp - 4]
call esi
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push str.NoExplorer
push dword [ebp - 4]
mov dword [ebp - 0xc], edi
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, 0x41b124
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0xc20]
push str._s___sIDMIECC64.dll_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x3c
lea eax, [ebp - 0xe4]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
mov dword [ebp - 0xe4], 0x3c
mov dword [ebp - 0xe0], 0x40
mov dword [ebp - 0xd8], str.open
mov dword [ebp - 0xd4], str.regsvr32.exe
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], 3
mov dword [ebp - 0xc4], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xdc], eax
lea eax, [ebp - 0xc20]
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0xe4]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0xc20]
push str._s___sIDMGetAll64.dll_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x3c
lea eax, [ebp - 0xa8]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
mov dword [ebp - 0xa8], 0x3c
mov dword [ebp - 0xa4], 0x40
mov dword [ebp - 0x9c], str.open
mov dword [ebp - 0x98], str.regsvr32.exe
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], 3
mov dword [ebp - 0x88], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xc20]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0xa8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0xc20]
push str._s___sdownlWithIDM64.dll_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x3c
lea eax, [ebp - 0x4c]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
mov dword [ebp - 0x40], str.open
mov dword [ebp - 0x3c], str.regsvr32.exe
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0xc20]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
jmp 0x40a058
mov esi, 0x41b124
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push str.SoftwareMozilla
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40a099
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push esi
push ebx
push str.SoftwareMozilla
push 0x80000002
call edi
test eax, eax
jne 0x40a0a2
push dword [ebp - 4]
jmp 0x40a09c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00403037
test eax, eax
je 0x40a0f5
lea eax, [ebp - 8]
push eax
push 0x20119
push ebx
push str.SoftwareMozilla
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40a0ec
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf013f
push ebx
push esi
push ebx
push str.SoftwareMozilla
push 0x80000002
call edi
test eax, eax
jne 0x40a0f5
push dword [ebp - 4]
jmp 0x40a0ef
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x400]
mov dword [ebp - 0x400], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a241
cmp dword [ebp - 0x3f0], 2
jne 0x40a241
cmp dword [ebp - 0x3fc], 6
jb 0x40a241
call fcn.004094b7
cmp dword [ebp - 0x3f8], ebx
ja 0x40a148
cmp dword [ebp - 0x3fc], 6
jbe 0x40a241
push 0x3c
lea eax, [ebp - 0x4c]
push ebx
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x2ec]
add esp, 0xc
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x48], 0x40
mov dword [ebp - 0x40], str.open
mov dword [ebp - 0x3c], str.idmBroker.exe
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x38], str._RegServer
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push esi
push ebx
push str.CLSID0055C089_8582_441B_A0BF_17B458C2A3A8Implemented_Categories
push 0x80000000
call edi
test eax, eax
jne 0x40a1ec
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push ebx
push esi
push ebx
push str.59FB2056_D625_48D0_A944_1A85B5AB2640
push dword [ebp - 8]
call edi
test eax, eax
jne 0x40a1e3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00403037
test eax, eax
je 0x40a241
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push 0xf013f
push ebx
push esi
push ebx
push str.CLSID0055C089_8582_441B_A0BF_17B458C2A3A8Implemented_Categories
push 0x80000000
call edi
test eax, eax
jne 0x40a241
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf013f
push ebx
push esi
push ebx
push str.59FB2056_D625_48D0_A944_1A85B5AB2640
push dword [ebp - 8]
call edi
test eax, eax
jne 0x40a238
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
pop ebx
leave
ret