Function at 0x10003742
Capabilities:
Check if file exists
Delete registry key
Delete registry value
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x10042130
call fcn.10035ae0
sub esp, 0x70
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.10006156
pop ecx
xor ebx, ebx
lea eax, [ebp - 0x18]
push ebx
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftInternet_ExplorerToolbar
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp byte [ebp + 8], bl
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
je 0x100037b6
mov ecx, dword [0x10059e74]
mov byte [ebp - 0xd], bl
cmp ecx, ebx
je 0x1000379d
call fcn.10002120
jmp 0x1000379f
xor eax, eax
lea ecx, [ebp - 0xd]
push 1
push ecx
push 3
push ebx
push eax
push dword [ebp - 0x18]
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x100037d5
mov ecx, dword [0x10059e74]
cmp ecx, ebx
je 0x100037c7
call fcn.10002120
jmp 0x100037c9
xor eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push eax
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10059eb0
lea eax, [ebp - 0x28]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push eax
call fcn.10004098
add esp, 0xc
mov ecx, dword [eax]
mov dword [ebp - 4], ebx
cmp ecx, ebx
je 0x10003804
call fcn.10002120
jmp 0x10003806
xor eax, eax
lea ecx, [ebp - 0x18]
push ebx
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100040f3
cmp byte [ebp + 8], bl
je 0x10003a90
lea eax, [ebp - 0xe]
mov esi, 0x3e8
push eax
lea eax, [ebp - 0xd]
push eax
push esi
lea ecx, [ebp - 0x7c]
mov byte [ebp - 0xd], bl
call fcn.10014186
mov eax, dword [0x10059f64]
push esi
push dword [ebp - 0x78]
mov dword [ebp - 4], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov eax, dword [ebp - 0x78]
push ebx
mov dword [ebp - 0x20], eax
mov al, byte [ebp + 0xb]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 0x6c], al
call fcn.100149cc
push dword [ebp - 0x20]
call fcn.10035bc0
pop ecx
push eax
lea ecx, [ebp - 0x6c]
push dword [ebp - 0x20]
call fcn.10015611
mov ecx, dword [0x10059e28]
mov byte [ebp - 4], 2
cmp ecx, ebx
je 0x100038a7
call fcn.10002120
mov dword [ebp - 0x20], eax
jmp 0x100038aa
mov dword [ebp - 0x20], ebx
mov ecx, 0x10059e28
call fcn.10002109
push eax
push dword [ebp - 0x20]
push 1
push ebx
push str.DisplayName
push dword [ebp - 0x18]
call edi
mov al, byte [ebp + 0xb]
push ebx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 0x5c], al
call fcn.100149cc
push esi
mov byte [ebp - 4], 3
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x10003912
mov esi, dword [ebp - 0x78]
push esi
call fcn.10035bc0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x5c]
call fcn.10015611
mov esi, 0x100547d8
push esi
call fcn.10035bc0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x5c]
call fcn.100155ba
jmp 0x10003928
mov esi, 0x10059ef8
push esi
call fcn.10035bc0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x5c]
call fcn.10015611
push 0x100547d4
lea ecx, [ebp - 0x24]
call fcn.10001065
push str.regsvr32__u__s__
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.10001065
mov eax, dword [ebp - 0x68]
mov byte [ebp - 4], 5
cmp eax, ebx
jne 0x10003956
mov eax, 0x10047534
push eax
lea ecx, [ebp - 0x44]
call fcn.10001065
mov esi, eax
mov eax, dword [ebp - 0x58]
mov byte [ebp - 4], 6
cmp eax, ebx
jne 0x10003971
mov eax, 0x10047534
push eax
lea ecx, [ebp - 0x40]
call fcn.10001065
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 7
push ecx
lea ecx, [ebp - 0x3c]
push ecx
mov ecx, eax
call fcn.10003fde
lea ecx, [ebp - 0x38]
push esi
push ecx
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.10003fde
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 9
push ecx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
call fcn.10003fde
lea ecx, [ebp - 0x38]
call fcn.100040f3
lea ecx, [ebp - 0x3c]
call fcn.100040f3
lea ecx, [ebp - 0x40]
call fcn.100040f3
lea ecx, [ebp - 0x44]
call fcn.100040f3
lea ecx, [ebp - 0x20]
call fcn.100040f3
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 0xb
call fcn.100040f3
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x100039f4
call fcn.10002120
mov esi, eax
jmp 0x100039f6
xor esi, esi
lea ecx, [ebp - 0x1c]
call fcn.10002109
push eax
push esi
push 1
push ebx
push str.UninstallString
push dword [ebp - 0x18]
call edi
push 0x100547ac
lea ecx, [ebp - 0x28]
call fcn.10001065
mov eax, dword [ebp - 0x68]
mov byte [ebp - 4], 0x11
cmp eax, ebx
jne 0x10003a2a
mov eax, 0x10047534
push eax
lea ecx, [ebp - 0x48]
call fcn.10001065
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x12
push ecx
lea ecx, [ebp - 0x4c]
push ecx
mov ecx, eax
call fcn.10003fde
lea ecx, [ebp - 0x48]
call fcn.100040f3
lea ecx, [ebp - 0x28]
call fcn.100040f3
lea ecx, [ebp - 0x4c]
call fcn.100040f3
lea ecx, [ebp - 0x1c]
call fcn.100040f3
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.100149cc
push 1
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.100149cc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7c]
call fcn.100136c9
jmp 0x10003af2
push str.DisplayName
push dword [ebp - 0x18]
call esi
push str.UninstallString
push dword [ebp - 0x18]
call esi
push str.DisplayIcon
push dword [ebp - 0x18]
call esi
push 0x10059eb0
lea eax, [ebp - 0x4c]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push eax
call fcn.10004098
add esp, 0xc
mov ecx, dword [eax]
mov dword [ebp - 4], 0x13
cmp ecx, ebx
je 0x10003ad8
call fcn.10002120
jmp 0x10003ada
xor eax, eax
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.100040f3
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10059ef8
lea ecx, [ebp - 0x34]
call fcn.10001065
push str.SoftwareMicrosoftInternet_ExplorerMenuExt_
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 0x14
call fcn.10001065
mov al, byte [ebp + 0xb]
push ebx
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x15
mov byte [ebp - 0x6c], al
call fcn.100149cc
mov esi, str.IE_Toolbar_search
push esi
call fcn.10035bc0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x6c]
call fcn.10015611
mov al, byte [ebp + 0xb]
push ebx
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x16
mov byte [ebp - 0x7c], al
call fcn.100149cc
mov esi, str.contextMenuItemName
push esi
call fcn.10035bc0
pop ecx
push eax
push esi
lea ecx, [ebp - 0x7c]
call fcn.10015611
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 0x17
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.10002a7b
add esp, 0xc
mov eax, dword [eax + 4]
mov byte [ebp - 4], 0x18
cmp eax, ebx
jne 0x10003b96
mov eax, 0x10047534
push eax
lea ecx, [ebp - 0x28]
call fcn.10001065
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x34]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0x19
call fcn.10003fde
lea ecx, [ebp - 0x28]
call fcn.100040f3
push 1
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 0x1d
call fcn.100149cc
push 1
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 0x1c
call fcn.100149cc
push 1
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 0x1b
call fcn.100149cc
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 4], 0x1f
cmp ecx, ebx
je 0x10003bfa
call fcn.10002120
jmp 0x10003bfc
xor eax, eax
lea ecx, [ebp - 0x4c]
mov esi, 0xf003f
push ecx
lea ecx, [ebp - 0x24]
push ecx
push ebx
push esi
push ebx
push ebx
push ebx
push eax
push SysReAllocString
mov dword [ebp - 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x10003c2f
lea ecx, [ebp - 0x14]
call fcn.10003f56
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x2c]
cmp ecx, ebx
je 0x10003c3d
call fcn.10002120
jmp 0x10003c3f
xor eax, eax
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0x14], ebx
je 0x10003c5a
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
cmp byte [ebp + 8], bl
je 0x10003ecc
lea eax, [ebp - 0x48]
push eax
call fcn.10002fa0
mov dword [esp], str.GNBar.ico
push eax
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 0x20
push eax
call fcn.100041a8
push dword [eax]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0x21
call fcn.10001065
lea ecx, [ebp - 0x4c]
call fcn.10001a89
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x23
call fcn.10001a89
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x10003cb1
call fcn.10002120
jmp 0x10003cb3
xor eax, eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10003ec2
lea eax, [ebp - 0x44]
mov dword [ebp - 0x24], ebx
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push str.SOFTWAREMicrosoftInternet_ExplorerExtensionsA4586F43_D58C_4cfc_A0E8_D8EEE078DE09
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x10003cf4
lea ecx, [ebp - 0x14]
call fcn.10003f56
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x10059eac]
cmp ecx, ebx
je 0x10003d08
call fcn.10002120
mov dword [ebp - 0x1c], eax
jmp 0x10003d0b
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push str.ButtonText
push dword [ebp - 0x14]
call edi
push str.E0DD6CAB_2D10_11D2_8F1A_0000F87ABD16
call esi
inc eax
push eax
push str.E0DD6CAB_2D10_11D2_8F1A_0000F87ABD16
push 1
push ebx
push str.CLSID
push dword [ebp - 0x14]
call edi
push 0x100546ac
call esi
inc eax
push eax
push 0x100546ac
push 1
push ebx
push str.Default_Visible
push dword [ebp - 0x14]
call edi
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x10003d6f
call fcn.10002120
mov dword [ebp - 0x1c], eax
jmp 0x10003d72
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x1c]
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push str.HotIcon
push dword [ebp - 0x14]
call edi
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x10003d9a
call fcn.10002120
mov dword [ebp - 0x1c], eax
jmp 0x10003d9d
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x1c]
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push str.Icon
push dword [ebp - 0x14]
call edi
mov ecx, dword [0x10059eac]
cmp ecx, ebx
je 0x10003dc8
call fcn.10002120
mov dword [ebp - 0x1c], eax
jmp 0x10003dcb
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x1c]
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push str.MenuStatusBar
push dword [ebp - 0x14]
call edi
mov ecx, dword [0x10059eac]
cmp ecx, ebx
je 0x10003df6
call fcn.10002120
mov dword [ebp - 0x1c], eax
jmp 0x10003df9
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x1c]
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push str.MenuText
push dword [ebp - 0x14]
call edi
mov ecx, dword [0x10059e74]
cmp ecx, ebx
je 0x10003e24
call fcn.10002120
mov dword [ebp - 0x1c], eax
jmp 0x10003e27
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x1c]
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push str.BandCLSID
push dword [ebp - 0x14]
call edi
cmp dword [ebp - 0x14], ebx
je 0x10003e4f
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push eax
push 0xf003f
push ebx
push str.SOFTWAREMicrosoftInternet_ExplorerExtensionsCmdMapping
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x10003e7e
lea ecx, [ebp - 0x14]
call fcn.10003f56
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x20], 0x2002
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x40]
push eax
push ebx
push str.NextId
mov dword [ebp - 0x40], ebx
push dword [ebp - 0x14]
mov dword [ebp - 0x44], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push str.A4586F43_D58C_4cfc_A0E8_D8EEE078DE09
lea ecx, [ebp - 0x14]
push dword [ebp - 0x20]
call fcn.10003fc4
lea ecx, [ebp - 0x14]
call fcn.10003f56
lea ecx, [ebp + 8]
call fcn.100040f3
jmp 0x10003f23
push ebx
push ebx
push esi
push ebx
push ebx
push str.SOFTWAREMicrosoftInternet_ExplorerExtensions
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x14]
call fcn.10003f6d
mov edi, str.A4586F43_D58C_4cfc_A0E8_D8EEE078DE09
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0x14]
call fcn.10003f56
push ebx
push ebx
push esi
push ebx
push ebx
push str.SOFTWAREMicrosoftInternet_ExplorerExtensionsCmdMapping
push SysReAllocString
lea ecx, [ebp - 0x14]
call fcn.10003f6d
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea ecx, [ebp - 0x14]
call fcn.10003f56
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 0x1b
call fcn.10003f56
lea ecx, [ebp - 0x2c]
call fcn.100040f3
lea ecx, [ebp - 0x30]
call fcn.100040f3
lea ecx, [ebp - 0x34]
call fcn.100040f3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret