Function at 0x401340
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x378
mov eax, dword [0x42b21c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
call fcn.00401210
add esp, 4
mov dword [ebp - 0x368], eax
mov dword [ebp - 0x378], 0
mov dword [ebp - 0x360], 0
mov dword [ebp - 0x364], 0
mov dword [ebp - 0x374], 0
mov ecx, dword [section..data]
push ecx
push str.1._.2d
lea edx, [ebp - 0x2c]
push edx
call fcn.004012e0
add esp, 0xc
mov dword [ebp - 0x320], 1
mov dword [ebp - 0x31c], 0x80000002
mov dword [ebp - 0x318], str.SoftwareCLASSES
mov dword [ebp - 0x314], 0
mov dword [ebp - 0x310], 2
mov dword [ebp - 0x30c], 0
mov dword [ebp - 0x308], str.CLSID0CEF79D8_D373_11D3_A7D3_00062962BF17
mov eax, dword [str.IEOnflow1_Class]
mov dword [ebp - 0x304], eax
mov dword [ebp - 0x300], 2
mov dword [ebp - 0x2fc], 0
mov dword [ebp - 0x2f8], str.ProgID
mov ecx, dword [str.IEOnflow.IEOnflow1]
mov dword [ebp - 0x2f4], ecx
mov dword [ebp - 0x2f0], 3
mov dword [ebp - 0x2ec], 0
mov dword [ebp - 0x2e8], str.VersionIndependentProgID
mov edx, dword [str.IEOnflow.IEOnflow1]
mov dword [ebp - 0x2e4], edx
mov dword [ebp - 0x2e0], 3
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x2d8], str.Programmable
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x2d0], 3
mov dword [ebp - 0x2cc], 0
mov dword [ebp - 0x2c8], str.InprocServer32
mov dword [ebp - 0x2c4], 0x421437
mov dword [ebp - 0x2c0], 7
mov dword [ebp - 0x2bc], 0
mov dword [ebp - 0x2b8], 0x421437
mov dword [ebp - 0x2b4], 0x421437
mov dword [ebp - 0x2b0], 7
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2a8], str.ThreadingModel
mov dword [ebp - 0x2a4], str.Apartment
mov dword [ebp - 0x2a0], 3
mov dword [ebp - 0x29c], 0
mov dword [ebp - 0x298], str.Control
mov dword [ebp - 0x294], 0
mov dword [ebp - 0x290], 3
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x288], str.ToolboxBitmap32
mov dword [ebp - 0x284], 0x421437
mov dword [ebp - 0x280], 3
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x278], str.MiscStatus
mov dword [ebp - 0x274], 0x421478
mov dword [ebp - 0x270], 2
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x268], 0x42147c
mov dword [ebp - 0x264], str.131473
mov dword [ebp - 0x260], 4
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x258], str.Version
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], 3
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x248], str.Implemented_Categories
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 3
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x238], str.Implemented_Categories7DD95801_9882_11CF_9FA9_00AA006C42C4
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 3
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x228], str.Implemented_Categories7DD95802_9882_11CF_9FA9_00AA006C42C4
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 4
mov dword [ebp - 0x21c], 0
mov ecx, dword [str.IEOnflow.IEOnflow1]
mov dword [ebp - 0x218], ecx
mov edx, dword [str.IEOnflow1_Class]
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x210], 2
mov dword [ebp - 0x20c], 0
mov eax, dword [str.CLSID]
mov dword [ebp - 0x208], eax
mov ecx, dword [str.0CEF79D8_D373_11D3_A7D3_00062962BF17]
mov dword [ebp - 0x204], ecx
mov dword [ebp - 0x200], 3
mov dword [ebp - 0x1fc], 0
mov dword [ebp - 0x1f8], str.CurVer
lea edx, [ebp - 0x2c]
mov dword [ebp - 0x1f4], edx
mov dword [ebp - 0x1f0], 0
mov dword [ebp - 0x1ec], 0
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 0
push 0x40
push 0
lea eax, [ebp - 0x1e0]
push eax
call fcn.0040bfd0
add esp, 0xc
mov ecx, dword [ebp - 0x368]
push ecx
call fcn.00410217
add esp, 4
push str.MICROS
mov edx, dword [ebp - 0x368]
push edx
call fcn.00401320
add esp, 8
test eax, eax
jne 0x401725
push str.INTERN
mov eax, dword [ebp - 0x368]
push eax
call fcn.00401320
add esp, 8
test eax, eax
je 0x401c95
mov ecx, dword [ebp - 0x368]
push ecx
lea edx, [ebp - 0x130]
push edx
call fcn.0040ff00
add esp, 8
push str.__101
lea eax, [ebp - 0x130]
push eax
call fcn.0040ff10
add esp, 8
mov ecx, 0x10
imul edx, ecx, 6
mov eax, dword [ebp - 0x368]
mov dword [ebp + edx - 0x314], eax
mov ecx, 0x10
imul edx, ecx, 9
lea eax, [ebp - 0x130]
mov dword [ebp + edx - 0x314], eax
mov ecx, dword [ebp - 0x364]
shl ecx, 4
cmp dword [ebp + ecx - 0x320], 0
je 0x401a6b
mov edx, dword [ebp - 0x364]
shl edx, 4
mov eax, dword [ebp + edx - 0x320]
mov dword [ebp - 0x370], eax
mov ecx, dword [ebp - 0x370]
sub ecx, 1
mov dword [ebp - 0x370], ecx
cmp dword [ebp - 0x370], 8
ja case.default.0x4017c8
mov edx, dword [ebp - 0x370]
jmp dword [edx*4 + 0x401cb8]
mov dword [ebp - 0x360], 0
lea eax, [ebp - 0x374]
push eax
mov ecx, dword [ebp - 0x360]
lea edx, [ebp + ecx*4 - 0x35c]
push edx
push 0
push 0xf003f
push 0
push 0x421437
push 0
mov eax, dword [ebp - 0x364]
shl eax, 4
mov ecx, dword [ebp + eax - 0x318]
push ecx
mov edx, dword [ebp - 0x364]
shl edx, 4
mov eax, dword [ebp + edx - 0x31c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x36c], eax
jmp case.default.0x4017c8
mov ecx, dword [ebp - 0x360]
sub ecx, 1
mov dword [ebp - 0x360], ecx
mov edx, dword [ebp - 0x360]
sub edx, 1
mov dword [ebp - 0x360], edx
mov eax, dword [ebp - 0x360]
sub eax, 1
mov dword [ebp - 0x360], eax
mov ecx, dword [ebp - 0x360]
sub ecx, 1
mov dword [ebp - 0x360], ecx
cmp dword [ebp - 0x360], 0
jge 0x401880
mov dword [ebp - 0x360], 0
lea edx, [ebp - 0x374]
push edx
mov eax, dword [ebp - 0x360]
lea ecx, [ebp + eax*4 - 0x358]
push ecx
push 0
push 0xf003f
push 0
push 0x421437
push 0
mov edx, dword [ebp - 0x364]
shl edx, 4
mov eax, dword [ebp + edx - 0x318]
push eax
mov ecx, dword [ebp - 0x360]
mov edx, dword [ebp + ecx*4 - 0x35c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x360]
add eax, 1
mov dword [ebp - 0x360], eax
mov ecx, dword [ebp - 0x364]
shl ecx, 4
cmp dword [ebp + ecx - 0x314], 0
je 0x40193d
mov edx, dword [ebp - 0x364]
shl edx, 4
mov eax, dword [ebp + edx - 0x314]
push eax
call fcn.00410000
add esp, 4
push eax
mov ecx, dword [ebp - 0x364]
shl ecx, 4
mov edx, dword [ebp + ecx - 0x314]
push edx
push 1
push 0
push 0
mov eax, dword [ebp - 0x360]
mov ecx, dword [ebp + eax*4 - 0x35c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x36c], eax
jmp case.default.0x4017c8
mov edx, dword [ebp - 0x364]
shl edx, 4
mov eax, dword [ebp + edx - 0x314]
push eax
call fcn.00410000
add esp, 4
push eax
mov ecx, dword [ebp - 0x364]
shl ecx, 4
mov edx, dword [ebp + ecx - 0x314]
push edx
push 1
push 0
mov eax, dword [ebp - 0x364]
shl eax, 4
mov ecx, dword [ebp + eax - 0x318]
push ecx
mov edx, dword [ebp - 0x360]
mov eax, dword [ebp + edx*4 - 0x35c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x36c], eax
jmp case.default.0x4017c8
mov ecx, dword [ebp - 0x364]
shl ecx, 4
mov edx, dword [ebp + ecx - 0x314]
push edx
call fcn.00410000
add esp, 4
push eax
mov eax, dword [ebp - 0x364]
shl eax, 4
mov ecx, dword [ebp + eax - 0x314]
push ecx
push 1
push 0
mov edx, dword [ebp - 0x364]
shl edx, 4
mov eax, dword [ebp + edx - 0x318]
push eax
mov ecx, dword [ebp - 0x360]
mov edx, dword [ebp + ecx*4 - 0x35c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x36c], eax
jmp case.default.0x4017c8
mov eax, dword [ebp - 0x364]
shl eax, 4
mov ecx, dword [ebp + eax - 0x314]
push ecx
call fcn.00410000
add esp, 4
push eax
mov edx, dword [ebp - 0x364]
shl edx, 4
mov eax, dword [ebp + edx - 0x314]
push eax
push 1
push 0
mov ecx, dword [ebp - 0x364]
shl ecx, 4
mov edx, dword [ebp + ecx - 0x318]
push edx
mov eax, dword [ebp - 0x360]
mov ecx, dword [ebp + eax*4 - 0x35c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x36c], eax
mov edx, dword [ebp - 0x364]
add edx, 1
mov dword [ebp - 0x364], edx
jmp 0x401779
cmp dword [ebp + 0xc], 0
je 0x401c95
mov eax, dword [str.0CEF79D8_D373_11D3_A7D3_00062962BF17]
push eax
push 0x42bb68
push 0x80000000
call fcn.0040aa20
add esp, 0xc
mov dword [ebp - 0x148], str.MIME
mov dword [ebp - 0x144], str.Database
mov dword [ebp - 0x140], str.Content_Type
mov dword [ebp - 0x13c], str.application_x_onflow
mov dword [ebp - 0x138], str.CLSID
mov dword [ebp - 0x134], 0
mov ecx, dword [str.0CEF79D8_D373_11D3_A7D3_00062962BF17]
push ecx
lea edx, [ebp - 0x148]
push edx
push 0x80000000
call fcn.0040aa20
add esp, 0xc
mov dword [ebp - 0x160], str.MIME
mov dword [ebp - 0x15c], str.Database
mov dword [ebp - 0x158], str.Content_Type
mov dword [ebp - 0x154], str.application_x_onflow
mov eax, dword [str.Extension]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], 0
mov ecx, dword [str..ofb]
push ecx
lea edx, [ebp - 0x160]
push edx
push 0x80000000
call fcn.0040aa20
add esp, 0xc
mov eax, dword [str.SOFTWARE]
mov dword [ebp - 0x180], eax
mov ecx, dword [str.Microsoft]
mov dword [ebp - 0x17c], ecx
mov edx, dword [str.Internet_Explorer]
mov dword [ebp - 0x178], edx
mov eax, dword [0x42a03c]
mov dword [ebp - 0x174], eax
mov ecx, dword [str.Extension]
mov dword [ebp - 0x170], ecx
mov edx, dword [str..ofb]
mov dword [ebp - 0x16c], edx
mov eax, dword [str.Location]
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], 0
mov ecx, dword [str.SOFTWARE]
mov dword [ebp - 0x1a0], ecx
mov edx, dword [str.Microsoft]
mov dword [ebp - 0x19c], edx
mov eax, dword [str.Internet_Explorer]
mov dword [ebp - 0x198], eax
mov ecx, dword [0x42a03c]
mov dword [ebp - 0x194], ecx
mov edx, dword [str.Extension]
mov dword [ebp - 0x190], edx
mov eax, dword [str..ofb]
mov dword [ebp - 0x18c], eax
mov ecx, dword [str.Content_Type]
mov dword [ebp - 0x188], ecx
mov dword [ebp - 0x184], 0
mov edx, dword [ebp - 0x368]
push edx
lea eax, [ebp - 0x180]
push eax
push 0x80000002
call fcn.0040aa20
add esp, 0xc
mov ecx, dword [0x42a028]
push ecx
lea edx, [ebp - 0x1a0]
push edx
push 0x80000002
call fcn.0040aa20
add esp, 0xc
mov eax, dword [str..ofb]
push eax
push 0x42bb80
push 0x80000000
call fcn.0040aa20
add esp, 0xc
mov ecx, dword [str.IEOnflow.IEOnflow1]
push ecx
push 0x42bb98
push 0x80000000
call fcn.0040aa20
add esp, 0xc
mov edx, dword [0x42a028]
push edx
push 0x42bba4
push 0x80000000
call fcn.0040aa20
add esp, 0xc
mov eax, dword [str..ofb]
push eax
push 0x42bbb0
push 0x80000002
call fcn.0040aa20
add esp, 0xc
mov dword [ebp - 0x378], 1
mov ecx, dword [ebp - 0x368]
push ecx
call fcn.004011a0
add esp, 4
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040af7c
mov esp, ebp
pop ebp
ret