Function at 0x403850
Capabilities:
Get installed programs
Persist via contextmenuhandlers registry key
Set registry value

Disassembly:
sub esp, 0xd60
mov eax, dword [0x434480]
xor eax, esp
mov dword [esp + 0xd5c], eax
push ebx
push ebp
push esi
push edi
push str.IsWow64Process
push 0x4288b8
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x40389b
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
xor eax, eax
cmp dword [esp + 0x10], eax
push 0x436920
setne al
inc eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x3c]
push str._sgvim.exe
push eax
call fcn.00405500
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0xc
cmp dword [0x434f94], 0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
je 0x403bb7
push str.Creating__Edit_with_Vim__popup_menu_entry_n
call fcn.00404f40
add esp, 4
mov edx, str._sGvimExt32gvimext.dll
xor ecx, ecx
mov dword [esp + 0x10], ecx
nop word [eax + eax]
test ecx, ecx
mov eax, str._sGvimExt64gvimext.dll
push 0x436920
cmove eax, edx
push eax
lea eax, [esp + 0x144]
push eax
call fcn.00405500
push str.51EEE242_AD87_11d3_9C1E_0090278BBD99
lea eax, [esp + 0x354]
push str.CLSID_s
push eax
call fcn.00405500
add esp, 0x18
mov dword [esp + 0x14], 0
cmp dword [esp + 0x10], 0
mov eax, 0x100
mov esi, 0x200
cmovne esi, eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
or esi, 0x20006
push eax
push 0
push esi
push 0
push 0
push 0
lea eax, [esp + 0x360]
push eax
push 0x80000000
call ebp
test eax, eax
jne 0x403ce0
push 0x14
push str.Vim_Shell_Extension
push 1
push eax
push eax
push dword [esp + 0x28]
call edi
push dword [esp + 0x14]
mov dword [esp + 0x20], eax
call ebx
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x403ce0
push str.51EEE242_AD87_11d3_9C1E_0090278BBD99
lea eax, [esp + 0x348]
push str.CLSID_sInProcServer32
push eax
call fcn.00405500
add esp, 0xc
mov dword [esp + 0x14], 0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push esi
push 0
push 0
push 0
lea eax, [esp + 0x360]
push eax
push 0x80000000
call ebp
test eax, eax
jne 0x403ce0
lea ecx, [esp + 0x13c]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403a00
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x140]
push eax
push 1
push 0
push 0
push dword [esp + 0x28]
call edi
push dword [esp + 0x14]
mov dword [esp + 0x20], eax
call ebx
mov eax, dword [esp + 0x1c]
test eax, eax
jne 0x403ce0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push esi
push 0
push 0
push 0
lea eax, [esp + 0x360]
push eax
push 0x80000000
call ebp
mov edi, eax
test edi, edi
jne 0x403ce0
push 0xa
push str.Apartment
push 1
push eax
push str.ThreadingModel
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x14]
mov edi, eax
call ebx
test edi, edi
jne 0x403ce0
lea eax, [esp + 0x34]
mov dword [esp + 0x14], edi
push eax
lea eax, [esp + 0x18]
push eax
push edi
push esi
push edi
push edi
push edi
push str._shellexContextMenuHandlersgvim
push 0x80000000
call ebp
mov edi, eax
test edi, edi
jne 0x403ce0
push 0x27
push str.51EEE242_AD87_11d3_9C1E_0090278BBD99
push 1
push eax
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x14]
mov edi, eax
call ebx
test edi, edi
jne 0x403ce0
lea eax, [esp + 0x24]
mov dword [esp + 0x14], edi
push eax
lea eax, [esp + 0x18]
push eax
push edi
push esi
push edi
push edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push 0x80000002
call ebp
mov edi, eax
test edi, edi
jne 0x403ce0
push 0x14
push str.Vim_Shell_Extension
push 1
push eax
push str.51EEE242_AD87_11d3_9C1E_0090278BBD99
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x14]
mov edi, eax
call ebx
test edi, edi
jne 0x403ce0
lea eax, [esp + 0x18]
mov dword [esp + 0x14], edi
push eax
lea eax, [esp + 0x18]
push eax
push edi
push esi
push edi
push edi
push edi
push str.SoftwareVimGvim
push 0x80000002
call ebp
mov esi, eax
test esi, esi
jne 0x403b91
lea ecx, [esp + 0x38]
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403b60
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x3c]
push eax
push 1
push 0
push str.path
push dword [esp + 0x28]
call edi
push dword [esp + 0x14]
mov esi, eax
call ebx
jmp 0x403b97
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test esi, esi
jne 0x403ce0
mov ecx, dword [esp + 0x10]
mov edx, str._sGvimExt32gvimext.dll
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, dword [esp + 0x20]
jl 0x403900
cmp dword [0x4357bc], 0
je 0x403d1a
push str.Creating__Open_with_...__list_entry_n
call fcn.00404f40
add esp, 4
xor esi, esi
mov dword [esp + 0x14], esi
nop word [eax + eax]
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x140]
push str.__s_____1_
push eax
call fcn.00405500
add esp, 0xc
mov dword [esp + 0x10], 0
test esi, esi
mov eax, 0x100
mov ebx, 0x200
cmovne ebx, eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
or ebx, 0x20006
push eax
push 0
push ebx
push 0
push 0
push 0
push str.Applicationsgvim.exe_shelleditcommand
push 0x80000000
call ebp
mov esi, eax
test esi, esi
jne 0x403ce0
lea ecx, [esp + 0x13c]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403c50
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x140]
push eax
push 1
push 0
push 0
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x403ce0
mov esi, 0x43440c
cmp esi, 0x434418
jge 0x403cfb
lea eax, [esp + 0x24]
mov dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x14]
push eax
push 0
push ebx
push 0
push 0
push 0
push dword [esi]
push 0x80000000
call ebp
mov edi, eax
test edi, edi
jne 0x403cd9
push 1
push 0x4283de
push 1
push eax
push eax
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x10]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 4
test edi, edi
je 0x403c86
xor eax, eax
mov ecx, dword [esp + 0xd6c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004060be
add esp, 0xd60
ret
mov esi, dword [esp + 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc esi
mov dword [esp + 0x14], esi
cmp esi, dword [esp + 0x20]
jl 0x403be0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.Creating_an_uninstall_entry_n
call fcn.00404f40
lea eax, [esp + 0x550]
push str.Vim_9.1
push eax
call fcn.00405500
cmp dword [0x436a1c], 0
mov ecx, str._suninstall_gui.exe
mov eax, str._suninstall.exe
cmove eax, ecx
push 0x436920
push eax
lea eax, [esp + 0x768]
push eax
call fcn.00405500
push 0x436920
lea eax, [esp + 0x978]
push str._sgvim.exe_0
push eax
call fcn.00405500
lea eax, [esp + 0xb88]
push str.9.1.0759
push eax
call fcn.00405500
add esp, 0x2c
mov dword [esp + 0x10], 0
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x20106
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallVim_9.1
push 0x80000002
call ebp
mov esi, eax
test esi, esi
jne 0x403ce0
lea ecx, [esp + 0x54c]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403dc8
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x550]
push eax
push 1
push 0
push str.DisplayName
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
mov esi, eax
call ebx
test esi, esi
jne 0x403ce0
lea eax, [esp + 0x18]
mov dword [esp + 0x10], esi
push eax
lea eax, [esp + 0x14]
push eax
push esi
push 0x20106
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallVim_9.1
push 0x80000002
call ebp
mov esi, eax
test esi, esi
jne 0x403ce0
lea ecx, [esp + 0x754]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403e33
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x758]
push eax
push 1
push 0
push str.UninstallString
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
mov esi, eax
call ebx
test esi, esi
jne 0x403ce0
lea eax, [esp + 0x18]
mov dword [esp + 0x10], esi
push eax
lea eax, [esp + 0x14]
push eax
push esi
push 0x20106
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallVim_9.1
push 0x80000002
call ebp
mov esi, eax
test esi, esi
jne 0x403ce0
lea ecx, [esp + 0x95c]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403ea0
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0x960]
push eax
push 1
push 0
push str.DisplayIcon
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
mov esi, eax
call ebx
test esi, esi
jne 0x403ce0
lea eax, [esp + 0x18]
mov dword [esp + 0x10], esi
push eax
lea eax, [esp + 0x14]
push eax
push esi
push 0x20106
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallVim_9.1
push 0x80000002
call ebp
mov esi, eax
test esi, esi
jne 0x403ce0
lea ecx, [esp + 0xb64]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403f10
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [esp + 0xb68]
push eax
push 1
push 0
push str.DisplayVersion
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
mov esi, eax
call ebx
test esi, esi
jne 0x403ce0
lea eax, [esp + 0x18]
mov dword [esp + 0x10], esi
push eax
lea eax, [esp + 0x14]
push eax
push esi
push 0x20106
push esi
push esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallVim_9.1
push 0x80000002
call ebp
mov esi, eax
test esi, esi
jne 0x403f8a
push 0x10
push str.The_Vim_Project
push 1
push eax
push str.Publisher
push dword [esp + 0x24]
call edi
push dword [esp + 0x10]
mov esi, eax
call ebx
xor eax, eax
test esi, esi
sete al
jmp 0x403ce2