Function at 0x406226
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xdac
mov eax, 0x4189e0
call fcn.00418297
mov dword [ebp - 0xd78], edx
mov esi, ecx
mov ebx, dword [ebp + 8]
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0xd90], ebx
mov edi, ecx
mov byte [ebp - 0xd47], cl
inc eax
mov dword [ebp - 0xd94], edi
mov dword [ebp - 0xdb0], eax
mov byte [ebp - 0xd46], cl
mov dword [ebp - 0xd6c], ecx
mov byte [ebp - 0xd45], cl
mov byte [ebp - 0xd48], cl
mov byte [ebp - 0xd68], cl
mov dword [ebp - 0xd54], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xdac], ecx
mov dword [ebp - 0xda8], ecx
mov dword [ebp - 0xd58], ecx
mov dword [ebp - 0xd50], ecx
mov dword [ebp - 0xd64], ecx
mov dword [ebp - 0xd60], ecx
mov dword [ebp - 0xd7c], ecx
mov dword [ebp - 0xd80], ecx
mov dword [ebp - 0xd84], ecx
mov dword [ebp - 0xd98], ecx
mov byte [ebp - 4], 0xa
xor eax, eax
mov word [ebp - 0x4c], ax
mov edx, 0x851
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xd5c], ecx
push eax
push str.Start_Verb_Registration:
mov dword [ebp - 0xdb4], ecx
mov dword [ebp - 0xd88], ecx
mov ecx, 0x170b011
push 0x64
mov dword [ebp - 0xda4], 0x28
mov dword [ebp - 0xdb8], 0x208
mov dword [ebp - 0x1c], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov dword [ebp - 0x18], str.Param
mov dword [ebp - 0x14], ebx
call fcn.00401cbf
mov edx, str.print
mov ecx, ebx
call fcn.0040b412
test eax, eax
je 0x40633e
xor eax, eax
inc eax
mov byte [ebp - 0xd46], al
xor al, al
mov dword [ebp - 0xdb0], eax
lea eax, [ebp - 0xd8c]
mov edx, str.shell
push eax
lea eax, [ebp - 0xd7c]
mov ecx, esi
push eax
sub esp, 0x14
call fcn.0040bb2f
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x406dbc
mov ecx, dword [ebp - 0xd7c]
lea eax, [ebp - 0xd8c]
push eax
lea eax, [ebp - 0xd54]
mov edx, ebx
push eax
sub esp, 0x14
call fcn.0040bb2f
test eax, eax
jne 0x406dbc
mov ecx, dword [ebp - 0xd54]
lea eax, [ebp - 0xd8c]
push eax
lea eax, [ebp - 0xd64]
mov edx, str.command
push eax
sub esp, 0x14
call fcn.0040bb2f
test eax, eax
jne 0x406dbc
mov ecx, dword [ebp - 0xd64]
lea eax, [ebp - 0xd5c]
push eax
lea eax, [ebp - 0xd88]
xor edx, edx
push eax
call fcn.004091a9
test eax, eax
je 0x406dad
mov edi, dword [ebp - 0xd88]
test edi, edi
je 0x4063f5
mov edx, str.msohtmed.exe
mov ecx, edi
call fcn.0040b5f5
xor ebx, ebx
jmp 0x4063f9
xor ebx, ebx
mov eax, ebx
test eax, eax
je 0x4065f0
mov ecx, edi
mov dword [ebp - 0xd5c], ebx
mov dword [ebp - 0xda0], ebx
mov dword [ebp - 0xd4c], ebx
mov dword [ebp - 0xd70], ebx
call fcn.00405730
push 2
lea ecx, [ebp - 0xd44]
mov ebx, eax
call fcn.00409c60
test eax, eax
je 0x40658f
lea edx, [ebp - 0xd44]
mov ecx, ebx
call fcn.0040b412
test eax, eax
jne 0x406626
lea eax, [ebp - 0xd5c]
mov edx, 0x41c290
push eax
push 0x20019
push ecx
mov ecx, Ordinal_1
call fcn.0040bac7
test eax, eax
jne 0x40658f
lea eax, [ebp - 0xda0]
mov edx, str.42042206_2D85_11D3_8CFF_005004838597
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd5c]
call fcn.0040bac7
test eax, eax
jne 0x40658f
lea eax, [ebp - 0xd4c]
mov edx, str.Version
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xda0]
call fcn.0040bac7
test eax, eax
jne 0x40658f
xor edi, edi
xor edx, edx
jmp 0x406570
cmp dword [ebp - 0xd70], 0
je 0x4064d4
push dword [ebp - 0xd70]
call esi
and dword [ebp - 0xd70], 0
lea eax, [ebp - 0xd70]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd4c]
lea edx, [ebp - 0x24]
call fcn.0040bac7
test eax, eax
jne 0x40656d
movzx eax, byte [ebp - 0x524]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0xd9c], 0x208
inc edx
cmp dword [ebp - 0xd74], edx
cmove eax, ecx
mov byte [ebp - 0x524], al
lea eax, [ebp - 0xd9c]
push eax
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0xd74]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd70]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40656d
lea edx, [ebp - 0x524]
mov ecx, ebx
call fcn.0040b412
test eax, eax
je 0x40656d
push 0xa
pop edx
lea ecx, [ebp - 0x24]
call fcn.0040b796
cmp eax, 0x10
jae 0x406620
inc edi
mov edx, edi
mov ecx, dword [ebp - 0xd4c]
lea eax, [ebp - 0x24]
push 0xa
push eax
call fcn.0040b94a
test eax, eax
je 0x4064c3
mov edi, dword [ebp - 0xd88]
xor eax, eax
inc eax
xor ebx, ebx
mov byte [ebp - 0xd47], al
cmp dword [ebp - 0xd70], 0
je 0x4065ab
push dword [ebp - 0xd70]
call esi
cmp dword [ebp - 0xd4c], 0
mov dword [ebp - 0xd70], ebx
je 0x4065c2
push dword [ebp - 0xd4c]
call esi
cmp dword [ebp - 0xda0], 0
mov dword [ebp - 0xd4c], ebx
je 0x4065d9
push dword [ebp - 0xda0]
call esi
cmp dword [ebp - 0xd5c], 0
mov dword [ebp - 0xda0], ebx
je 0x4065f0
push dword [ebp - 0xd5c]
call esi
cmp word [edi], bx
je 0x406635
mov edx, str.fpxpress.exe
mov ecx, edi
call fcn.0040b5f5
test eax, eax
jne 0x406635
mov edx, str.winword.exe
mov ecx, edi
call fcn.0040b5f5
test eax, eax
je 0x40663e
xor eax, eax
inc eax
mov byte [ebp - 0xd47], al
jmp 0x40665b
mov edi, dword [ebp - 0xd88]
xor ebx, ebx
mov al, bl
mov dword [ebp - 0xdb0], eax
jmp 0x40659a
xor eax, eax
inc eax
mov byte [ebp - 0xd47], al
cmp dword [ebp + 0x10], 0
je 0x40665b
cmp byte [ebp - 0xd46], 0
jne 0x40665b
cmp dword [ebp - 0xd78], 0
mov edi, str.SharePointDesigner.Editor.Document
je 0x406660
mov edi, str.Word.Document
push 0x104
mov edx, edi
lea ecx, [ebp - 0x72c]
call fcn.0040b4cf
push 0x104
mov edx, 0x41a744
lea ecx, [ebp - 0x72c]
call fcn.0040b51a
xor eax, eax
lea edx, [ebp - 0x72c]
mov dword [ebp - 0xd4c], eax
lea eax, [ebp - 0xd4c]
push eax
push 0x20019
push ecx
mov ecx, Ordinal_1
call fcn.0040bac7
test eax, eax
jne 0x406789
movzx eax, byte [ebp - 0x114]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0xd9c], 0xc8
inc edx
cmp dword [ebp - 0xd74], edx
cmove eax, ecx
mov byte [ebp - 0x114], al
lea eax, [ebp - 0xd9c]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xd74]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd4c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406789
lea ecx, [ebp - 0x114]
push 0x64
cmp byte [ebp - 0xd46], al
je 0x406730
mov edx, str._shell_
call fcn.0040b51a
mov edx, dword [ebp - 0xd90]
lea ecx, [ebp - 0x114]
push 0x64
jmp 0x406735
mov edx, str._shellopen
call fcn.0040b51a
cmp dword [ebp - 0xd60], 0
je 0x40674b
push dword [ebp - 0xd60]
call esi
xor eax, eax
lea edx, [ebp - 0x114]
mov dword [ebp - 0xd60], eax
lea eax, [ebp - 0xd60]
push eax
push 0x20019
push ecx
mov ecx, Ordinal_1
call fcn.0040bac7
mov ecx, dword [ebp - 0xd68]
test eax, eax
push 1
movzx ecx, cl
pop eax
cmove ecx, eax
mov dword [ebp - 0xd68], ecx
jmp 0x40678f
mov ecx, dword [ebp - 0xd68]
test cl, cl
jne 0x4067b2
test ebx, ebx
jne 0x4067b2
mov eax, str.SharePointDesigner.Editor.Document
cmp edi, eax
jne 0x4067a7
mov edi, str.Word.Document
jmp 0x4067b2
cmp dword [ebp - 0xd78], 0
jne 0x4067d7
mov edi, eax
cmp dword [ebp - 0xd4c], 0
je 0x4067c3
push dword [ebp - 0xd4c]
call esi
xor eax, eax
inc ebx
mov dword [ebp - 0xd4c], eax
cmp ebx, 2
jb 0x406660
jmp 0x4067e8
cmp dword [ebp - 0xd4c], 0
je 0x4067e8
push dword [ebp - 0xd4c]
call esi
push dword [ebp - 0xd78]
lea edx, [ebp - 0xd84]
lea ecx, [ebp - 0xd80]
call fcn.00405d7a
mov ebx, dword [ebp - 0xdb0]
test bl, bl
je 0x4068ff
cmp byte [ebp - 0xd47], 0
mov edi, dword [ebp - 0xd90]
je 0x4068ee
xor eax, eax
mov edx, edi
mov dword [ebp - 0xd5c], eax
lea eax, [ebp - 0xd5c]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd80]
call fcn.0040bac7
test eax, eax
jne 0x4068dd
mov dword [ebp - 0xd68], eax
mov edx, 0x41b910
lea eax, [ebp - 0xd68]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd5c]
call fcn.0040bac7
test eax, eax
jne 0x4068cc
movzx eax, byte [ebp - 0xb3c]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0xd9c], 0x410
inc edx
cmp dword [ebp - 0xd74], edx
cmove eax, ecx
mov byte [ebp - 0xb3c], al
lea eax, [ebp - 0xd9c]
push eax
lea eax, [ebp - 0xb3c]
push eax
lea eax, [ebp - 0xd74]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd68]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4068cc
cmp word [ebp - 0xb3c], ax
movzx ebx, bl
cmovne ebx, eax
cmp dword [ebp - 0xd68], 0
je 0x4068dd
push dword [ebp - 0xd68]
call esi
cmp dword [ebp - 0xd5c], 0
je 0x4068ee
push dword [ebp - 0xd5c]
call esi
test bl, bl
je 0x4068ff
mov ecx, dword [ebp - 0xd80]
mov edx, edi
call fcn.0040902d
mov edi, dword [ebp - 0xd90]
lea eax, [ebp - 0xd8c]
mov ecx, dword [ebp - 0xd80]
mov edx, edi
push eax
lea eax, [ebp - 0xd58]
push eax
sub esp, 0x14
call fcn.0040bb2f
test eax, eax
jne 0x406da7
lea eax, [ebp - 0xd50]
mov edx, edi
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd84]
call fcn.0040bac7
test eax, eax
jne 0x406b8c
lea eax, [ebp - 0xdac]
mov edx, str.command
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd50]
call fcn.0040bac7
test eax, eax
jne 0x406b8c
test bl, bl
jne 0x406b39
lea eax, [ebp - 0xd98]
mov edx, 0x41b910
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd58]
call fcn.0040bac7
test eax, eax
jne 0x406b58
movzx eax, byte [ebp - 0x31c]
xor edx, edx
xor ecx, ecx
inc edx
cmp dword [ebp - 0xd74], edx
cmove eax, ecx
xor ebx, ebx
mov byte [ebp - 0x31c], al
lea eax, [ebp - 0xdb8]
push eax
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0xd74]
push eax
push ebx
push ebx
push dword [ebp - 0xd98]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406b5a
cmp word [ebp - 0x31c], bx
je 0x406b5a
mov al, bl
cmp byte [ebp - 0xd46], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jne 0x406a7a
cmp dword [ebp - 0xd6c], 0
jne 0x406a12
test al, al
je 0x406a7a
push dword [ebp - 0xd78]
mov ecx, dword [ebp - 0xd54]
lea eax, [ebp - 0xda4]
push eax
lea eax, [ebp - 0x4c]
mov edx, edi
push eax
xor eax, eax
push eax
call fcn.00405f1a
cmp dword [ebp - 0xd6c], 0
je 0x406a56
push dword [ebp - 0xda4]
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
inc eax
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd58]
call ebx
mov al, byte [ebp - 0xd45]
test al, al
je 0x406a7a
push dword [ebp - 0xda4]
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
inc eax
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd50]
call ebx
cmp byte [ebp - 0xd48], 0
je 0x406af0
xor eax, eax
mov dword [ebp - 0xd6c], eax
mov edi, dword [ebp - 0xd78]
lea eax, [ebp - 0xd6c]
push eax
push 0x2001f
mov eax, str.SOFTWAREMicrosoftSharedHTML
mov byte [ebp - 4], 0xb
test edi, edi
mov edx, str.SOFTWAREMicrosoftSharedMHTML
push ecx
cmove edx, eax
mov ecx, reloc.AppVIsvSubsystems32.dll_Ordinal_1
call fcn.0040bac7
test eax, eax
jne 0x406acf
mov ecx, dword [ebp - 0xd6c]
mov edx, str.Default_Editor
call fcn.0040902d
mov edx, edi
mov ecx, reloc.AppVIsvSubsystems32.dll_Ordinal_1
call fcn.00407a44
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0xd6c], 0
je 0x406af0
push dword [ebp - 0xd6c]
call esi
movzx edi, byte [ebp - 0xd46]
lea ecx, [ebp - 0xdb4]
mov edx, edi
call fcn.0040613e
cmp word [ebp - 0x4c], 0
jne 0x406c9f
push dword [ebp - 0xd78]
mov ecx, dword [ebp - 0xd54]
lea eax, [ebp - 0xda4]
push eax
lea eax, [ebp - 0x4c]
push eax
push edi
mov edi, dword [ebp - 0xd90]
mov edx, edi
call fcn.00405f1a
jmp 0x406ca5
cmp byte [ebp - 0xd47], 0
jne 0x406b58
mov edx, dword [ebp - 0xd58]
xor eax, eax
mov ecx, dword [ebp - 0xd54]
push eax
call fcn.00408c7b
jmp 0x406b7a
xor ebx, ebx
mov ecx, dword [ebp - 0xd60]
test ecx, ecx
je 0x406b7a
mov edx, dword [ebp - 0xd58]
push ebx
call fcn.00408c7b
mov dword [ebp - 0xd6c], 1
mov byte [ebp - 0xd48], 1
mov al, byte [ebp - 0xd45]
jmp 0x4069f6
cmp dword [ebp - 0xd50], 0
je 0x406bb3
mov ecx, dword [ebp - 0xd84]
mov edx, edi
call fcn.0040902d
cmp dword [ebp - 0xd50], 0
je 0x406bb3
push dword [ebp - 0xd50]
call esi
mov ecx, dword [ebp - 0xd84]
xor eax, eax
mov dword [ebp - 0xd50], eax
mov edx, edi
lea eax, [ebp - 0xd8c]
push eax
lea eax, [ebp - 0xd50]
push eax
sub esp, 0x14
call fcn.0040bb2f
test eax, eax
jne 0x406da7
lea eax, [ebp - 0xda8]
mov edx, str.command
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd58]
call fcn.0040bac7
test eax, eax
jne 0x406c30
test bl, bl
jne 0x406c34
mov ecx, dword [ebp - 0xd60]
test ecx, ecx
je 0x406b81
mov edx, dword [ebp - 0xd50]
push eax
call fcn.00408c7b
xor ecx, ecx
inc ecx
mov al, cl
mov byte [ebp - 0xd45], al
jmp 0x4069f6
test bl, bl
je 0x406c3d
cmp byte [ebp - 0xd47], 0
je 0x406c74
cmp byte [ebp - 0xd46], 0
jne 0x406c74
mov ecx, dword [ebp - 0xd60]
test ecx, ecx
je 0x406c8b
push dword [ebp - 0xd50]
mov edx, dword [ebp - 0xd58]
call fcn.00408c7b
xor ecx, ecx
inc ecx
mov al, cl
mov byte [ebp - 0xd45], cl
mov dword [ebp - 0xd6c], ecx
jmp 0x406c94
push dword [ebp - 0xd50]
mov edx, dword [ebp - 0xd58]
mov ecx, dword [ebp - 0xd54]
call fcn.00408c7b
mov al, byte [ebp - 0xd45]
xor ecx, ecx
inc ecx
mov byte [ebp - 0xd48], cl
jmp 0x4069f6
mov edi, dword [ebp - 0xd90]
cmp dword [ebp - 0xd54], 0
je 0x406cb6
push dword [ebp - 0xd54]
call esi
xor eax, eax
mov dword [ebp - 0xd54], eax
cmp dword [ebp - 0xd64], eax
je 0x406cd0
push dword [ebp - 0xd64]
call esi
xor eax, eax
mov ecx, dword [ebp - 0xd7c]
mov edx, edi
mov dword [ebp - 0xd64], eax
call fcn.0040902d
mov ecx, dword [ebp - 0xd7c]
lea eax, [ebp - 0xd8c]
push eax
lea eax, [ebp - 0xd54]
mov edx, edi
push eax
sub esp, 0x14
call fcn.0040bb2f
mov edi, dword [ebp - 0xdb4]
test eax, eax
jne 0x406d9c
push dword [ebp - 0xda4]
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
inc eax
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd54]
call ebx
test eax, eax
jne 0x406d9c
mov ecx, dword [ebp - 0xd54]
lea eax, [ebp - 0xd8c]
push eax
lea eax, [ebp - 0xd64]
mov edx, str.command
push eax
sub esp, 0x14
call fcn.0040bb2f
test eax, eax
jne 0x406d9c
mov ecx, edi
call fcn.0040b2d4
add eax, eax
push eax
push edi
xor eax, eax
inc eax
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd64]
call ebx
test eax, eax
jne 0x406d9c
cmp byte [ebp - 0xd46], al
jne 0x406d93
push dword [ebp - 0xd78]
mov edx, dword [ebp - 0xd58]
mov ecx, 0x80000002
call fcn.004073e3
test eax, eax
je 0x406d9c
xor eax, eax
inc eax
mov dword [ebp - 0xd94], eax
test edi, edi
je 0x406da7
mov ecx, edi
call fcn.00401e39
mov edi, dword [ebp - 0xd94]
mov ecx, dword [ebp - 0xd88]
test ecx, ecx
je 0x406dbc
call fcn.00401e39
cmp dword [ebp - 0xd98], 0
je 0x406dcd
push dword [ebp - 0xd98]
call esi
xor ebx, ebx
mov dword [ebp - 0xd98], ebx
cmp dword [ebp - 0xd84], ebx
je 0x406de5
push dword [ebp - 0xd84]
call esi
mov dword [ebp - 0xd84], ebx
cmp dword [ebp - 0xd80], ebx
je 0x406dfb
push dword [ebp - 0xd80]
call esi
mov dword [ebp - 0xd80], ebx
cmp dword [ebp - 0xd7c], ebx
je 0x406e11
push dword [ebp - 0xd7c]
call esi
mov dword [ebp - 0xd7c], ebx
cmp dword [ebp - 0xd60], ebx
je 0x406e27
push dword [ebp - 0xd60]
call esi
mov dword [ebp - 0xd60], ebx
cmp dword [ebp - 0xd64], ebx
je 0x406e3d
push dword [ebp - 0xd64]
call esi
mov dword [ebp - 0xd64], ebx
cmp dword [ebp - 0xd50], ebx
je 0x406e53
push dword [ebp - 0xd50]
call esi
mov dword [ebp - 0xd50], ebx
cmp dword [ebp - 0xd58], ebx
je 0x406e69
push dword [ebp - 0xd58]
call esi
mov dword [ebp - 0xd58], ebx
cmp dword [ebp - 0xda8], ebx
je 0x406e7f
push dword [ebp - 0xda8]
call esi
mov dword [ebp - 0xda8], ebx
cmp dword [ebp - 0xdac], ebx
je 0x406e95
push dword [ebp - 0xdac]
call esi
mov dword [ebp - 0xdac], ebx
cmp dword [ebp - 0xd54], ebx
je 0x406eab
push dword [ebp - 0xd54]
call esi
mov eax, edi
call fcn.0041824c
ret 0xc