Function at 0x407ad8
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
push 0x83c
mov eax, 0x418b8c
call fcn.00418297
mov eax, ecx
mov dword [ebp - 0x81c], eax
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x838], ecx
mov byte [ebp - 0x811], cl
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x824], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x830], ecx
mov dword [ebp - 0x82c], ecx
mov dword [ebp - 0x820], ecx
test eax, eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x830]
mov ecx, str.SOFTWAREMicrosoftSharedHTML
push eax
mov esi, str.SOFTWAREMicrosoftSharedMHTML
cmove esi, ecx
push 0x20019
push ecx
mov edx, esi
mov ecx, reloc.AppVIsvSubsystems32.dll_Ordinal_1
call fcn.0040bac7
mov edi, str.Default_Editor
test eax, eax
jne 0x407b62
mov ecx, dword [ebp - 0x830]
mov edx, edi
call fcn.0040902d
lea eax, [ebp - 0x824]
mov edx, esi
push eax
push 0x20019
push ecx
mov ecx, 0x80000002
call fcn.0040bac7
test eax, eax
jne 0x407b8c
mov ecx, dword [ebp - 0x824]
mov edx, edi
call fcn.0040902d
lea eax, [ebp - 0x82c]
mov esi, 0x20019
push eax
push esi
push ecx
mov ecx, dword [ebp - 0x824]
mov edx, str.Old_Default_Editor
call fcn.0040bac7
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x407bd1
lea eax, [ebp - 0x820]
mov edx, str.shell
push eax
push esi
push ecx
mov ecx, dword [ebp - 0x82c]
call fcn.0040bac7
test eax, eax
je 0x407beb
lea ecx, [ebp - 0x820]
call fcn.0040846e
test eax, eax
je 0x407e45
mov byte [ebp - 0x811], 1
mov ecx, dword [ebp - 0x81c]
call fcn.004096a7
mov dword [ebp - 0x840], eax
test eax, eax
je 0x407c58
mov bl, byte [ebp - 0x811]
mov esi, eax
xor edi, edi
push 0x3b
pop edx
mov ecx, esi
call fcn.0040b2eb
mov dword [ebp - 0x834], eax
test eax, eax
je 0x407c23
xor ecx, ecx
mov word [eax], cx
cmp word [esi], di
je 0x407c3f
movzx eax, bl
mov edx, esi
push eax
push dword [ebp - 0x820]
call fcn.00407eda
mov eax, dword [ebp - 0x834]
mov esi, eax
add eax, 2
neg esi
sbb esi, esi
and esi, eax
jne 0x407c0a
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x828]
xor esi, esi
lea edx, [ebp - 0x818]
push esi
push dword [ebp - 0x81c]
mov ecx, 0x80000002
mov dword [ebp - 0x818], esi
call fcn.00405e3c
test eax, eax
je 0x407c8c
push str.KnownIDs
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x818], esi
je 0x407c9c
push dword [ebp - 0x818]
call edi
mov edi, dword [ebp - 0x81c]
mov edx, edi
mov ecx, esi
call fcn.00407959
inc esi
cmp esi, 9
jb 0x407ca2
mov esi, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x407e0a
xor ecx, ecx
lea eax, [ebp - 0x848]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x818]
mov dword [ebp - 0x83c], ecx
push eax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x834], ecx
push eax
push ecx
jmp 0x407ded
xor eax, eax
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x818]
push eax
push 0x2001f
push ecx
lea edx, [ebp - 0x810]
mov ecx, Ordinal_1
call fcn.0040bac7
test eax, eax
jne 0x407db0
mov dword [ebp - 0x81c], eax
lea eax, [ebp - 0x81c]
mov byte [ebp - 4], 5
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x818]
mov edx, 0x41b664
call fcn.0040bac7
test eax, eax
jne 0x407d9f
mov ecx, dword [ebp - 0x81c]
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x828]
xor edx, edx
push eax
call fcn.004091a9
test eax, eax
je 0x407ea6
mov ebx, dword [ebp - 0x828]
test ebx, ebx
je 0x407d80
mov edx, str.msohtmed.exe
mov ecx, ebx
call fcn.0040b5f5
jmp 0x407d82
xor eax, eax
test eax, eax
je 0x407d9f
movzx eax, byte [ebp - 0x811]
lea edx, [ebp - 0x810]
push eax
push dword [ebp - 0x820]
call fcn.00407eda
cmp dword [ebp - 0x81c], 0
je 0x407db0
push dword [ebp - 0x81c]
call edi
mov byte [ebp - 4], 3
cmp dword [ebp - 0x818], 0
je 0x407dc5
push dword [ebp - 0x818]
call edi
mov eax, dword [ebp - 0x834]
lea ecx, [ebp - 0x848]
push ecx
inc eax
xor ecx, ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x834], eax
push ecx
lea ecx, [ebp - 0x810]
push ecx
push eax
push Ordinal_1
mov dword [ebp - 0x818], 0x400
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x407ced
mov ecx, esi
call fcn.00407f97
mov ecx, dword [ebp - 0x824]
mov edx, str.Old_Default_Editor
call fcn.0040902d
mov dword [ebp - 0x838], 1
mov ecx, dword [ebp - 0x840]
test ecx, ecx
je 0x407e3a
call fcn.00401e39
test ebx, ebx
je 0x407e45
mov ecx, ebx
call fcn.00401e39
cmp dword [ebp - 0x820], 0
je 0x407e56
push dword [ebp - 0x820]
call edi
xor ebx, ebx
mov dword [ebp - 0x820], ebx
cmp dword [ebp - 0x82c], ebx
je 0x407e6e
push dword [ebp - 0x82c]
call edi
mov dword [ebp - 0x82c], ebx
cmp dword [ebp - 0x830], ebx
je 0x407e84
push dword [ebp - 0x830]
call edi
mov dword [ebp - 0x830], ebx
cmp dword [ebp - 0x824], ebx
je 0x407e9a
push dword [ebp - 0x824]
call edi
mov eax, dword [ebp - 0x838]
call fcn.0041824c
ret
cmp dword [ebp - 0x81c], 0
je 0x407eb7
push dword [ebp - 0x81c]
call edi
xor eax, eax
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x818], eax
je 0x407ecf
push dword [ebp - 0x818]
call edi
mov ebx, dword [ebp - 0x828]
jmp 0x407e2b