Function at 0x4037ef
Capabilities:
Delete registry key
Set registry value

Disassembly:
push 0x850
mov eax, 0x40869d
call fcn.00408335
mov eax, edx
mov dword [ebp - 0x854], eax
mov edx, ecx
mov dword [ebp - 0x844], edx
mov ecx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x858], ecx
mov edi, esi
mov dword [ebp - 0x85c], esi
mov ebx, esi
test edx, edx
je 0x403bde
test eax, eax
je 0x403bde
test ecx, ecx
je 0x403bde
xor eax, eax
mov dword [ebp - 0x84c], esi
push 0x4094f4
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x850], esi
mov dword [ebp - 0x848], esi
mov dword [ebp - 0x818], esi
mov dword [ebp - 0x814], 7
mov word [ebp - 0x828], ax
call fcn.00404a5c
lea ecx, [ebp - 0x810]
mov dword [ebp - 4], esi
call fcn.0040198c
mov esi, eax
mov dword [ebp - 0x82c], 7
xor eax, eax
lea ecx, [ebp - 0x840]
push 0x4094f4
mov dword [ebp - 0x830], eax
mov word [ebp - 0x840], ax
call fcn.00404a5c
xor eax, eax
lea ecx, [ebp - 0x840]
inc eax
mov byte [ebp - 4], al
test esi, esi
je 0x4038ed
push str.USERS_
mov esi, 0x80000003
call fcn.00404612
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.00404612
lea ecx, [ebp - 0x828]
mov eax, 0x409540
jmp 0x4038f7
mov esi, 0x80000001
mov eax, str.CURRENT_USER_
push eax
call fcn.00404612
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
lea ecx, [ebp - 0x828]
call fcn.00404612
push dword [ebp - 0x844]
lea ecx, [ebp - 0x828]
call fcn.00404612
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
push dword [ebp - 0x818]
cmovae eax, dword [ebp - 0x828]
lea ecx, [ebp - 0x840]
push eax
call fcn.00404ac2
push 0x40a66c
lea ecx, [ebp - 0x840]
call fcn.00404612
cmp dword [ebp - 0x814], 8
lea ecx, [ebp - 0x848]
push ecx
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
xor ecx, ecx
push 0xf003f
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403a1c
lea eax, [ebp - 0x844]
xor ecx, ecx
push eax
push 0x20019
push ecx
push str.UserChoice
push dword [ebp - 0x848]
mov dword [ebp - 0x844], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403a08
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x82c], 8
lea eax, [ebp - 0x840]
lea ecx, [ebp - 0x850]
cmovae eax, dword [ebp - 0x840]
xor edx, edx
push ecx
push edx
lea ecx, [ebp - 0x84c]
push ecx
push edx
push edx
push 4
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
push str.UserChoice
push dword [ebp - 0x848]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
push 1
pop eax
cmovne ebx, eax
push dword [ebp - 0x848]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x403b24
xor ebx, ebx
lea ecx, [ebp - 0x828]
push 0x40a66c
mov dword [ebp - 0x844], ebx
call fcn.00404612
cmp dword [ebp - 0x814], 8
lea ecx, [ebp - 0x844]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x403b24
cmp dword [ebp - 0x84c], ebx
je 0x403a99
cmp dword [ebp - 0x82c], 8
lea eax, [ebp - 0x840]
push ebx
push dword [ebp - 0x84c]
cmovae eax, dword [ebp - 0x840]
push ebx
push ebx
push 4
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov edx, dword [ebp - 0x854]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x403aa4
sub ecx, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
xor eax, eax
inc eax
push eax
push ebx
push str.Progid
push dword [ebp - 0x844]
call esi
test eax, eax
jne 0x403b18
mov edx, dword [ebp - 0x858]
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x85c]
jne 0x403ae3
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
inc ebx
lea eax, [ecx*2 + 2]
push eax
push edx
push ebx
xor eax, eax
push eax
push str.Hash
push dword [ebp - 0x844]
call esi
test eax, eax
cmove edi, ebx
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
cmp dword [ebp - 0x850], ebx
je 0x403b48
push dword [ebp - 0x850]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0x82c]
mov esi, 0x1000
cmp edx, 8
jb 0x403b84
mov ecx, dword [ebp - 0x840]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, esi
jb 0x403b7b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x403bcb
push edx
push ecx
call fcn.00407851
pop ecx
pop ecx
mov edx, dword [ebp - 0x814]
xor eax, eax
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x82c], 7
mov word [ebp - 0x840], ax
cmp edx, 8
jb 0x403bda
mov ecx, dword [ebp - 0x828]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, esi
jb 0x403bd1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x403bd1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00407851
pop ecx
pop ecx
mov eax, edi
jmp 0x403be0
xor eax, eax
call fcn.004082f0
ret