Function at 0x454ed0
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d33fb
push eax
mov dword fs:[0], esp
sub esp, 0x860
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp]
lea ecx, [esp + 0x55c]
push eax
push 0x4f01e8
push ecx
call edi
mov edx, dword [ebp]
add esp, 0xc
lea eax, [esp + 0x248]
push edx
push str.ACDSee._s
push eax
call edi
mov edx, dword [0x4f604c]
add esp, 0xc
lea ecx, [esp + 0x458]
push 0x104
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x455802
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x45517c
lea eax, [esp + 0x10]
lea ecx, [esp + 0x248]
push eax
push ecx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x454f73
xor eax, eax
jmp 0x455802
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x455088
mov dl, byte [0x4f55a8]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x141]
mov byte [esp + 0x140], dl
lea edx, [esp + 0x55c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x140]
push eax
push ecx
push edx
push 0x80000000
mov dword [esp + 0x24], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x455044
mov al, byte [esp + 0x140]
test al, al
je 0x455088
lea eax, [esp + 0x248]
lea ecx, [esp + 0x140]
push eax
push ecx
call fcn.004b3100
add esp, 8
test eax, eax
je 0x455088
lea edx, [esp + 0x55c]
lea eax, [esp + 0x664]
push edx
push str._sUndoClass
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x140]
push ecx
call ebx
lea edx, [esp + 0x140]
push eax
push edx
lea eax, [esp + 0x66c]
push 1
push eax
push 0x80000000
call esi
mov al, byte [esp + 0x140]
test al, al
je 0x455088
lea ecx, [esp + 0x18]
lea edx, [esp + 0x140]
push ecx
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x45507d
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push eax
push ecx
call fcn.00455820
add esp, 8
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x248]
push eax
call ebx
lea ecx, [esp + 0x248]
push eax
push ecx
lea edx, [esp + 0x564]
push 1
push edx
push 0x80000000
call esi
mov al, byte [0x4f55a8]
mov ecx, 0x3f
mov byte [esp + 0x350], al
xor eax, eax
lea edi, [esp + 0x351]
lea edx, [esp + 0x350]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp]
stosw word es:[edi], ax
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts._s
push edx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x350]
lea ecx, [esp + 0x12c]
push eax
push DrawStatusTextA
call fcn.0046fdd0
push str.Application
lea ecx, [esp + 0x130]
mov dword [esp + 0x87c], 0
call fcn.00470840
lea ecx, [esp + 0x12c]
mov dword [esp + 0x878], 0xffffffff
call fcn.0046ffb0
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4553fd
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x4552b2
mov eax, dword [ebp]
lea ecx, [esp + 0x24]
push eax
push str.ACDSee__s_
push ecx
call edi
add esp, 0xc
lea edx, [esp + 0x24]
push edx
call ebx
push eax
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x250]
push 1
push ecx
jmp 0x4552dc
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x455263
push 7
lea ecx, [esp + 0x24c]
push str.ACDSee.
push ecx
call fcn.004a9930
add esp, 0xc
test eax, eax
jne 0x4551c3
lea edx, [esp + 0x248]
push edx
push 0x80000000
call fcn.00470870
add esp, 8
lea eax, [esp + 0x55c]
lea ecx, [esp + 0x350]
push eax
push str._sUndoClass
push ecx
call edi
mov dl, byte [0x4f55a8]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14d]
mov byte [esp + 0x14c], dl
add esp, 0xc
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x140]
push eax
lea edx, [esp + 0x354]
push ecx
push edx
push 0x80000000
mov dword [esp + 0x24], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x455239
lea eax, [esp + 0x350]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [esp + 0x140]
push ecx
call ebx
lea edx, [esp + 0x140]
push eax
push edx
lea eax, [esp + 0x564]
push 1
push eax
push 0x80000000
call esi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x248]
push ecx
lea eax, [esp + 0x560]
push edx
push eax
push 0x80000000
mov dword [esp + 0x28], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x248]
push ecx
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x455137
xor eax, eax
jmp 0x455802
mov edx, dword [ebp]
lea eax, [esp + 0x24]
push edx
push 0x4f0154
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
call ebx
lea edx, [esp + 0x24]
push eax
push edx
lea eax, [esp + 0x250]
push 1
push eax
push 0x80000000
call esi
mov cl, byte [0x4f55a8]
xor eax, eax
mov byte [esp + 0x664], cl
mov ecx, 0x41
lea edi, [esp + 0x665]
lea edx, [esp + 0x20]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x664]
push edx
push eax
push str.DefaultIcon
push ecx
mov dword [esp + 0x30], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea edx, [esp + 0x664]
push 0x4eeef4
push edx
call fcn.004a8fec
add esp, 8
test eax, eax
jne 0x4553f8
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [esp + 0x458]
push 1
push eax
lea ecx, [esp + 0x774]
push 0x4efd08
push ecx
call edi
mov eax, dword [ebp + 0x1c]
add esp, 0x10
test eax, eax
je 0x45538e
mov eax, dword [ebp]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, 0x4f55f8
call fcn.0049b540
test eax, eax
je 0x4553da
mov edx, dword [eax + 0x138]
mov ecx, dword [esp + 0x14]
jmp 0x4553b6
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x4553da
mov ecx, dword [ebp]
lea eax, [esp + 0x1c]
push eax
push ecx
mov ecx, 0x4f55f8
call fcn.0049ab30
test eax, eax
je 0x4553da
mov edx, dword [eax + 0x138]
mov ecx, dword [esp + 0x1c]
mov edx, dword [edx + 0x38]
lea ecx, [ecx + ecx*4]
shl ecx, 4
add eax, 4
mov ecx, dword [edx + ecx + 0x48]
lea edx, [esp + 0x76c]
push ecx
push eax
push 0x4efd08
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x24]
push eax
call ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x76c]
push eax
push ecx
push 1
push str.DefaultIcon
push edx
call esi
mov eax, dword [ebp + 0x14]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
je 0x45554a
mov eax, dword [ebp + 0x1c]
push str.Open
test eax, eax
lea eax, [esp + 0x28]
push eax
je 0x455472
call edi
lea ecx, [esp + 0x24]
push ecx
call ebx
lea edx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push str.Shell
push eax
call esi
lea ecx, [esp + 0x458]
lea edx, [esp + 0x24]
push ecx
push str.__s_____1_
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x24]
push eax
call ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
push ecx
push 1
push str.ShellOpenCommand
push edx
call esi
jmp 0x45554a
call edi
lea ecx, [esp + 0x24]
push ecx
call ebx
lea edx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push str.Shell
push eax
call esi
lea ecx, [esp + 0x458]
lea edx, [esp + 0x24]
push ecx
push str.__s___dde
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x24]
push eax
call ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
push ecx
push 1
push str.ShellOpenCommand
push edx
call esi
lea eax, [esp + 0x24]
push str._open___1___
push eax
call edi
lea ecx, [esp + 0x24]
push ecx
call ebx
lea edx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push str.ShellOpenDDEExec
push eax
call esi
lea ecx, [esp + 0x24]
push 0x4ed560
push ecx
call edi
lea edx, [esp + 0x24]
push edx
call ebx
mov ecx, dword [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push 1
push str.ShellOpenDDEExecApplication
push ecx
call esi
lea edx, [esp + 0x24]
push str.System
push edx
call edi
lea eax, [esp + 0x24]
push eax
call ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
push ecx
push 1
push str.ShellOpenDDEExecTopic
push edx
call esi
mov eax, dword [esp + 0x10]
push str.ShellOpenDDEExecIFExec
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x4555e5
mov ecx, dword fs:[0x2c]
mov edx, dword [0x4f83ec]
mov eax, dword [ecx + edx*4]
mov cl, byte [eax + 0x4fb]
test cl, cl
je 0x4555e5
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x4555e5
mov edx, dword [0x4f604c]
lea ecx, [esp + 0x24]
push 0x105
push ecx
push 0xec
push edx
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x24]
push eax
call ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
push ecx
push 1
push str.shellACDBrowse
push edx
call esi
lea eax, [esp + 0x458]
lea ecx, [esp + 0x24]
push eax
push str.__s_____1_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x24]
push edx
call ebx
mov ecx, dword [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push 1
push str.shellACDBrowsecommand
push ecx
call esi
jmp 0x4555f7
mov edx, dword [esp + 0x10]
push str.shellACDBrowse
push edx
call fcn.00470870
add esp, 8
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x455729
mov eax, dword [ebp + 4]
test eax, eax
je 0x455729
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4f83ec]
mov edx, dword [eax + ecx*4]
mov al, byte [edx + 0x4f9]
test al, al
je 0x455729
mov eax, dword [ebp + 0x14]
test eax, eax
jne 0x455729
mov ecx, dword [0x4f604c]
lea eax, [esp + 0x24]
push 0x105
push eax
push 0xed
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 0x24]
push edx
call ebx
mov ecx, dword [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push 1
push str.ShellACDView
push ecx
call esi
lea edx, [esp + 0x458]
lea eax, [esp + 0x24]
push edx
push str.__s___dde
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
call ebx
lea edx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push str.ShellACDViewCommand
push eax
call esi
lea ecx, [esp + 0x24]
push str._open___1___
push ecx
call edi
lea edx, [esp + 0x24]
push edx
call ebx
mov ecx, dword [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push 1
push str.ShellACDViewDDEExec
push ecx
call esi
lea edx, [esp + 0x24]
push 0x4ed560
push edx
call edi
lea eax, [esp + 0x24]
push eax
call ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x24]
push eax
push ecx
push 1
push str.ShellACDViewDDEExecApplication
push edx
call esi
lea eax, [esp + 0x24]
push str.System
push eax
call edi
lea ecx, [esp + 0x24]
push ecx
call ebx
lea edx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push str.ShellACDViewDDEExecTopic
push eax
call esi
mov ecx, dword [esp + 0x10]
push str.ShellACDViewDDEExecIFExec
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x45573b
mov edx, dword [esp + 0x10]
push str.ShellACDView
push edx
call fcn.00470870
add esp, 8
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x4557e0
mov eax, dword [ebp + 4]
test eax, eax
jne 0x455758
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4557e0
mov eax, dword fs:[0x2c]
mov ecx, dword [0x4f83ec]
mov edx, dword [eax + ecx*4]
mov al, byte [edx + 0x4fa]
test al, al
je 0x4557e0
mov ecx, dword [0x4f604c]
lea eax, [esp + 0x24]
push 0x105
push eax
push 0xeb
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 0x24]
push edx
call ebx
mov ecx, dword [esp + 0x10]
push eax
lea eax, [esp + 0x28]
push eax
push 1
push str.ShellACDPrint
push ecx
call esi
lea edx, [esp + 0x458]
lea eax, [esp + 0x24]
push edx
push str.__s___p____1_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x24]
push ecx
call ebx
lea edx, [esp + 0x24]
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push str.ShellACDPrintCommand
push eax
call esi
jmp 0x4557f2
mov ecx, dword [esp + 0x10]
push str.ShellACDPrint
push ecx
call fcn.00470870
add esp, 8
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x870]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x86c
ret