Function at 0x4022c0
Capabilities:
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x403f9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
xor ecx, ecx
mov dword [esp], ecx
mov eax, str.mailtoDefaultIcon
mov dword [esp + 0x114], ecx
test eax, eax
mov eax, 0x407798
je 0x4022fb
mov eax, str.mailtoDefaultIcon
push ebx
push ebp
push esi
lea edx, [esp + 0xc]
push edi
push edx
push 0xf003f
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, 0x104
test eax, eax
jne 0x40238c
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push str.BAK_mailto_DefaultIcon
push edx
mov dword [esp + 0x2c], edi
call esi
test eax, eax
je 0x40238c
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push 0
push edx
mov dword [esp + 0x2c], edi
call esi
lea eax, [esp + 0x18]
push eax
call ebp
mov edx, dword [esp + 0x10]
inc eax
lea ecx, [esp + 0x18]
push eax
push ecx
push 2
push 0
push str.BAK_mailto_DefaultIcon
push edx
call ebx
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4023a3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], 0
mov eax, str.mailto_shellopencommand
test eax, eax
mov eax, 0x407798
je 0x4023b6
mov eax, str.mailto_shellopencommand
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40242d
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push str.BAK_mailto_command
push ecx
mov dword [esp + 0x2c], edi
call esi
test eax, eax
je 0x40242d
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push 0
push ecx
mov dword [esp + 0x2c], edi
call esi
lea edx, [esp + 0x18]
push edx
call ebp
mov ecx, dword [esp + 0x10]
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 2
push 0
push str.BAK_mailto_command
push ecx
call ebx
lea ecx, [esp + 0x10]
call fcn.00402580
mov edx, str.SOFTWAREClientsMail
mov eax, 0x407798
test edx, edx
je 0x402446
mov eax, edx
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4024bd
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push str.BAK_mail_softname
push ecx
mov dword [esp + 0x2c], edi
call esi
test eax, eax
je 0x4024bd
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push 0
push ecx
mov dword [esp + 0x2c], edi
call esi
lea edx, [esp + 0x18]
push edx
call ebp
mov ecx, dword [esp + 0x10]
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 2
push 0
push str.BAK_mail_softname
push ecx
call ebx
lea ecx, [esp + 0x10]
call fcn.00402580
mov edx, str.SOFTWAREClientsMail
mov eax, 0x407798
test edx, edx
je 0x4024d6
mov eax, edx
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40254d
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push str.BAK_CUser_mail_softname
push ecx
mov dword [esp + 0x2c], edi
call esi
test eax, eax
je 0x40254d
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0
push 0
push ecx
mov dword [esp + 0x2c], edi
call esi
lea edx, [esp + 0x18]
push edx
call ebp
mov ecx, dword [esp + 0x10]
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 2
push 0
push str.BAK_CUser_mail_softname
push ecx
call ebx
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
je 0x402560
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10c]
mov dword fs:[0], ecx
add esp, 0x118
ret