Function at 0x407fdc
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
push 0x844
mov eax, 0x438f77
call fcn.0043869b
mov dword [ebp - 0x834], ecx
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x83c], eax
mov byte [ebp - 0x811], al
mov dword [ebp - 0x838], ebx
mov dword [ebp - 0x824], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x82c], eax
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x820], eax
mov ebx, ecx
mov byte [ebp - 4], 3
mov eax, str.SOFTWAREMicrosoftSharedHTML
test ebx, ebx
mov esi, str.SOFTWAREMicrosoftSharedMHTML
cmove esi, eax
lea eax, [ebp - 0x82c]
push eax
push 0x20019
push ecx
mov edx, esi
mov ecx, reloc.AppVIsvSubsystems32.dll_Ordinal_1
call fcn.0040c1f1
mov edi, str.Default_Editor
test eax, eax
jne 0x408066
mov ecx, dword [ebp - 0x82c]
mov edx, edi
call fcn.0040956d
lea eax, [ebp - 0x824]
mov edx, esi
push eax
push 0x20019
push ecx
mov ecx, 0x80000002
call fcn.0040c1f1
test eax, eax
jne 0x408090
mov ecx, dword [ebp - 0x824]
mov edx, edi
call fcn.0040956d
lea eax, [ebp - 0x828]
mov esi, 0x20019
push eax
push esi
push ecx
mov ecx, dword [ebp - 0x824]
mov edx, str.Old_Default_Editor
call fcn.0040c1f1
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4080d5
lea eax, [ebp - 0x820]
mov edx, str.shell
push eax
push esi
push ecx
mov ecx, dword [ebp - 0x828]
call fcn.0040c1f1
test eax, eax
je 0x4080ef
lea ecx, [ebp - 0x820]
call fcn.004089b1
test eax, eax
je 0x40838b
mov byte [ebp - 0x811], 1
mov ecx, ebx
call fcn.00409c38
mov dword [ebp - 0x848], eax
test eax, eax
je 0x40814c
mov esi, eax
xor edi, edi
push 0x3b
pop edx
mov ecx, esi
call fcn.0040b9ce
mov ebx, eax
test ebx, ebx
je 0x408119
xor eax, eax
mov word [ebx], ax
cmp word [esi], di
je 0x408133
movzx eax, byte [ebp - 0x811]
mov edx, esi
push eax
push dword [ebp - 0x820]
call fcn.0040841d
mov esi, ebx
lea eax, [ebx + 2]
neg esi
sbb esi, esi
and esi, eax
jne 0x408104
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x834]
xor esi, esi
lea edx, [ebp - 0x818]
push esi
push ebx
mov ecx, 0x80000002
mov dword [ebp - 0x818], esi
call fcn.004061ad
test eax, eax
je 0x40817b
push str.KnownIDs
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x818], esi
je 0x40818b
push dword [ebp - 0x818]
call edi
mov edx, ebx
mov ecx, esi
call fcn.00407e2f
inc esi
cmp esi, 9
jb 0x40818b
test ebx, ebx
jne 0x408348
xor ecx, ecx
mov dword [ebp - 0x818], 0x400
lea eax, [ebp - 0x850]
mov dword [ebp - 0x840], ecx
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x818]
mov dword [ebp - 0x830], ecx
push eax
lea eax, [ebp - 0x810]
mov esi, ecx
push eax
push ecx
push Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x408348
mov dword [ebp - 0x818], ebx
lea eax, [ebp - 0x818]
push eax
push 0x2001f
push ecx
lea edx, [ebp - 0x810]
mov ecx, Ordinal_1
call fcn.0040c1f1
test eax, eax
jne 0x4082f0
mov dword [ebp - 0x81c], ebx
lea eax, [ebp - 0x81c]
mov byte [ebp - 4], 5
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x818]
mov edx, 0x43c728
call fcn.0040c1f1
test eax, eax
jne 0x4082df
mov ecx, dword [ebp - 0x81c]
lea eax, [ebp - 0x840]
push eax
lea eax, [ebp - 0x838]
xor edx, edx
push eax
call fcn.004096fb
test eax, eax
je 0x4083ec
mov ebx, dword [ebp - 0x838]
test ebx, ebx
je 0x4082b4
mov ecx, str.msohtmed.exe
call fcn.0040b9b7
dec eax
mov dword [ebp - 0x844], eax
jmp 0x4082a0
push dword [ebp - 0x844]
lea ebx, [esi + 2]
mov edx, 0x43d306
mov ecx, ebx
call fcn.0040bb72
test eax, eax
jne 0x4082b0
cmp word [ebx], ax
je 0x4082d7
push 0x6d
pop edx
mov ecx, ebx
call fcn.0040ba21
mov esi, eax
test esi, esi
jne 0x408282
xor ebx, ebx
jmp 0x4082b8
xor ebx, ebx
mov esi, ebx
test esi, esi
je 0x4082d9
movzx eax, byte [ebp - 0x811]
lea edx, [ebp - 0x810]
push eax
push dword [ebp - 0x820]
call fcn.0040841d
jmp 0x4082d9
xor ebx, ebx
mov esi, dword [ebp - 0x830]
cmp dword [ebp - 0x81c], 0
je 0x4082f0
push dword [ebp - 0x81c]
call edi
mov byte [ebp - 4], 3
cmp dword [ebp - 0x818], 0
je 0x408305
push dword [ebp - 0x818]
call edi
lea eax, [ebp - 0x850]
mov dword [ebp - 0x818], 0x400
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x818]
inc esi
push eax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x830], esi
push eax
push esi
push Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4081e8
mov ebx, dword [ebp - 0x834]
mov ecx, ebx
call fcn.004084da
mov ecx, dword [ebp - 0x824]
mov edx, str.Old_Default_Editor
call fcn.0040956d
mov dword [ebp - 0x83c], 1
mov eax, dword [ebp - 0x848]
mov esi, dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test eax, eax
je 0x40837d
push eax
call esi
pop ecx
mov eax, dword [ebp - 0x838]
test eax, eax
je 0x40838b
push eax
call esi
pop ecx
cmp dword [ebp - 0x820], 0
je 0x40839c
push dword [ebp - 0x820]
call edi
xor ebx, ebx
mov dword [ebp - 0x820], ebx
cmp dword [ebp - 0x828], ebx
je 0x4083b4
push dword [ebp - 0x828]
call edi
mov dword [ebp - 0x828], ebx
cmp dword [ebp - 0x82c], ebx
je 0x4083ca
push dword [ebp - 0x82c]
call edi
mov dword [ebp - 0x82c], ebx
cmp dword [ebp - 0x824], ebx
je 0x4083e0
push dword [ebp - 0x824]
call edi
mov eax, dword [ebp - 0x83c]
call fcn.00438650
ret
cmp dword [ebp - 0x81c], 0
je 0x4083fd
push dword [ebp - 0x81c]
call edi
cmp dword [ebp - 0x818], 0
mov dword [ebp - 0x81c], ebx
je 0x408369
push dword [ebp - 0x818]
call edi
jmp 0x408369