Function at 0x40804d
Capabilities:
Delete registry value
Query or enumerate registry key

Disassembly:
push 0x83c
mov eax, 0x42f761
call fcn.0042ed1b
mov eax, ecx
mov dword [ebp - 0x81c], eax
xor ecx, ecx
mov ebx, ecx
mov dword [ebp - 0x838], ecx
mov byte [ebp - 0x811], cl
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x824], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x830], ecx
mov dword [ebp - 0x82c], ecx
mov dword [ebp - 0x820], ecx
test eax, eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x830]
mov ecx, str.SOFTWAREMicrosoftSharedHTML
push eax
mov esi, str.SOFTWAREMicrosoftSharedMHTML
cmove esi, ecx
push 0x20019
push ecx
mov edx, esi
mov ecx, reloc.appvisvsubsystems32.dll_Ordinal_1
call main
mov edi, str.Default_Editor
test eax, eax
jne 0x4080d7
mov ecx, dword [ebp - 0x830]
mov edx, edi
call fcn.0040957f
lea eax, [ebp - 0x824]
mov edx, esi
push eax
push 0x20019
push ecx
mov ecx, 0x80000002
call main
test eax, eax
jne 0x408101
mov ecx, dword [ebp - 0x824]
mov edx, edi
call fcn.0040957f
lea eax, [ebp - 0x82c]
mov esi, 0x20019
push eax
push esi
push ecx
mov ecx, dword [ebp - 0x824]
mov edx, str.Old_Default_Editor
call main
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
test eax, eax
jne 0x408146
lea eax, [ebp - 0x820]
mov edx, str.shell
push eax
push esi
push ecx
mov ecx, dword [ebp - 0x82c]
call main
test eax, eax
je 0x408160
lea ecx, [ebp - 0x820]
call main
test eax, eax
je 0x4083ba
mov byte [ebp - 0x811], 1
mov ecx, dword [ebp - 0x81c]
call main
mov dword [ebp - 0x840], eax
test eax, eax
je 0x4081cd
mov bl, byte [ebp - 0x811]
mov esi, eax
xor edi, edi
push 0x3b
pop edx
mov ecx, esi
call fcn.0040b844
mov dword [ebp - 0x834], eax
test eax, eax
je 0x408198
xor ecx, ecx
mov word [eax], cx
cmp word [esi], di
je 0x4081b4
movzx eax, bl
mov edx, esi
push eax
push dword [ebp - 0x820]
call fcn.0040844f
mov eax, dword [ebp - 0x834]
mov esi, eax
add eax, 2
neg esi
sbb esi, esi
and esi, eax
jne 0x40817f
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x828]
xor esi, esi
lea edx, [ebp - 0x818]
push esi
push dword [ebp - 0x81c]
mov ecx, 0x80000002
mov dword [ebp - 0x818], esi
call main
test eax, eax
je 0x408201
push str.KnownIDs
push dword [ebp - 0x818]
call dword [sym.imp.advapi32.dll_RegDeleteValueW]
cmp dword [ebp - 0x818], esi
je 0x408211
push dword [ebp - 0x818]
call edi
mov edi, dword [ebp - 0x81c]
mov edx, edi
mov ecx, esi
call fcn.00407ea0
inc esi
cmp esi, 9
jb 0x408217
mov esi, edi
mov edi, dword [sym.imp.advapi32.dll_RegCloseKey]
test esi, esi
jne 0x40837f
xor ecx, ecx
lea eax, [ebp - 0x848]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x818]
mov dword [ebp - 0x83c], ecx
push eax
lea eax, [ebp - 0x810]
mov dword [ebp - 0x834], ecx
push eax
push ecx
jmp 0x408362
xor eax, eax
mov dword [ebp - 0x818], eax
lea eax, [ebp - 0x818]
push eax
push 0x2001f
push ecx
lea edx, [ebp - 0x810]
mov ecx, Ordinal_1
call main
test eax, eax
jne 0x408325
mov dword [ebp - 0x81c], eax
lea eax, [ebp - 0x81c]
mov byte [ebp - 4], 5
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x818]
mov edx, 0x4337e4
call main
test eax, eax
jne 0x408314
mov ecx, dword [ebp - 0x81c]
lea eax, [ebp - 0x83c]
push eax
lea eax, [ebp - 0x828]
xor edx, edx
push eax
call main
test eax, eax
je 0x40841b
mov ebx, dword [ebp - 0x828]
test ebx, ebx
je 0x4082f5
mov edx, str.msohtmed.exe
mov ecx, ebx
call main
jmp 0x4082f7
xor eax, eax
test eax, eax
je 0x408314
movzx eax, byte [ebp - 0x811]
lea edx, [ebp - 0x810]
push eax
push dword [ebp - 0x820]
call fcn.0040844f
cmp dword [ebp - 0x81c], 0
je 0x408325
push dword [ebp - 0x81c]
call edi
mov byte [ebp - 4], 3
cmp dword [ebp - 0x818], 0
je 0x40833a
push dword [ebp - 0x818]
call edi
mov eax, dword [ebp - 0x834]
lea ecx, [ebp - 0x848]
push ecx
inc eax
xor ecx, ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x818]
mov dword [ebp - 0x834], eax
push ecx
lea ecx, [ebp - 0x810]
push ecx
push eax
push Ordinal_1
mov dword [ebp - 0x818], 0x400
call dword [sym.imp.advapi32.dll_RegEnumKeyExW]
test eax, eax
je 0x408262
mov ecx, esi
call fcn.0040850c
mov ecx, dword [ebp - 0x824]
mov edx, str.Old_Default_Editor
call fcn.0040957f
mov dword [ebp - 0x838], 1
mov ecx, dword [ebp - 0x840]
test ecx, ecx
je 0x4083af
call fcn.00402061
test ebx, ebx
je 0x4083ba
mov ecx, ebx
call fcn.00402061
cmp dword [ebp - 0x820], 0
je 0x4083cb
push dword [ebp - 0x820]
call edi
xor ebx, ebx
mov dword [ebp - 0x820], ebx
cmp dword [ebp - 0x82c], ebx
je 0x4083e3
push dword [ebp - 0x82c]
call edi
mov dword [ebp - 0x82c], ebx
cmp dword [ebp - 0x830], ebx
je 0x4083f9
push dword [ebp - 0x830]
call edi
mov dword [ebp - 0x830], ebx
cmp dword [ebp - 0x824], ebx
je 0x40840f
push dword [ebp - 0x824]
call edi
mov eax, dword [ebp - 0x838]
call fcn.0042ecda
ret
cmp dword [ebp - 0x81c], 0
je 0x40842c
push dword [ebp - 0x81c]
call edi
xor eax, eax
mov dword [ebp - 0x81c], eax
cmp dword [ebp - 0x818], eax
je 0x408444
push dword [ebp - 0x818]
call edi
mov ebx, dword [ebp - 0x828]
jmp 0x4083a0