Function at 0x401950
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c8
mov eax, dword [0x455070]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x414], ax
push 0x206
push 0
lea ecx, [ebp - 0x412]
push ecx
call sub.MSVCR110.dll_memset
add esp, 0xc
mov dword [ebp - 0x628], 0
mov dword [ebp - 0x638], 0
mov dword [ebp - 0x624], 0
mov dword [ebp - 0x62c], 0
mov dword [ebp - 0x634], 0
mov dword [ebp - 0x630], 0
mov dword [ebp - 0x620], 0
xor edx, edx
mov word [ebp - 0x20c], dx
push 0x206
push 0
lea eax, [ebp - 0x20a]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
mov dword [ebp - 0x63c], 0
mov ecx, dword [ebp + 0x14]
push ecx
push 0x439114
push 0x208
lea edx, [ebp - 0x20c]
push edx
call fcn.00401000
add esp, 0x10
lea eax, [ebp - 0x620]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x63c], eax
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x648], edx
mov eax, dword [ebp - 0x648]
add eax, 2
mov dword [ebp - 0x67c], eax
mov ecx, dword [ebp - 0x648]
mov dx, word [ecx]
mov word [ebp - 0x676], dx
add dword [ebp - 0x648], 2
cmp word [ebp - 0x676], 0
jne 0x401a45
mov eax, dword [ebp - 0x648]
sub eax, dword [ebp - 0x67c]
sar eax, 1
mov dword [ebp - 0x6b8], eax
mov ecx, dword [ebp - 0x6b8]
add ecx, 1
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 1
push 0x43911c
mov eax, dword [ebp - 0x620]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp - 0x63c]
push ecx
lea edx, [ebp - 0x20c]
push edx
push str.::Asso__RegisterElexViewer_HKEY_CLASSES_ROOT__s__d
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
push str.SOFTWAREClasses._s
push 0x208
lea ecx, [ebp - 0x20c]
push ecx
call fcn.00401000
add esp, 0x10
lea edx, [ebp - 0x620]
push edx
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x664], ecx
mov edx, dword [ebp - 0x664]
add edx, 2
mov dword [ebp - 0x6c0], edx
mov eax, dword [ebp - 0x664]
mov cx, word [eax]
mov word [ebp - 0x66c], cx
add dword [ebp - 0x664], 2
cmp word [ebp - 0x66c], 0
jne 0x401b12
mov edx, dword [ebp - 0x664]
sub edx, dword [ebp - 0x6c0]
sar edx, 1
mov dword [ebp - 0x6c8], edx
mov eax, dword [ebp - 0x6c8]
add eax, 1
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0x4391b4
mov edx, dword [ebp - 0x620]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x63c]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 0x4391b8
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0xc
mov edx, dword [ebp + 0x14]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts._s
push 0x208
lea eax, [ebp - 0x20c]
push eax
call fcn.00401000
add esp, 0x10
lea ecx, [ebp - 0x620]
push ecx
lea edx, [ebp - 0x20c]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x650], eax
mov ecx, dword [ebp - 0x650]
add ecx, 2
mov dword [ebp - 0x684], ecx
mov edx, dword [ebp - 0x650]
mov ax, word [edx]
mov word [ebp - 0x666], ax
add dword [ebp - 0x650], 2
cmp word [ebp - 0x666], 0
jne 0x401bdf
mov ecx, dword [ebp - 0x650]
sub ecx, dword [ebp - 0x684]
sar ecx, 1
mov dword [ebp - 0x6c4], ecx
mov edx, dword [ebp - 0x6c4]
add edx, 1
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
push 0x4392a0
mov ecx, dword [ebp - 0x620]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x63c], eax
mov edx, dword [ebp - 0x63c]
push edx
lea eax, [ebp - 0x20c]
push eax
push str._RegisterElexViewer_HKEY_CURRENT_USER__s_d
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x61c], cx
push 0x206
push 0
lea edx, [ebp - 0x61a]
push edx
call sub.MSVCR110.dll_memset
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
push 0x4391f4
push 0x208
lea ecx, [ebp - 0x61c]
push ecx
call fcn.00401000
add esp, 0x10
lea edx, [ebp - 0x628]
push edx
lea eax, [ebp - 0x61c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x660], ecx
mov edx, dword [ebp - 0x660]
add edx, 2
mov dword [ebp - 0x68c], edx
mov eax, dword [ebp - 0x660]
mov cx, word [eax]
mov word [ebp - 0x672], cx
add dword [ebp - 0x660], 2
cmp word [ebp - 0x672], 0
jne 0x401ccb
mov edx, dword [ebp - 0x660]
sub edx, dword [ebp - 0x68c]
sar edx, 1
mov dword [ebp - 0x6ac], edx
mov eax, dword [ebp - 0x6ac]
add eax, 1
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 1
push 0x43921c
mov edx, dword [ebp - 0x628]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x63c]
push eax
lea ecx, [ebp - 0x61c]
push ecx
push str._RegisterElexViewer___s____d
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0xc
lea edx, [ebp - 0x638]
push edx
push str.DefaultIcon
mov eax, dword [ebp - 0x628]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x658], ecx
mov edx, dword [ebp - 0x658]
add edx, 2
mov dword [ebp - 0x694], edx
mov eax, dword [ebp - 0x658]
mov cx, word [eax]
mov word [ebp - 0x674], cx
add dword [ebp - 0x658], 2
cmp word [ebp - 0x674], 0
jne 0x401d7b
mov edx, dword [ebp - 0x658]
sub edx, dword [ebp - 0x694]
sar edx, 1
mov dword [ebp - 0x6bc], edx
mov eax, dword [ebp - 0x6bc]
add eax, 1
push eax
mov ecx, dword [ebp + 8]
push ecx
push 1
push 0x439364
mov edx, dword [ebp - 0x638]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x638]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x63c]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0x439368
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0xc
lea eax, [ebp - 0x624]
push eax
push str.shell
mov ecx, dword [ebp - 0x628]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x64c], 0x4393ac
mov edx, dword [ebp - 0x64c]
add edx, 2
mov dword [ebp - 0x69c], edx
mov eax, dword [ebp - 0x64c]
mov cx, word [eax]
mov word [ebp - 0x678], cx
add dword [ebp - 0x64c], 2
cmp word [ebp - 0x678], 0
jne 0x401e36
mov edx, dword [ebp - 0x64c]
sub edx, dword [ebp - 0x69c]
sar edx, 1
mov dword [ebp - 0x6b4], edx
mov eax, dword [ebp - 0x6b4]
add eax, 1
push eax
push 0x4393b8
push 1
push 0x4393c4
mov ecx, dword [ebp - 0x624]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x63c], eax
mov edx, dword [ebp - 0x63c]
push edx
push 0x4393c8
push 0x4393d4
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0xc
lea eax, [ebp - 0x62c]
push eax
push 0x43940c
mov ecx, dword [ebp - 0x624]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x640], 0x439418
mov edx, dword [ebp - 0x640]
add edx, 2
mov dword [ebp - 0x6a4], edx
mov eax, dword [ebp - 0x640]
mov cx, word [eax]
mov word [ebp - 0x66a], cx
add dword [ebp - 0x640], 2
cmp word [ebp - 0x66a], 0
jne 0x401ee6
mov edx, dword [ebp - 0x640]
sub edx, dword [ebp - 0x6a4]
sar edx, 1
mov dword [ebp - 0x680], edx
mov eax, dword [ebp - 0x680]
add eax, 1
push eax
push 0x43941c
push 1
push 0x439420
mov ecx, dword [ebp - 0x62c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x63c], eax
lea edx, [ebp - 0x630]
push edx
push 0x439424
mov eax, dword [ebp - 0x62c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x439434
push 0x208
lea edx, [ebp - 0x414]
push edx
call fcn.00401000
add esp, 0x10
lea eax, [ebp - 0x414]
mov dword [ebp - 0x654], eax
mov ecx, dword [ebp - 0x654]
add ecx, 2
mov dword [ebp - 0x688], ecx
mov edx, dword [ebp - 0x654]
mov ax, word [edx]
mov word [ebp - 0x670], ax
add dword [ebp - 0x654], 2
cmp word [ebp - 0x670], 0
jne 0x401f9b
mov ecx, dword [ebp - 0x654]
sub ecx, dword [ebp - 0x688]
sar ecx, 1
mov dword [ebp - 0x690], ecx
mov edx, dword [ebp - 0x690]
add edx, 1
push edx
lea eax, [ebp - 0x414]
push eax
push 1
push 0x43944c
mov ecx, dword [ebp - 0x630]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x63c], eax
mov edx, dword [ebp - 0x63c]
push edx
push 0x439450
push 0x43945c
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0xc
lea eax, [ebp - 0x634]
push eax
push str.preview
mov ecx, dword [ebp - 0x624]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x65c], 0x4394a4
mov edx, dword [ebp - 0x65c]
add edx, 2
mov dword [ebp - 0x698], edx
mov eax, dword [ebp - 0x65c]
mov cx, word [eax]
mov word [ebp - 0x668], cx
add dword [ebp - 0x65c], 2
cmp word [ebp - 0x668], 0
jne 0x40204d
mov edx, dword [ebp - 0x65c]
sub edx, dword [ebp - 0x698]
sar edx, 1
mov dword [ebp - 0x6a0], edx
mov eax, dword [ebp - 0x6a0]
add eax, 1
push eax
push 0x4394a8
push 1
push 0x4394ac
mov ecx, dword [ebp - 0x634]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x63c], eax
lea edx, [ebp - 0x620]
push edx
push 0x4394b0
mov eax, dword [ebp - 0x634]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp + 0xc]
push ecx
push str.__s_____1_
push 0x208
lea edx, [ebp - 0x414]
push edx
call fcn.00401000
add esp, 0x10
lea eax, [ebp - 0x414]
mov dword [ebp - 0x644], eax
mov ecx, dword [ebp - 0x644]
add ecx, 2
mov dword [ebp - 0x6a8], ecx
mov edx, dword [ebp - 0x644]
mov ax, word [edx]
mov word [ebp - 0x66e], ax
add dword [ebp - 0x644], 2
cmp word [ebp - 0x66e], 0
jne 0x402102
mov ecx, dword [ebp - 0x644]
sub ecx, dword [ebp - 0x6a8]
sar ecx, 1
mov dword [ebp - 0x6b0], ecx
mov edx, dword [ebp - 0x6b0]
add edx, 1
push edx
lea eax, [ebp - 0x414]
push eax
push 1
push 0x4394d8
mov ecx, dword [ebp - 0x620]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x63c], eax
mov edx, dword [ebp - 0x63c]
push edx
push str.command
push str._RegisterElexViewer___s_d
call dword [sym.imp.iImportLib.dll_ISAFE_WriteProgramLogNoMask]
add esp, 0xc
mov eax, dword [ebp - 0x630]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x620]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x624]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x628]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004314a6
mov esp, ebp
pop ebp
ret