Function at 0x4032a1
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
jmp 0x463440
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x529f0b
push eax
mov dword fs:[0], esp
sub esp, 0x860
push ebx
push ebp
mov ebp, ecx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp]
lea ecx, [esp + 0x458]
push eax
push 0x557ce4
push ecx
call edi
mov edx, dword [ebp]
add esp, 0xc
lea eax, [esp + 0x248]
push edx
push str.FotoCanvas2._s
push eax
call edi
mov edx, dword [0x566a70]
add esp, 0xc
lea ecx, [esp + 0x76c]
push 0x104
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x463b5b
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x463792
lea eax, [esp + 0x10]
lea ecx, [esp + 0x248]
push eax
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x4634e3
xor eax, eax
jmp 0x463b5b
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x4635f9
mov dl, byte [0x5688a4]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x141]
mov byte [esp + 0x140], dl
lea edx, [esp + 0x458]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x140]
push eax
push ecx
push edx
push SysReAllocString
mov dword [esp + 0x24], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x4635b5
mov al, byte [esp + 0x140]
test al, al
je 0x4635f9
lea eax, [esp + 0x248]
lea ecx, [esp + 0x140]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__strcmpi]
add esp, 8
test eax, eax
je 0x4635f9
lea edx, [esp + 0x458]
lea eax, [esp + 0x560]
push edx
push str._sUndoClass
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x140]
push ecx
call ebx
lea edx, [esp + 0x140]
push eax
push edx
lea eax, [esp + 0x568]
push 1
push eax
push SysReAllocString
call esi
mov al, byte [esp + 0x140]
test al, al
je 0x4635f9
lea ecx, [esp + 0x18]
lea edx, [esp + 0x140]
push ecx
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4635ee
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push eax
push ecx
call fcn.00463d50
add esp, 8
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x248]
push eax
call ebx
lea ecx, [esp + 0x248]
push eax
push ecx
lea edx, [esp + 0x460]
push 1
push edx
push SysReAllocString
call esi
mov al, byte [0x5688a4]
mov ecx, 0x3f
mov byte [esp + 0x350], al
xor eax, eax
lea edi, [esp + 0x351]
lea edx, [esp + 0x350]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp]
stosw word es:[edi], ax
push ecx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts._s
push edx
stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x350]
lea ecx, [esp + 0x24]
push eax
push SysReAllocString
call fcn.00477940
push str.Application
lea ecx, [esp + 0x28]
mov dword [esp + 0x87c], 0
call fcn.00478cf0
lea ecx, [esp + 0x24]
mov dword [esp + 0x878], 0xffffffff
call fcn.00477bd0
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x463938
mov eax, dword [ebp]
lea ecx, [esp + 0x38]
push eax
push str.FotoCanvas__s_Image
push ecx
call edi
add esp, 0xc
lea edx, [esp + 0x38]
push edx
call ebx
push eax
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x250]
push 1
push ecx
push SysReAllocString
call esi
mov dl, byte [0x5688a4]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x561]
mov byte [esp + 0x560], dl
mov edx, dword [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x20]
lea ecx, [esp + 0x560]
push eax
push ecx
push str.DefaultIcon
push edx
mov dword [esp + 0x30], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [esp + 0x560]
push 0x557c38
push eax
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 8
test eax, eax
jne 0x463933
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x76c]
push 1
push ecx
lea edx, [esp + 0x670]
push str._s__d
push edx
call edi
mov eax, dword [ebp + 0x1c]
add esp, 0x10
test eax, eax
je 0x4638c9
mov ecx, dword [ebp]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, 0x566788
call fcn.004c1fd0
test eax, eax
je 0x463915
mov edx, dword [eax + 0x140]
mov ecx, dword [esp + 0x14]
jmp 0x4638f1
mov eax, dword [ebp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x46387a
push 0xc
lea ecx, [esp + 0x24c]
push str.FotoCanvas2.
push ecx
call dword [sym.imp.MSVCRT.dll__memicmp]
add esp, 0xc
test eax, eax
jne 0x4637da
lea edx, [esp + 0x248]
push edx
push SysReAllocString
call fcn.00478d20
add esp, 8
lea eax, [esp + 0x458]
lea ecx, [esp + 0x350]
push eax
push str._sUndoClass
push ecx
call edi
mov dl, byte [0x5688a4]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x14d]
mov byte [esp + 0x14c], dl
add esp, 0xc
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
lea ecx, [esp + 0x140]
push eax
lea edx, [esp + 0x354]
push ecx
push edx
push SysReAllocString
mov dword [esp + 0x24], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x463850
lea eax, [esp + 0x350]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [esp + 0x140]
push ecx
call ebx
lea edx, [esp + 0x140]
push eax
push edx
lea eax, [esp + 0x460]
push 1
push eax
push SysReAllocString
call esi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x248]
push ecx
lea eax, [esp + 0x45c]
push edx
push eax
push SysReAllocString
mov dword [esp + 0x28], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x248]
push ecx
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x46369f
xor eax, eax
jmp 0x463b5b
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x463915
mov ecx, dword [ebp]
lea eax, [esp + 0x1c]
push eax
push ecx
mov ecx, 0x566788
call fcn.004c14a0
test eax, eax
je 0x463915
mov edx, dword [eax + 0x140]
mov ecx, dword [esp + 0x1c]
mov edx, dword [edx + 0x38]
lea ecx, [ecx + ecx*4]
shl ecx, 4
add eax, 4
mov ecx, dword [edx + ecx + 0x48]
lea edx, [esp + 0x668]
push ecx
push eax
push str._s__d
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x38]
push eax
call ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x668]
push eax
push ecx
push 1
push str.DefaultIcon
push edx
call esi
mov eax, dword [ebp + 0x14]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
je 0x463a26
lea eax, [esp + 0x38]
push str.Open
push eax
call edi
lea ecx, [esp + 0x38]
push ecx
call ebx
lea edx, [esp + 0x38]
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push str.Shell
push eax
call esi
lea ecx, [esp + 0x76c]
lea edx, [esp + 0x38]
push ecx
push str.__s___dde
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x38]
push eax
call ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
push ecx
push 1
push str.ShellOpenCommand
push edx
call esi
lea eax, [esp + 0x38]
push str._open___1___
push eax
call edi
lea ecx, [esp + 0x38]
push ecx
call ebx
lea edx, [esp + 0x38]
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push str.ShellOpenDDEExec
push eax
call esi
lea ecx, [esp + 0x38]
push 0x552364
push ecx
call edi
lea edx, [esp + 0x38]
push edx
call ebx
mov ecx, dword [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
push 1
push str.ShellOpenDDEExecApplication
push ecx
call esi
lea edx, [esp + 0x38]
push str.System
push edx
call edi
lea eax, [esp + 0x38]
push eax
call ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
push ecx
push 1
push str.ShellOpenDDEExecTopic
push edx
call esi
mov eax, dword [esp + 0x10]
push str.ShellOpenDDEExecIFExec
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x463b39
mov eax, dword [ebp + 4]
test eax, eax
jne 0x463a43
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x463b39
mov edx, dword [0x566a70]
lea ecx, [esp + 0x38]
push 0x105
push ecx
push 0x3ea2
push edx
call fcn.0040182a
add esp, 0x10
lea eax, [esp + 0x38]
push eax
call ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
push ecx
push 1
push str.ShellFotoCanvasEdit
push edx
call esi
lea eax, [esp + 0x76c]
lea ecx, [esp + 0x38]
push eax
push str.__s___dde
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x38]
push edx
call ebx
mov ecx, dword [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
push 1
push str.ShellFotoCanvasEditCommand
push ecx
call esi
lea edx, [esp + 0x38]
push str._edit___1___
push edx
call edi
lea eax, [esp + 0x38]
push eax
call ebx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x38]
push eax
push ecx
push 1
push str.ShellFotoCanvasEditDDEExec
push edx
call esi
lea eax, [esp + 0x38]
push 0x552364
push eax
call edi
lea ecx, [esp + 0x38]
push ecx
call ebx
lea edx, [esp + 0x38]
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push str.ShellFotoCanvasEditDDEExecApplication
push eax
call esi
lea ecx, [esp + 0x38]
push str.System
push ecx
call edi
lea edx, [esp + 0x38]
push edx
call ebx
mov ecx, dword [esp + 0x10]
push eax
lea eax, [esp + 0x3c]
push eax
push 1
push str.ShellFotoCanvasEditDDEExecTopic
push ecx
call esi
mov edx, dword [esp + 0x10]
push str.ShellFotoCanvasEditDDEExecIFExec
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x463b4b
mov eax, dword [esp + 0x10]
push str.ShellFotoCanvasEdit
push eax
call fcn.00478d20
add esp, 8
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0x870]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x86c
ret