Function at 0x1000892b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xdb4
mov eax, 0x10031709
call fcn.10030db7
mov dword [ebp - 0xd78], edx
mov esi, ecx
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov edi, ecx
mov dword [ebp - 0xd8c], ebx
mov dword [ebp - 0xdb0], edi
mov byte [ebp - 0xd46], cl
mov dword [ebp - 0xd70], ecx
mov byte [ebp - 0xd45], cl
mov byte [ebp - 0xd47], cl
mov byte [ebp - 0xd6c], cl
mov dword [ebp - 0xd54], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xdb8], ecx
mov dword [ebp - 0xdb4], ecx
mov dword [ebp - 0xd5c], ecx
mov dword [ebp - 0xd50], ecx
mov dword [ebp - 0xd64], ecx
mov dword [ebp - 0xd68], ecx
mov dword [ebp - 0xd80], ecx
mov dword [ebp - 0xd84], ecx
mov dword [ebp - 0xd88], ecx
mov dword [ebp - 0xd9c], ecx
mov byte [ebp - 4], 0xa
xor eax, eax
mov word [ebp - 0x4c], ax
mov edx, 0x851
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x20]
push eax
push str.Start_Verb_Registration:
push ecx
mov dword [ebp - 0xd60], ecx
mov dword [ebp - 0xdac], ecx
mov dword [ebp - 0xd98], ecx
mov ecx, 0x170b011
push 0x64
mov dword [ebp - 0xda8], 0x28
mov dword [ebp - 0xdc0], 0x208
mov dword [ebp - 0x20], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov dword [ebp - 0x1c], str.Param
mov dword [ebp - 0x18], ebx
call fcn.10026806
mov edx, str.print
mov ecx, ebx
call fcn.1000d8bb
test eax, eax
mov dword [ebp - 0xd90], eax
lea eax, [ebp - 0xd94]
mov edx, str.shell
push eax
lea eax, [ebp - 0xd80]
sete byte [ebp - 0xd58]
push eax
sub esp, 0x14
mov ecx, esi
call fcn.10026806
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
test eax, eax
jne 0x10009542
mov ecx, dword [ebp - 0xd80]
lea eax, [ebp - 0xd94]
push eax
lea eax, [ebp - 0xd54]
mov edx, ebx
push eax
sub esp, 0x14
call fcn.10026806
test eax, eax
jne 0x10009542
mov ecx, dword [ebp - 0xd54]
lea eax, [ebp - 0xd94]
push eax
lea eax, [ebp - 0xd64]
mov edx, str.command
push eax
sub esp, 0x14
call fcn.10026806
test eax, eax
jne 0x10009542
mov ecx, dword [ebp - 0xd64]
lea eax, [ebp - 0xd60]
push eax
lea eax, [ebp - 0xd98]
xor edx, edx
push eax
call fcn.10026806
test eax, eax
je 0x10009533
mov edi, dword [ebp - 0xd98]
test edi, edi
je 0x10008aea
mov edx, str.msohtmed.exe
mov ecx, edi
call fcn.10026806
xor ecx, ecx
jmp 0x10008aee
xor ecx, ecx
mov eax, ecx
test eax, eax
je 0x10008d1c
mov bl, cl
mov dword [ebp - 0xd60], ecx
mov dword [ebp - 0xda4], ecx
mov dword [ebp - 0xd4c], ecx
mov dword [ebp - 0xd74], ecx
mov ecx, edi
call fcn.10007da3
mov edi, eax
lea ecx, [ebp - 0xd44]
push 2
mov dword [ebp - 0xda0], edi
call fcn.10026806
test eax, eax
je 0x10008c8c
lea edx, [ebp - 0xd44]
mov ecx, edi
call fcn.1000d8bb
test eax, eax
je 0x10008b4f
xor eax, eax
inc eax
mov bl, al
jmp 0x10008c8f
lea eax, [ebp - 0xd60]
mov edi, 0x20019
push eax
push edi
push ecx
mov edx, 0x10037940
mov ecx, 0x80000000
call fcn.10026806
test eax, eax
jne 0x10008c8c
lea eax, [ebp - 0xda4]
mov edx, str.42042206_2D85_11D3_8CFF_005004838597
push eax
push edi
push ecx
mov ecx, dword [ebp - 0xd60]
call fcn.10026806
test eax, eax
jne 0x10008c8c
lea eax, [ebp - 0xd4c]
mov edx, str.Version
push eax
push edi
push ecx
mov ecx, dword [ebp - 0xda4]
call fcn.10026806
test eax, eax
jne 0x10008c8c
xor ecx, ecx
xor edx, edx
mov edi, ecx
jmp 0x10008c73
cmp dword [ebp - 0xd74], 0
je 0x10008bd2
push dword [ebp - 0xd74]
call esi
xor eax, eax
lea edx, [ebp - 0x24]
mov dword [ebp - 0xd74], eax
lea eax, [ebp - 0xd74]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd4c]
call fcn.10026806
test eax, eax
jne 0x10008c70
movzx eax, byte [ebp - 0x524]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0xdbc], 0x208
inc edx
cmp dword [ebp - 0xd7c], edx
cmove eax, ecx
mov byte [ebp - 0x524], al
lea eax, [ebp - 0xdbc]
push eax
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0xd7c]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd74]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10008c70
mov ecx, dword [ebp - 0xda0]
lea edx, [ebp - 0x524]
call fcn.1000d8bb
test eax, eax
je 0x10008c70
push 0xa
pop edx
lea ecx, [ebp - 0x24]
call fcn.10026806
cmp eax, 0x10
jae 0x10008b45
inc edi
mov edx, edi
mov ecx, dword [ebp - 0xd4c]
lea eax, [ebp - 0x24]
push 0xa
push eax
call fcn.10026806
test eax, eax
je 0x10008bc1
xor eax, eax
inc eax
mov bh, bl
xor ecx, ecx
xor bh, al
mov eax, dword [ebp - 0xd58]
test bl, bl
movzx eax, al
mov byte [ebp - 0xd46], bh
cmove ecx, eax
cmp dword [ebp - 0xd74], 0
mov byte [ebp - 0xd58], cl
je 0x10008cc0
push dword [ebp - 0xd74]
call esi
xor edi, edi
mov dword [ebp - 0xd74], edi
cmp dword [ebp - 0xd4c], edi
je 0x10008cd8
push dword [ebp - 0xd4c]
call esi
mov dword [ebp - 0xd4c], edi
cmp dword [ebp - 0xda4], edi
je 0x10008cee
push dword [ebp - 0xda4]
call esi
mov dword [ebp - 0xda4], edi
cmp dword [ebp - 0xd60], edi
je 0x10008d16
push dword [ebp - 0xd60]
call esi
mov eax, dword [ebp - 0xd58]
mov dword [ebp - 0xd58], eax
mov byte [ebp - 0xd46], bh
mov edi, dword [ebp - 0xd98]
xor ebx, ebx
cmp word [edi], bx
je 0x10008d4e
mov edx, str.fpxpress.exe
mov ecx, edi
call fcn.10026806
test eax, eax
jne 0x10008d4e
mov edx, str.winword.exe
mov ecx, edi
call fcn.10026806
test eax, eax
je 0x10008d57
xor eax, eax
inc eax
mov byte [ebp - 0xd46], al
jmp 0x10008d71
xor eax, eax
inc eax
mov byte [ebp - 0xd46], al
cmp dword [ebp + 0x10], ebx
je 0x10008d71
cmp dword [ebp - 0xd90], ebx
jne 0x10008d71
mov edi, str.SharePointDesigner.Editor.Document
cmp dword [ebp - 0xd78], ebx
je 0x10008d76
mov edi, str.Word.Document
push 0x104
mov edx, edi
lea ecx, [ebp - 0x72c]
call fcn.10026806
push 0x104
mov edx, 0x10034c44
lea ecx, [ebp - 0x72c]
call fcn.10026806
xor eax, eax
lea edx, [ebp - 0x72c]
mov dword [ebp - 0xd4c], eax
lea eax, [ebp - 0xd4c]
push eax
push 0x20019
push ecx
mov ecx, 0x80000000
call fcn.10026806
test eax, eax
jne 0x10008e9f
movzx eax, byte [ebp - 0x114]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0xda0], 0xc8
inc edx
cmp dword [ebp - 0xd7c], edx
cmove eax, ecx
mov byte [ebp - 0x114], al
lea eax, [ebp - 0xda0]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0xd7c]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd4c]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10008e9f
lea ecx, [ebp - 0x114]
push 0x64
cmp dword [ebp - 0xd90], eax
je 0x10008e46
mov edx, str._shell_
call fcn.10026806
mov edx, dword [ebp - 0xd8c]
lea ecx, [ebp - 0x114]
push 0x64
jmp 0x10008e4b
mov edx, str._shellopen
call fcn.10026806
cmp dword [ebp - 0xd68], 0
je 0x10008e61
push dword [ebp - 0xd68]
call esi
xor eax, eax
lea edx, [ebp - 0x114]
mov dword [ebp - 0xd68], eax
lea eax, [ebp - 0xd68]
push eax
push 0x20019
push ecx
mov ecx, 0x80000000
call fcn.10026806
mov ecx, dword [ebp - 0xd6c]
test eax, eax
push 1
movzx ecx, cl
pop eax
cmove ecx, eax
mov dword [ebp - 0xd6c], ecx
jmp 0x10008ea5
mov ecx, dword [ebp - 0xd6c]
test cl, cl
jne 0x10008ec8
test ebx, ebx
jne 0x10008ec8
mov eax, str.SharePointDesigner.Editor.Document
cmp edi, eax
jne 0x10008ebd
mov edi, str.Word.Document
jmp 0x10008ec8
cmp dword [ebp - 0xd78], 0
jne 0x10008eed
mov edi, eax
cmp dword [ebp - 0xd4c], 0
je 0x10008ed9
push dword [ebp - 0xd4c]
call esi
xor eax, eax
inc ebx
mov dword [ebp - 0xd4c], eax
cmp ebx, 2
jb 0x10008d76
jmp 0x10008efe
cmp dword [ebp - 0xd4c], 0
je 0x10008efe
push dword [ebp - 0xd4c]
call esi
push dword [ebp - 0xd78]
lea edx, [ebp - 0xd88]
lea ecx, [ebp - 0xd84]
call fcn.10026806
cmp byte [ebp - 0xd58], 0
mov bl, byte [ebp - 0xd46]
je 0x10009028
mov edi, dword [ebp - 0xd8c]
test bl, bl
je 0x10009012
xor eax, eax
mov edx, edi
mov dword [ebp - 0xd60], eax
lea eax, [ebp - 0xd60]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd84]
call fcn.10026806
test eax, eax
jne 0x10009001
mov dword [ebp - 0xd6c], eax
mov edx, 0x10036de4
lea eax, [ebp - 0xd6c]
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd60]
call fcn.10026806
test eax, eax
jne 0x10008ff0
movzx eax, byte [ebp - 0xb3c]
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0xda0], 0x410
inc edx
cmp dword [ebp - 0xd7c], edx
cmove eax, ecx
mov byte [ebp - 0xb3c], al
lea eax, [ebp - 0xda0]
push eax
lea eax, [ebp - 0xb3c]
push eax
lea eax, [ebp - 0xd7c]
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd6c]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10008ff0
mov eax, dword [ebp - 0xd58]
xor ecx, ecx
cmp word [ebp - 0xb3c], cx
movzx eax, al
cmovne eax, ecx
mov dword [ebp - 0xd58], eax
cmp dword [ebp - 0xd6c], 0
je 0x10009001
push dword [ebp - 0xd6c]
call esi
cmp dword [ebp - 0xd60], 0
je 0x10009012
push dword [ebp - 0xd60]
call esi
cmp byte [ebp - 0xd58], 0
je 0x10009028
mov ecx, dword [ebp - 0xd84]
mov edx, edi
call fcn.1000b7bc
mov edi, dword [ebp - 0xd8c]
lea eax, [ebp - 0xd94]
mov ecx, dword [ebp - 0xd84]
mov edx, edi
push eax
lea eax, [ebp - 0xd5c]
push eax
sub esp, 0x14
call fcn.10026806
test eax, eax
jne 0x1000952d
lea eax, [ebp - 0xd50]
mov edx, edi
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd88]
call fcn.10026806
test eax, eax
jne 0x10009211
lea eax, [ebp - 0xdb8]
mov edx, str.command
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd50]
call fcn.10026806
test eax, eax
jne 0x10009211
cmp byte [ebp - 0xd58], al
jne 0x10009121
lea eax, [ebp - 0xd9c]
mov edx, 0x10036de4
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd5c]
call fcn.10026806
test eax, eax
jne 0x100091e5
movzx eax, byte [ebp - 0x31c]
xor edx, edx
xor ecx, ecx
inc edx
cmp dword [ebp - 0xd7c], edx
cmove eax, ecx
xor ebx, ebx
mov byte [ebp - 0x31c], al
lea eax, [ebp - 0xdc0]
push eax
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0xd7c]
push eax
push ebx
push ebx
push dword [ebp - 0xd9c]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x100091e7
cmp word [ebp - 0x31c], bx
je 0x100091e7
mov al, bl
jmp 0x1000914c
test bl, bl
jne 0x100091e5
mov edx, dword [ebp - 0xd5c]
xor eax, eax
mov ecx, dword [ebp - 0xd54]
push eax
call fcn.10026806
xor eax, eax
inc eax
mov byte [ebp - 0xd47], al
mov al, byte [ebp - 0xd45]
cmp dword [ebp - 0xd90], 0
mov edi, dword [sym.imp.advapi32.dll_RegSetValueExW]
jne 0x1000932e
cmp dword [ebp - 0xd70], 0
jne 0x10009170
test al, al
je 0x1000932e
mov ebx, dword [ebp - 0xd78]
lea eax, [ebp - 0xda8]
mov edx, dword [ebp - 0xd8c]
mov ecx, dword [ebp - 0xd54]
push ebx
push eax
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
push eax
call fcn.10026806
cmp dword [ebp - 0xd70], 0
je 0x100091b9
push dword [ebp - 0xda8]
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
inc eax
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd5c]
call edi
cmp byte [ebp - 0xd45], 0
je 0x10009334
push dword [ebp - 0xda8]
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
inc eax
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd50]
call edi
jmp 0x10009334
xor ebx, ebx
mov eax, dword [ebp - 0xd68]
test eax, eax
je 0x1000913d
mov edx, dword [ebp - 0xd5c]
mov ecx, eax
push ebx
call fcn.10026806
xor eax, eax
inc eax
mov dword [ebp - 0xd70], eax
jmp 0x10009140
cmp dword [ebp - 0xd50], 0
je 0x10009238
mov ecx, dword [ebp - 0xd88]
mov edx, edi
call fcn.1000b7bc
cmp dword [ebp - 0xd50], 0
je 0x10009238
push dword [ebp - 0xd50]
call esi
mov ecx, dword [ebp - 0xd88]
xor eax, eax
mov dword [ebp - 0xd50], eax
mov edx, edi
lea eax, [ebp - 0xd94]
push eax
lea eax, [ebp - 0xd50]
push eax
sub esp, 0x14
call fcn.10026806
test eax, eax
jne 0x1000952d
lea eax, [ebp - 0xdb4]
mov edx, str.command
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0xd5c]
call fcn.10026806
test eax, eax
jne 0x100092bd
cmp byte [ebp - 0xd58], al
jne 0x100092c6
mov eax, dword [ebp - 0xd68]
test eax, eax
je 0x10009146
mov edx, dword [ebp - 0xd50]
xor ecx, ecx
push ecx
mov ecx, eax
call fcn.10026806
xor ecx, ecx
inc ecx
mov al, cl
mov byte [ebp - 0xd45], al
jmp 0x1000914c
cmp byte [ebp - 0xd58], 0
je 0x100092ca
test bl, bl
je 0x10009303
cmp dword [ebp - 0xd90], 0
jne 0x10009303
mov eax, dword [ebp - 0xd68]
test eax, eax
je 0x1000931a
push dword [ebp - 0xd50]
mov edx, dword [ebp - 0xd5c]
mov ecx, eax
call fcn.10026806
xor ecx, ecx
inc ecx
mov al, cl
mov byte [ebp - 0xd45], cl
mov dword [ebp - 0xd70], ecx
jmp 0x10009323
push dword [ebp - 0xd50]
mov edx, dword [ebp - 0xd5c]
mov ecx, dword [ebp - 0xd54]
call fcn.10026806
mov al, byte [ebp - 0xd45]
xor ecx, ecx
inc ecx
mov byte [ebp - 0xd47], cl
jmp 0x1000914c
mov ebx, dword [ebp - 0xd78]
cmp byte [ebp - 0xd47], 0
je 0x100093a4
xor eax, eax
mov dword [ebp - 0xd70], eax
lea eax, [ebp - 0xd70]
mov byte [ebp - 4], 0xb
push eax
push 0x2001f
mov eax, str.SOFTWAREMicrosoftSharedHTML
test ebx, ebx
push ecx
mov edx, str.SOFTWAREMicrosoftSharedMHTML
mov ecx, 0x80000001
cmove edx, eax
call fcn.10026806
test eax, eax
jne 0x10009383
mov ecx, dword [ebp - 0xd70]
mov edx, str.Default_Editor
call fcn.1000b7bc
mov edx, ebx
mov ecx, 0x80000001
call fcn.1000a1c8
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0xd70], 0
je 0x100093a4
push dword [ebp - 0xd70]
call esi
cmp byte [ebp - 0xd58], 0
jne 0x100093b7
cmp dword [ebp + 0xc], 0
je 0x100094d5
xor ebx, ebx
lea ecx, [ebp - 0xdac]
cmp dword [ebp - 0xd90], ebx
setne bl
mov edx, ebx
call fcn.10026806
cmp word [ebp - 0x4c], 0
jne 0x100093fd
push dword [ebp - 0xd78]
mov ecx, dword [ebp - 0xd54]
lea eax, [ebp - 0xda8]
push eax
lea eax, [ebp - 0x4c]
push eax
push ebx
mov ebx, dword [ebp - 0xd8c]
mov edx, ebx
call fcn.10026806
jmp 0x10009403
mov ebx, dword [ebp - 0xd8c]
cmp dword [ebp - 0xd54], 0
je 0x10009414
push dword [ebp - 0xd54]
call esi
xor eax, eax
mov dword [ebp - 0xd54], eax
cmp dword [ebp - 0xd64], eax
je 0x1000942e
push dword [ebp - 0xd64]
call esi
xor eax, eax
mov ecx, dword [ebp - 0xd80]
mov edx, ebx
mov dword [ebp - 0xd64], eax
call fcn.1000b7bc
mov ecx, dword [ebp - 0xd80]
lea eax, [ebp - 0xd94]
push eax
lea eax, [ebp - 0xd54]
mov edx, ebx
push eax
sub esp, 0x14
call fcn.10026806
test eax, eax
jne 0x10009514
push dword [ebp - 0xda8]
lea eax, [ebp - 0x4c]
push eax
xor eax, eax
inc eax
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd54]
call edi
test eax, eax
jne 0x10009514
mov ecx, dword [ebp - 0xd54]
lea eax, [ebp - 0xd94]
push eax
lea eax, [ebp - 0xd64]
mov edx, str.command
push eax
sub esp, 0x14
call fcn.10026806
test eax, eax
jne 0x10009514
mov ebx, dword [ebp - 0xdac]
mov ecx, ebx
call fcn.1000d787
add eax, eax
push eax
push ebx
xor eax, eax
inc eax
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 0xd64]
call edi
test eax, eax
jne 0x1000951a
jmp 0x100094db
mov ebx, dword [ebp - 0xdac]
cmp byte [ebp - 0xd47], 0
jne 0x100094ea
cmp dword [ebp + 0xc], 0
je 0x1000950d
cmp dword [ebp - 0xd90], 0
jne 0x1000950d
push dword [ebp - 0xd78]
mov edx, dword [ebp - 0xd5c]
mov ecx, 0x80000002
call fcn.10009b64
test eax, eax
je 0x1000951a
xor eax, eax
lea edi, [eax + 1]
jmp 0x10009520
mov ebx, dword [ebp - 0xdac]
mov edi, dword [ebp - 0xdb0]
test ebx, ebx
je 0x10009533
mov ecx, ebx
call fcn.100033fc
jmp 0x10009533
mov edi, dword [ebp - 0xdb0]
mov ecx, dword [ebp - 0xd98]
test ecx, ecx
je 0x10009542
call fcn.100033fc
cmp dword [ebp - 0xd9c], 0
je 0x10009553
push dword [ebp - 0xd9c]
call esi
xor ebx, ebx
mov dword [ebp - 0xd9c], ebx
cmp dword [ebp - 0xd88], ebx
je 0x1000956b
push dword [ebp - 0xd88]
call esi
mov dword [ebp - 0xd88], ebx
cmp dword [ebp - 0xd84], ebx
je 0x10009581
push dword [ebp - 0xd84]
call esi
mov dword [ebp - 0xd84], ebx
cmp dword [ebp - 0xd80], ebx
je 0x10009597
push dword [ebp - 0xd80]
call esi
mov eax, dword [ebp - 0xd68]
mov dword [ebp - 0xd80], ebx
test eax, eax
je 0x100095aa
push eax
call esi
mov dword [ebp - 0xd68], ebx
cmp dword [ebp - 0xd64], ebx
je 0x100095c0
push dword [ebp - 0xd64]
call esi
mov dword [ebp - 0xd64], ebx
cmp dword [ebp - 0xd50], ebx
je 0x100095d6
push dword [ebp - 0xd50]
call esi
mov dword [ebp - 0xd50], ebx
cmp dword [ebp - 0xd5c], ebx
je 0x100095ec
push dword [ebp - 0xd5c]
call esi
mov dword [ebp - 0xd5c], ebx
cmp dword [ebp - 0xdb4], ebx
je 0x10009602
push dword [ebp - 0xdb4]
call esi
mov dword [ebp - 0xdb4], ebx
cmp dword [ebp - 0xdb8], ebx
je 0x10009618
push dword [ebp - 0xdb8]
call esi
mov dword [ebp - 0xdb8], ebx
cmp dword [ebp - 0xd54], ebx
je 0x1000962e
push dword [ebp - 0xd54]
call esi
mov eax, edi
call fcn.10030d76
ret 0xc