Function at 0x40dbe3
Capabilities:
Delete registry key
Set registry value

Disassembly:
push 0x260
mov eax, 0x43a302
call fcn.0041ef30
mov eax, dword [ebp + 8]
xor ecx, ecx
mov esi, dword [ebp + 0xc]
mov bl, cl
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x254], eax
mov byte [ebp - 0x250], cl
test eax, eax
je 0x40e126
test esi, esi
je 0x40e126
test edi, edi
je 0x40e126
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x25c], ecx
lea ecx, [ebp - 0x230]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
call main
push dword [ebp - 0x254]
and dword [ebp - 4], 0
call main
pop ecx
push eax
push dword [ebp - 0x254]
lea ecx, [ebp - 0x230]
call main
push str.CURRENT_USER_
lea ecx, [ebp - 0x248]
call main
push dword [ebp - 0x220]
xor eax, eax
lea ecx, [ebp - 0x248]
inc eax
cmp dword [ebp - 0x21c], 8
mov byte [ebp - 4], al
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
call main
push 0x440940
call main
pop ecx
push eax
push 0x440940
lea ecx, [ebp - 0x248]
call main
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x25c]
push ecx
push 0xf003f
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push 0
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ddf1
and dword [ebp - 0x258], eax
lea eax, [ebp - 0x258]
push eax
push 0x20019
push 0
push str.UserChoice
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ddd8
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
lea ecx, [ebp - 0x24c]
cmovae eax, dword [ebp - 0x248]
push eax
call fcn.004020ed
mov eax, dword [ebp - 0x24c]
xor ecx, ecx
inc ecx
mov byte [ebp - 4], 2
cmp dword [eax - 4], ecx
jle 0x40dd74
push dword [eax - 0xc]
lea ecx, [ebp - 0x24c]
call main
mov eax, dword [ebp - 0x24c]
lea ecx, [ebp - 0x264]
xor edx, edx
push ecx
push edx
lea ecx, [ebp - 0x260]
push ecx
push edx
push edx
push 4
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x24c]
call main
push str.UserChoice
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 0x250]
test eax, eax
movzx ecx, cl
push 1
pop eax
cmovne ecx, eax
mov byte [ebp - 4], al
mov dword [ebp - 0x250], ecx
mov ecx, dword [ebp - 0x24c]
lea ecx, [ecx - 0x10]
call fcn.00401a64
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x250], 0
jne 0x40e0f7
and dword [ebp - 0x24c], 0
push 0x440940
call main
pop ecx
push eax
push 0x440940
lea ecx, [ebp - 0x230]
call main
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x24c]
cmovae eax, dword [ebp - 0x230]
xor edx, edx
push edx
push ecx
push edx
push 0xf003f
push edx
push edx
push edx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40dee7
cmp dword [ebp - 0x260], eax
je 0x40de81
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
xor ecx, ecx
push ecx
push dword [ebp - 0x260]
push ecx
push ecx
push 4
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
push esi
call main
pop ecx
xor ecx, ecx
inc ecx
lea eax, [eax*2 + 2]
push eax
push esi
push ecx
push 0
push str.Progid
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x40dedb
push edi
call main
pop ecx
lea eax, [eax*2 + 2]
push eax
push edi
xor edi, edi
inc edi
push edi
push 0
push str.Hash
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
movzx ebx, bl
cmove ebx, edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
push edi
push edi
push edi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
call main
test al, al
je 0x40e0f7
push str..pdf
push dword [ebp - 0x254]
call main
pop ecx
pop ecx
test eax, eax
jne 0x40e0f7
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.00420450
push str.AcroExch.Document.
push esi
call fcn.004205aa
add esp, 0x14
test eax, eax
je 0x40df49
push str.SOFTWAREAdobeAcrobat_Reader
jmp 0x40df5f
push str.Acrobat.Document.
push esi
call fcn.004205aa
pop ecx
pop ecx
test eax, eax
je 0x40df73
push str.SOFTWAREAdobeAdobe_Acrobat
lea eax, [ebp - 0x218]
push 0x104
push eax
call main
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call main
pop ecx
test eax, eax
je 0x40e0f7
lea eax, [ebp - 0x258]
mov dword [ebp - 0x258], edi
push eax
push str.iSuppressToastMessage
lea eax, [ebp - 0x218]
push eax
push 0x80000002
call main
xor eax, eax
add esp, 0x10
inc eax
cmp dword [ebp - 0x258], eax
jae 0x40e0f7
push 0x7f02
push edi
call dword [sym.imp.USER32.dll_LoadCursorW]
test eax, eax
je 0x40dfd6
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov edi, eax
push 0x1388
call dword [sym.imp.kernel32.dll_Sleep]
test edi, edi
je 0x40dfec
push edi
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [ebp - 0x234], 8
lea eax, [ebp - 0x248]
lea ecx, [ebp - 0x254]
cmovae eax, dword [ebp - 0x248]
push eax
call fcn.004020ed
push str.HKEY_CURRENT_USER_
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 3
call fcn.004020ed
mov eax, dword [ebp - 0x26c]
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 4
push dword [eax - 0xc]
push 0
call main
call fcn.00410229
push eax
lea ecx, [ebp - 0x250]
call main
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 5
push eax
push str.ProgID
push dword [ebp - 0x254]
push 0x80000001
call main
push dword [ebp - 0x250]
call main
add esp, 0x14
test eax, eax
je 0x40e0cd
push esi
push dword [ebp - 0x250]
call main
pop ecx
pop ecx
test eax, eax
je 0x40e0cd
push str.ownership_is_not_confirmed
lea ecx, [ebp - 0x268]
call fcn.004020ed
push 0
lea eax, [ebp - 0x268]
mov byte [ebp - 4], 6
push eax
push 2
call fcn.00403241
mov ecx, dword [ebp - 0x268]
add esp, 0xc
mov byte [ebp - 4], 5
lea ecx, [ecx - 0x10]
call fcn.00401a64
call fcn.0040d3ad
mov ecx, dword [ebp - 0x250]
lea ecx, [ecx - 0x10]
call fcn.00401a64
mov ecx, dword [ebp - 0x26c]
lea ecx, [ecx - 0x10]
call fcn.00401a64
mov ecx, dword [ebp - 0x254]
lea ecx, [ecx - 0x10]
call fcn.00401a64
cmp dword [ebp - 0x264], 0
je 0x40e10c
push dword [ebp - 0x264]
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x248]
call fcn.0040e1f2
lea ecx, [ebp - 0x230]
call fcn.0040e1f2
mov al, bl
jmp 0x40e128
xor al, al
call fcn.0041eeda
ret