Function at 0x417c20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x1010
call fcn.00459b10
mov eax, dword [0x488e40]
xor eax, esp
mov dword [esp + 0x100c], eax
push edi
mov edi, ecx
call fcn.00442f33
mov eax, dword [eax + 8]
push 0x800
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x417c70
xor al, al
pop edi
mov ecx, dword [esp + 0x100c]
xor ecx, esp
call fcn.00454016
add esp, 0x1010
ret
push esi
push 0x800
lea edx, [esp + 0x818]
push edx
lea eax, [esp + 0x1c]
push eax
mov byte [esp + 0x81f], 0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x417cc6
lea eax, [esp + 0x814]
lea esi, [esp + 0x14]
mov ecx, eax
mov edx, 0x7ff
sub esi, ecx
lea esp, [esp]
mov cl, byte [esi + eax]
test cl, cl
je 0x417cc3
mov byte [eax], cl
sub edx, 1
add eax, 1
test edx, edx
jg 0x417cb0
mov byte [eax], 0
mov esi, str.__dde
lea eax, [esp + 0x814]
mov ecx, 0x7ff
cmp byte [eax], 0
je 0x417ce8
sub ecx, 1
add eax, 1
test ecx, ecx
jg 0x417cd7
jmp 0x417d05
test ecx, ecx
jle 0x417d05
lea esp, [esp]
mov dl, byte [esi]
test dl, dl
je 0x417d05
mov byte [eax], dl
sub ecx, 1
add eax, 1
add esi, 1
test ecx, ecx
jg 0x417cf0
cmp byte [edi], 0x3a
push ebx
push ebp
mov ebp, edi
mov byte [eax], 0
mov byte [esp + 0x13], 1
mov dword [esp + 0x14], ebp
jne 0x417ef2
jmp 0x417d24
mov ebp, dword [esp + 0x14]
lea esi, [ebp + 1]
mov ebx, esi
cmp byte [ebx], 0
je 0x417ef2
cmp byte [ebx], 0x3a
je 0x417d3f
add ebx, 1
cmp byte [ebx], 0
jne 0x417d32
cmp byte [ebx], 0
je 0x417ef2
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x20]
push eax
push ebp
mov byte [ebp], 0x2e
push SysReAllocStringLen
mov byte [ebx], 0
mov dword [esp + 0x28], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x417d77
cmp byte [esp + 0x1c], al
jne 0x417dcb
push esi
push str._sfile
mov esi, 0x800
lea edi, [esp + 0x24]
mov byte [esp + 0x823], 0
call fcn.00416ab0
mov ecx, edi
push ecx
call fcn.004542ba
mov eax, edi
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x417da3
sub eax, edx
push eax
lea edx, [esp + 0x20]
push edx
push 1
push ebp
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
sete al
and byte [esp + 0x13], al
mov edi, str._shellView_Dependencies_
lea ecx, [esp + 0x1c]
mov eax, 0x7ff
lea esp, [esp]
cmp byte [ecx], 0
je 0x417df1
sub eax, 1
add ecx, 1
test eax, eax
jg 0x417de0
jmp 0x417e0a
test eax, eax
jle 0x417e0a
mov dl, byte [edi]
test dl, dl
je 0x417e0a
mov byte [ecx], dl
sub eax, 1
add ecx, 1
add edi, 1
test eax, eax
jg 0x417df5
lea eax, [esp + 0x1c]
mov byte [ecx], 0
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x417e14
sub eax, edx
mov edi, 0x800
sub edi, eax
mov ecx, edi
test ecx, ecx
lea ebp, [esp + eax + 0x1c]
mov eax, ebp
jle 0x417e56
sub ecx, 1
test ecx, ecx
jle 0x417e53
mov esi, str.command
sub esi, ebp
mov dl, byte [esi + eax]
test dl, dl
je 0x417e53
mov byte [eax], dl
sub ecx, 1
add eax, 1
test ecx, ecx
jg 0x417e40
mov byte [eax], 0
lea eax, [esp + 0x81c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x417e60
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
sub eax, edx
push eax
lea ecx, [esp + 0x820]
push ecx
push 1
lea edx, [esp + 0x28]
push edx
push SysReAllocStringLen
call esi
test eax, eax
sete al
and byte [esp + 0x13], al
mov eax, edi
test eax, eax
mov ecx, ebp
jle 0x417ebd
sub eax, 1
test eax, eax
jle 0x417eba
mov edi, str.ddeexec
sub edi, ebp
mov dl, byte [edi + ecx]
test dl, dl
je 0x417eba
mov byte [ecx], dl
sub eax, 1
add ecx, 1
test eax, eax
jg 0x417ea7
mov byte [ecx], 0
push 0xc
push str._open___1___
push 1
lea ecx, [esp + 0x28]
push ecx
push SysReAllocStringLen
call esi
test eax, eax
mov eax, dword [esp + 0x14]
sete dl
and byte [esp + 0x13], dl
mov byte [eax], 0x3a
mov byte [ebx], 0x3a
cmp byte [ebx], 0x3a
mov dword [esp + 0x14], ebx
je 0x417d20
mov ecx, dword [esp + 0x101c]
mov al, byte [esp + 0x13]
pop ebp
pop ebx
pop esi
pop edi
xor ecx, esp
call fcn.00454016
add esp, 0x1010
ret