Function at 0x404596
Capabilities:
Delete registry key
Set registry value

Disassembly:
push 0x850
mov eax, 0x40a024
call fcn.00409b65
mov eax, edx
mov dword [ebp - 0x854], eax
mov edx, ecx
mov dword [ebp - 0x844], edx
mov ecx, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x858], ecx
mov edi, esi
mov dword [ebp - 0x85c], esi
mov ebx, esi
test edx, edx
je 0x404985
test eax, eax
je 0x404985
test ecx, ecx
je 0x404985
xor eax, eax
mov dword [ebp - 0x84c], esi
push 0x40b524
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x850], esi
mov dword [ebp - 0x848], esi
mov dword [ebp - 0x818], esi
mov dword [ebp - 0x814], 7
mov word [ebp - 0x828], ax
call fcn.004058d7
lea ecx, [ebp - 0x810]
mov dword [ebp - 4], esi
call fcn.00401a15
mov esi, eax
mov dword [ebp - 0x82c], 7
xor eax, eax
lea ecx, [ebp - 0x840]
push 0x40b524
mov dword [ebp - 0x830], eax
mov word [ebp - 0x840], ax
call fcn.004058d7
xor eax, eax
lea ecx, [ebp - 0x840]
inc eax
mov byte [ebp - 4], al
test esi, esi
je 0x404694
push str.USERS_
mov esi, 0x80000003
call fcn.00405435
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.00405435
lea ecx, [ebp - 0x828]
mov eax, 0x40b570
jmp 0x40469e
mov esi, 0x80000001
mov eax, str.CURRENT_USER_
push eax
call fcn.00405435
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
lea ecx, [ebp - 0x828]
call fcn.00405435
push dword [ebp - 0x844]
lea ecx, [ebp - 0x828]
call fcn.00405435
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
push dword [ebp - 0x818]
cmovae eax, dword [ebp - 0x828]
lea ecx, [ebp - 0x840]
push eax
call fcn.0040593d
push 0x40ce6c
lea ecx, [ebp - 0x840]
call fcn.00405435
cmp dword [ebp - 0x814], 8
lea ecx, [ebp - 0x848]
push ecx
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
xor ecx, ecx
push 0xf003f
push ecx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4047c3
lea eax, [ebp - 0x844]
xor ecx, ecx
push eax
push 0x20019
push ecx
push str.UserChoice
push dword [ebp - 0x848]
mov dword [ebp - 0x844], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4047af
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x82c], 8
lea eax, [ebp - 0x840]
lea ecx, [ebp - 0x850]
cmovae eax, dword [ebp - 0x840]
xor edx, edx
push ecx
push edx
lea ecx, [ebp - 0x84c]
push ecx
push edx
push edx
push 4
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_GetNamedSecurityInfoW]
push str.UserChoice
push dword [ebp - 0x848]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
push 1
pop eax
cmovne ebx, eax
push dword [ebp - 0x848]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x4048cb
xor ebx, ebx
lea ecx, [ebp - 0x828]
push 0x40ce6c
mov dword [ebp - 0x844], ebx
call fcn.00405435
cmp dword [ebp - 0x814], 8
lea ecx, [ebp - 0x844]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4048cb
cmp dword [ebp - 0x84c], ebx
je 0x404840
cmp dword [ebp - 0x82c], 8
lea eax, [ebp - 0x840]
push ebx
push dword [ebp - 0x84c]
cmovae eax, dword [ebp - 0x840]
push ebx
push ebx
push 4
push 4
push eax
call dword [sym.imp.ADVAPI32.dll_SetNamedSecurityInfoW]
mov edx, dword [ebp - 0x854]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40484b
sub ecx, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
xor eax, eax
inc eax
push eax
push ebx
push str.Progid
push dword [ebp - 0x844]
call esi
test eax, eax
jne 0x4048bf
mov edx, dword [ebp - 0x858]
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x85c]
jne 0x40488a
sub ecx, ebx
xor ebx, ebx
sar ecx, 1
inc ebx
lea eax, [ecx*2 + 2]
push eax
push edx
push ebx
xor eax, eax
push eax
push str.Hash
push dword [ebp - 0x844]
call esi
test eax, eax
cmove edi, ebx
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
cmp dword [ebp - 0x850], ebx
je 0x4048ef
push dword [ebp - 0x850]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0x82c]
mov esi, 0x1000
cmp edx, 8
jb 0x40492b
mov ecx, dword [ebp - 0x840]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, esi
jb 0x404922
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x404972
push edx
push ecx
call fcn.0040908b
pop ecx
pop ecx
mov edx, dword [ebp - 0x814]
xor eax, eax
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x82c], 7
mov word [ebp - 0x840], ax
cmp edx, 8
jb 0x404981
mov ecx, dword [ebp - 0x828]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, esi
jb 0x404978
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x404978
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.0040908b
pop ecx
pop ecx
mov eax, edi
jmp 0x404987
xor eax, eax
call fcn.00409b20
ret