Function at 0x40c2de
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa70
cmp dword [ebp + 8], 0
push esi
je 0x40c6be
push ebx
push edi
push 0x1c
mov esi, str.SoftwareClientsStartMenuInternet360
pop ecx
lea edi, [ebp - 0x9c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x25
mov esi, 0x42038c
pop ecx
lea edi, [ebp - 0x1a0]
rep movsd dword es:[edi], dword [esi]
push 0x21
mov esi, 0x420304
pop ecx
lea edi, [ebp - 0x44c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x24
mov esi, 0x420270
pop ecx
lea edi, [ebp - 0x234]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1c
mov esi, 0x420200
pop ecx
lea edi, [ebp - 0x344]
rep movsd dword es:[edi], dword [esi]
push 0x1b
mov esi, 0x420190
pop ecx
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1f
mov esi, 0x420110
pop ecx
lea edi, [ebp - 0x3c4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x28
mov esi, str.360360
pop ecx
lea edi, [ebp - 0x2d4]
rep movsd dword es:[edi], dword [esi]
mov ebx, str.360
lea edi, [ebp - 0x28]
mov esi, ebx
lea eax, [ebp - 0x9c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str.360seURL
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x9c]
push eax
push 1
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push str.SOFTWARERegisteredApplications
push esi
call ebx
lea eax, [ebp - 0x2d4]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
lea eax, [ebp - 0x9c]
push str.ApplicationDescription
push eax
push esi
call ebx
push dword [ebp + 0xc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x9c]
push dword [ebp + 0xc]
push 1
push str.ApplicationIcon
push eax
push esi
call ebx
lea eax, [ebp - 0x28]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x28]
push eax
push 1
lea eax, [ebp - 0x9c]
push str.ApplicationName
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push str..htm
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push str..html
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push str..shtml
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push str..xht
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push str..xhtml
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x234]
push 0x41ff60
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x234]
push str.http
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x234]
push str.https
push eax
push esi
call ebx
lea eax, [ebp - 0x28]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x28]
push eax
push 1
lea eax, [ebp - 0x44c]
push str.StartMenuInternet
push eax
push esi
call ebx
push dword [ebp + 0xc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x344]
push dword [ebp + 0xc]
push 1
push 0x421658
push eax
push esi
call ebx
and word [ebp - 0x864], 0
mov edx, 0x82
mov ecx, edx
xor eax, eax
and word [ebp - 0x658], ax
lea edi, [ebp - 0x862]
push dword [ebp + 0xc]
and word [ebp - 0xa70], ax
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x656]
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0xa6e]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
push str.__s___hide_icons_
lea eax, [ebp - 0x864]
push 0x104
push eax
mov dword [ebp + 8], 1
call edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x658]
push str.__s___make_default_browser_
push 0x104
push eax
call edi
push dword [ebp + 0xc]
lea eax, [ebp - 0xa70]
push str.__s___show_icons_
push 0x104
push eax
call edi
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
lea eax, [ebp - 0x864]
push eax
call edi
add esp, 0x34
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x864]
push eax
push 1
lea eax, [ebp - 0x10c]
push str.HideIconsCommand
push eax
push esi
call ebx
lea eax, [ebp + 8]
push 4
push eax
push 4
lea eax, [ebp - 0x10c]
push str.IconsVisible
push eax
push esi
call ebx
lea eax, [ebp - 0x658]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x658]
push eax
push 1
push str.ReinstallCommand
lea eax, [ebp - 0x10c]
push eax
push esi
call ebx
lea eax, [ebp - 0xa70]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xa70]
push eax
push 1
lea eax, [ebp - 0x10c]
push str.ShowIconsCommand
push eax
push esi
call ebx
push dword [ebp + 0xc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x3c4]
push dword [ebp + 0xc]
push 1
push 0x421658
push eax
push esi
call ebx
pop edi
pop ebx
jmp 0x40c6e0
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push 0x41fdc4
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push str.360
push str.SOFTWARERegisteredApplications
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
pop esi
leave
ret