Function at 0x10024fe0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10075688
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
push str.Version
push str.SoftwareMicrosoftInternet_Explorer
lea eax, [ebp - 0x10]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
call fcn.1001e260
add esp, 0x10
xor edi, edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
call fcn.10002f50
push eax
call fcn.1003d71d
add esp, 4
cmp eax, 7
jl 0x100250b8
mov eax, dword [ebp + 0x14]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
cmp eax, edi
je 0x10025048
mov esi, reloc.WSOCK32.dll_accept
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp + 0x14]
call fcn.1005bbb3
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 1
call fcn.10009370
test eax, eax
jne 0x100250d7
push 0x10096d5c
push 0x10096d68
push esi
call fcn.1001e300
push 0x10096dc4
push 0x10096dc8
push esi
call fcn.1001e300
push 0x10096e24
push 0x10096e30
push esi
call fcn.1001e300
push 0x10096e8c
push 0x10096e90
push 0x10096e98
push esi
call fcn.1001dfd0
add esp, 0x34
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0
call fcn.1005bb45
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.1005bb45
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push ebx
push str.searchTerms
push str.KEYWORD
lea ecx, [ebp + 0x14]
call fcn.100535cc
push str.inputEncoding
push str.ENC
lea ecx, [ebp + 0x14]
call fcn.100535cc
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push edx
call fcn.1005bbb3
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10002f50
push eax
push 0x10096f28
push 0x10096f34
push esi
call fcn.1001dfd0
add esp, 0x10
lea ecx, [ebp + 0x14]
call fcn.10002f50
push eax
push 0x10096f90
push 0x10096f94
push esi
call fcn.1001dfd0
push 0x3b5
push str.CodePage
push 0x10096ffc
push esi
call fcn.1001e060
push str.Deleted
push str.SoftwareMicrosoftInternet_ExplorerSearchScopes98AD4750_8B93_40b5_8849_A0746667051E
push esi
call fcn.1001e300
mov eax, dword [ebp + 0x10]
add esp, 0x2c
cmp eax, edi
je 0x10025235
push str.98AD4750_8B93_40b5_8849_A0746667051E
push str.DefaultScope
push str.SoftwareMicrosoftInternet_ExplorerSearchScopes
push esi
call fcn.1001dfd0
lea eax, [ebp + 8]
mov dword [ebp + 0xc], edi
push eax
mov dword [ebp + 8], edi
call fcn.100206c0
add esp, 0x14
test eax, eax
je 0x10025235
lea ecx, [ebp + 0x10]
push ecx
push 0x10097128
push esi
call fcn.10020840
mov ecx, dword [ebp + 8]
lea edx, [ebp + 0xc]
lea eax, [ebp - 0x28]
push edx
push eax
push ecx
call fcn.100208e0
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 0x18
test eax, eax
je 0x10025205
lea edx, [ebp - 0x28]
push 0
push edx
push 0x10097160
push esi
call fcn.10020a90
add esp, 0x10
push 0x10097198
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x10025205
push eax
push 0
call ebx
push eax
call edi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x10025226
push 0
push eax
push str.SoftwareMicrosoftInternet_ExplorerUser_Preferences
push esi
call fcn.10020a90
mov eax, dword [ebp + 0x10]
push eax
call fcn.10056e79
add esp, 0x14
mov eax, dword [ebp + 8]
test eax, eax
je 0x10025235
push eax
push 0
call ebx
push eax
call edi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.1005bb45
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0
call fcn.1005bb45
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.1005bb45
mov ecx, dword [ebp - 0xc]
pop ebx
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret