Function at 0x41d530
Capabilities:
Get common file path
Set registry value

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x820
test eax, eax
push ebx
push ebp
push esi
je 0x41d54d
mov ebx, 0x53ae24
mov ebp, 0x53b234
jmp 0x41d559
call fcn.004a5540
mov ebx, eax
mov ebp, str.open
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.0041d440
mov esi, dword [sym.imp.MSVCRT.dll_wcslen]
push ebx
call esi
add esp, 0x10
shl eax, 1
push eax
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 1
push 0x53ada0
push str.CLSID0002DF01_0000_0000_C000_000000000046LocalServer32
push SysReAllocStringLen
call ebx
lea ecx, [esp + 0x10]
push ecx
push ebp
push str.Softwareclasseshttp_shell
push SysReAllocStringLen
call fcn.0041e5d0
lea edx, [esp + 0x20]
push edx
push ebp
push str.Softwareclasseshttps_shell
push SysReAllocStringLen
call fcn.0041e5d0
lea eax, [esp + 0x30]
push eax
push ebp
push str.Softwareclasses_file_shell
push SysReAllocStringLen
call fcn.0041e5d0
lea ecx, [esp + 0x40]
push ecx
push ebp
push str.Softwareclasseshttp_shell
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041e5d0
add esp, 0x40
lea edx, [esp + 0x10]
push edx
push ebp
push str.Softwareclasseshttps_shell
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041e5d0
lea eax, [esp + 0x20]
push eax
push ebp
push str.Softwareclasses_file_shell
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0041e5d0
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x30]
xor ebp, ebp
rep stosd dword es:[edi], eax
mov ecx, 0x81
lea edi, [esp + 0x23a]
mov word [esp + 0x238], bp
add esp, 0x20
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x62a]
mov word [esp + 0x628], bp
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [esp + 0x420], bp
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x422]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x628]
push 0x103
push ecx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
lea edx, [esp + 0x628]
push edx
push str._surl.dll_0
lea eax, [esp + 0x428]
push 0x103
push eax
call edi
lea ecx, [esp + 0x20]
push 0x104
push ecx
push 0x53ae24
call fcn.0041d440
push str.360seURL
call esi
add esp, 0x20
shl eax, 1
push eax
push str.360seURL
push 1
push 0x53ada0
push str.360seURL
push SysReAllocStringLen
call ebx
push str.360seURL
push str._s_shell
lea edx, [esp + 0x220]
push 0x103
push edx
call edi
lea eax, [esp + 0x20]
lea ecx, [esp + 0x228]
push eax
push str.open
push ecx
call fcn.0041d460
add esp, 0x1c
lea edx, [esp + 0x218]
push str.360seURL
push str._sDefaultIcon
push 0x103
push edx
call edi
lea eax, [esp + 0x430]
push eax
call esi
add esp, 0x14
lea ecx, [esp + 0x420]
shl eax, 1
push eax
push ecx
push 1
lea edx, [esp + 0x224]
push 0x53ada0
push edx
push SysReAllocStringLen
call ebx
mov eax, dword [esp + 0x834]
pop edi
cmp eax, ebp
je 0x41d850
push str.360seURL
call esi
add esp, 4
shl eax, 1
push eax
push str.360seURL
push 1
push 0x53ada0
push str..htm
push SysReAllocStringLen
call ebx
push str.360seURL
call esi
add esp, 4
shl eax, 1
push eax
push str.360seURL
push 1
push 0x53ada0
push 0x50ccb8
push SysReAllocStringLen
call ebx
push str.360seURL
call esi
add esp, 4
shl eax, 1
push eax
push str.360seURL
push 1
push 0x53ada0
push str..shtm
push SysReAllocStringLen
call ebx
push str.360seURL
call esi
add esp, 4
shl eax, 1
push eax
push str.360seURL
push 1
push 0x53ada0
push str..shtml
push SysReAllocStringLen
call ebx
push str.360seURL
call esi
add esp, 4
shl eax, 1
push eax
push str.360seURL
push 1
push 0x53ada0
push str..mht
push SysReAllocStringLen
call ebx
push str.360seURL
call esi
add esp, 4
shl eax, 1
push eax
push str.360seURL
jmp 0x41d91b
push str.htmlfile
call esi
add esp, 4
shl eax, 1
push eax
push str.htmlfile
push 1
push 0x53ada0
push str..htm
push SysReAllocStringLen
call ebx
push str.htmlfile
call esi
add esp, 4
shl eax, 1
push eax
push str.htmlfile
push 1
push 0x53ada0
push 0x50ccb8
push SysReAllocStringLen
call ebx
push str.htmlfile
call esi
add esp, 4
shl eax, 1
push eax
push str.htmlfile
push 1
push 0x53ada0
push str..shtm
push SysReAllocStringLen
call ebx
push str.htmlfile
call esi
add esp, 4
shl eax, 1
push eax
push str.htmlfile
push 1
push 0x53ada0
push str..shtml
push SysReAllocStringLen
call ebx
push str.mhtmlfile
call esi
add esp, 4
shl eax, 1
push eax
push str.mhtmlfile
push 1
push 0x53ada0
push str..mht
push SysReAllocStringLen
call ebx
push str.mhtmlfile
call esi
add esp, 4
shl eax, 1
push eax
push str.mhtmlfile
push 1
push 0x53ada0
push str..mhtml
push SysReAllocStringLen
call ebx
pop esi
pop ebp
pop ebx
add esp, 0x820
ret