Function at 0x435240
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xa30
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21a]
mov word [esp + 0x218], si
mov word [esp + 0x10], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
push 0x104
rep stosd dword es:[edi], eax
mov ecx, dword [0x73ff2c]
mov dword [esp + 0x10], 1
stosw word es:[edi], ax
lea eax, [esp + 0x834]
mov dword [esp + 0xc], 0x208
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x628]
push 0x104
lea eax, [esp + 0x834]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
call fcn.00435100
test eax, eax
je 0x4354b9
cmp dword [0x73eec4], esi
je 0x435449
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push reloc.DSOUND.dll_DirectSoundCreate
call esi
mov edi, dword [sym.imp.MSVCRT.dll__wcsicmp]
test eax, eax
jne 0x43531d
lea ecx, [esp + 0x10]
push str.TheWorld.HTTP
push ecx
call edi
add esp, 8
test eax, eax
jne 0x4354b9
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x500df0
push str.SOFTWAREClientsStartMenuInternet
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x103
call esi
test eax, eax
jne 0x4354b9
lea edx, [esp + 0x628]
push 0x5c
push edx
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x4354b9
lea ecx, [esp + 0x10]
add eax, 2
push ecx
push eax
call edi
add esp, 8
test eax, eax
jne 0x4354b9
lea edx, [esp + 8]
lea eax, [esp + 0x218]
push edx
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x500df0
push str.SOFTWAREClientsStartMenuInternet
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x208
call esi
cmp word [esp + 0x218], 0
je 0x4353d6
lea edx, [esp + 0x218]
lea eax, [esp + 0x10]
push edx
push eax
call edi
add esp, 8
test eax, eax
jne 0x4354b9
lea ecx, [esp + 0x10]
lea edx, [esp + 0x420]
push ecx
push str.SOFTWAREClientsStartMenuInternet_s_shellopencommand
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push eax
push ecx
push edx
lea eax, [esp + 0x42c]
push 0x500df0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x208
call esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x628]
push ecx
push edx
call edi
add esp, 8
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0xa30
ret
lea eax, [esp + 8]
lea ecx, [esp + 0x218]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push 0x500df0
push str.htmlfile_shellopencommand
push closesocket
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4354b9
lea eax, [esp + 0x420]
push 0x104
lea ecx, [esp + 0x62c]
push eax
push ecx
call fcn.004347c0
lea edx, [esp + 0x42c]
lea eax, [esp + 0x224]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 0x14
test eax, eax
jne 0x4354b9
pop edi
mov eax, 1
pop esi
add esp, 0xa30
ret
pop edi
xor eax, eax
pop esi
add esp, 0xa30
ret