Function at 0x42a82e
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa70
cmp dword [ebp + 8], 0
push esi
je 0x42ac14
push ebx
push edi
push 0x1c
mov esi, 0x466a3c
pop ecx
lea edi, [ebp - 0x9c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x25
mov esi, 0x4669a8
pop ecx
lea edi, [ebp - 0x1a0]
rep movsd dword es:[edi], dword [esi]
push 0x21
mov esi, 0x466920
pop ecx
lea edi, [ebp - 0x44c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x24
mov esi, 0x46688c
pop ecx
lea edi, [ebp - 0x234]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1c
mov esi, 0x46681c
pop ecx
lea edi, [ebp - 0x344]
rep movsd dword es:[edi], dword [esi]
push 0x1b
mov esi, 0x4667ac
pop ecx
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1f
mov esi, 0x46672c
pop ecx
lea edi, [ebp - 0x3c4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x28
mov esi, 0x46668c
pop ecx
lea edi, [ebp - 0x2d4]
rep movsd dword es:[edi], dword [esi]
mov ebx, 0x46429c
lea edi, [ebp - 0x28]
mov esi, ebx
lea eax, [ebp - 0x9c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str.360seURL
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x9c]
push eax
push 1
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push 0x46664c
push esi
call ebx
lea eax, [ebp - 0x2d4]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
lea eax, [ebp - 0x9c]
push 0x46661c
push eax
push esi
call ebx
push dword [ebp + 0xc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x9c]
push dword [ebp + 0xc]
push 1
push 0x4665fc
push eax
push esi
call ebx
lea eax, [ebp - 0x28]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x28]
push eax
push 1
lea eax, [ebp - 0x9c]
push 0x4665dc
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push 0x4665d0
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push str..html
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push 0x4665c0
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push 0x4665b4
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push 0x4665a4
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x234]
push 0x46659c
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x234]
push 0x466590
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x234]
push 0x466584
push eax
push esi
call ebx
lea eax, [ebp - 0x28]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x28]
push eax
push 1
lea eax, [ebp - 0x44c]
push 0x466560
push eax
push esi
call ebx
push dword [ebp + 0xc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x344]
push dword [ebp + 0xc]
push 1
push 0x467084
push eax
push esi
call ebx
and word [ebp - 0x864], 0
mov edx, 0x82
mov ecx, edx
xor eax, eax
and word [ebp - 0x658], ax
lea edi, [ebp - 0x862]
push dword [ebp + 0xc]
and word [ebp - 0xa70], ax
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x656]
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0xa6e]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x46653c
lea eax, [ebp - 0x864]
push 0x104
push eax
mov dword [ebp + 8], 1
call edi
add esp, 0x10
lea eax, [ebp - 0x658]
push dword [ebp + 0xc]
push 0x466504
push 0x104
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0xa70]
push dword [ebp + 0xc]
push 0x4664e0
push 0x104
push eax
call edi
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
lea eax, [ebp - 0x864]
push eax
call edi
add esp, 0x14
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x864]
push eax
push 1
lea eax, [ebp - 0x10c]
push 0x4664bc
push eax
push esi
call ebx
lea eax, [ebp + 8]
push 4
push eax
push 4
lea eax, [ebp - 0x10c]
push 0x4664a0
push eax
push esi
call ebx
lea eax, [ebp - 0x658]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x658]
push eax
push 1
lea eax, [ebp - 0x10c]
push 0x46647c
push eax
push esi
call ebx
lea eax, [ebp - 0xa70]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xa70]
push eax
push 1
lea eax, [ebp - 0x10c]
push 0x466458
push eax
push esi
call ebx
push dword [ebp + 0xc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x3c4]
push dword [ebp + 0xc]
push 1
push 0x467084
push eax
push esi
call ebx
pop edi
pop ebx
jmp 0x42ac36
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push 0x466400
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x46429c
push 0x46664c
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
pop esi
leave
ret