Function at 0x455350
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d7398
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x511070]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
lea eax, [ebp - 0x10]
push eax
push str.PCMgrRepairIEExtensions
push SysReAllocString
mov dword [ebp - 0x10], 0
call esi
test eax, eax
jne 0x4553dc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x22
push str.URL:
push 1
push eax
push eax
push dword [ebp - 0x10]
call ebx
push 0
push 0
push 1
push 0
push str.URL_Protocol
push dword [ebp - 0x10]
call ebx
lea eax, [ebp - 0x14]
push eax
push str.DefaultIcon
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x4553f2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, dword [ebp + 0x10]
mov ecx, edi
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x455400
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push 0
push 0
push dword [ebp - 0x14]
call ebx
push dword [ebp - 0x14]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea eax, [ebp - 0x18]
push eax
push str.ShellOpenCommand
push dword [ebp - 0x10]
call esi
test eax, eax
je 0x45545b
push dword [ebp - 0x10]
call ebx
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.0041bed0
mov ecx, eax
test ecx, ecx
jne 0x455470
push 0x80004005
call fcn.0041cdf0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 0x10], eax
push edi
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.0041c970
push eax
mov edx, 0x4eecc0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.00438410
push 0x4eecc0
mov edx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
call fcn.0041c010
push 0x4f4688
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.0041c010
add esp, 0xc
push eax
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 4
call fcn.0041c6d0
mov byte [ebp - 4], 3
or edi, 0xffffffff
mov edx, dword [ebp - 0x1c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4554f4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov eax, edi
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x455512
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, edi
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x455530
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x45554e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp + 0x10]
mov eax, dword [esi - 0xc]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push 0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
call ebx
push dword [ebp - 0x10]
call ebx
lea eax, [ebp - 0x10]
push eax
push str.SOFTWAREMicrosoftInternet_ExplorerProtocolExecute
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4555cc
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push str.PCMgrRepairIEExtensions
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4555c7
push 4
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push 4
push 0
push str.WarnOnOpen
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp + 0x10]
call ebx
push dword [ebp - 0x10]
call ebx
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], edi
dec edi
test edi, edi
jg 0x4555e8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc