Function at 0x434960
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x850
push ebx
push ebp
push esi
mov esi, dword [esp + 0x860]
xor ebx, ebx
push edi
cmp esi, ebx
je 0x43498e
mov dword [esp + 0x10], str.TheWorld.AssocFile.HTM
mov dword [esp + 0x18], str.TheWorld.AssocFile.MHT
mov ebp, str.TheWorld.HTTP
jmp 0x4349a3
mov dword [esp + 0x10], str.IE.AssocFile.HTM
mov dword [esp + 0x18], str.IE.AssocFile.MHT
mov ebp, str.IE.HTTP
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x65a]
mov word [esp + 0x658], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x452]
mov word [esp + 0x450], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x42]
mov word [esp + 0x40], bx
rep stosd dword es:[edi], eax
mov ecx, dword [0x73ff2c]
push 0x104
stosw word es:[edi], ax
lea eax, [esp + 0x65c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x450]
push 0x104
lea eax, [esp + 0x65c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea ecx, [esp + 0x450]
lea edx, [esp + 0x40]
push ecx
push str._s_0
push 0x103
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
cmp esi, ebx
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
je 0x434bcf
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x40]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0x500df0
push str.IE.AssocFile.HTMDefaultIcon
push closesocket
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], 0x103
call edi
lea eax, [esp + 0x40]
push eax
call ebx
add esp, 4
lea ecx, [esp + 0x40]
shl eax, 1
push eax
push ecx
push 1
push 0x500df0
push str.TheWorld.AssocFile.HTMDefaultIcon
push closesocket
call esi
lea edx, [esp + 0x40]
push edx
call ebx
add esp, 4
shl eax, 1
push eax
lea eax, [esp + 0x44]
push eax
push 1
push 0x500df0
push str.TheWorld.HTTPDefaultIcon
push closesocket
call esi
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x40]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push 0x500df0
push str.IE.AssocFile.MHTDefaultIcon
push closesocket
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], 0x103
call edi
lea ecx, [esp + 0x40]
push ecx
call ebx
add esp, 4
lea edx, [esp + 0x40]
shl eax, 1
push eax
push edx
push 1
push 0x500df0
push str.TheWorld.AssocFile.MHTDefaultIcon
push closesocket
call esi
lea eax, [esp + 0x40]
push 0x104
lea ecx, [esp + 0x454]
push eax
push ecx
call fcn.004347c0
lea edx, [esp + 0x4c]
push edx
push str.open
push str.TheWorld.HTTPShell
call fcn.004347e0
lea eax, [esp + 0x58]
push eax
push str.open
push str.TheWorld.AssocFile.HTMShell
call fcn.004347e0
lea ecx, [esp + 0x64]
push ecx
push str.open
push str.TheWorld.AssocFile.MHTShell
call fcn.004347e0
add esp, 0x30
push 8
push str.open
push 1
push 0x500df0
push str.TheWorld.HTTPShell
push closesocket
call esi
push 8
push str.open
push 1
push 0x500df0
push str.TheWorld.AssocFile.HTMShell
push closesocket
call esi
push 8
push str.open
push 1
push 0x500df0
push str.TheWorld.AssocFile.MHTShell
push closesocket
call esi
jmp 0x434bff
push str.TheWorld.HTTP
push closesocket
call fcn.004afa70
push str.TheWorld.AssocFile.HTM
push closesocket
call fcn.004afa70
push str.TheWorld.AssocFile.MHT
push closesocket
call fcn.004afa70
add esp, 0x18
push ebp
call ebx
add esp, 4
shl eax, 1
push eax
push ebp
push 1
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_ftpUserChoice
push reloc.DSOUND.dll_DirectSoundCreate
call esi
push ebp
call ebx
add esp, 4
shl eax, 1
push eax
push ebp
push 1
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push reloc.DSOUND.dll_DirectSoundCreate
call esi
push ebp
call ebx
add esp, 4
shl eax, 1
push eax
push ebp
push 1
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpsUserChoice
push reloc.DSOUND.dll_DirectSoundCreate
call esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x24a]
mov word [esp + 0x248], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0x24]
mov dword [esp + 0x28], str..htm
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0x40], 0x4ef3d0
stosw word es:[edi], ax
mov dword [esp + 0x44], str..shtm
mov dword [esp + 0x48], str..shtml
mov dword [esp + 0x4c], 0x4ed8c4
mov dword [esp + 0x30], str..mht
mov dword [esp + 0x34], str..mhtml
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea edi, [esp + 0x28]
mov dword [esp + 0x14], 5
mov eax, dword [edi]
lea ecx, [esp + 0x248]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push str._s_sUserChoice
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea edx, [esp + 0x248]
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call ebp
mov eax, dword [esp + 0x10]
push eax
call ebx
mov ecx, dword [esp + 0x14]
add esp, 4
shl eax, 1
push eax
push ecx
push 1
lea edx, [esp + 0x254]
push str.Progid
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call esi
mov eax, dword [esp + 0x14]
add edi, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x434cd8
lea edi, [esp + 0x1c]
mov dword [esp + 0x10], 2
mov eax, dword [edi]
lea ecx, [esp + 0x248]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push str._s_sUserChoice
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea edx, [esp + 0x248]
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call ebp
mov eax, dword [esp + 0x18]
push eax
call ebx
mov ecx, dword [esp + 0x1c]
add esp, 4
shl eax, 1
push eax
push ecx
push 1
lea edx, [esp + 0x254]
push str.Progid
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call esi
mov eax, dword [esp + 0x10]
add edi, 4
dec eax
mov dword [esp + 0x10], eax
jne 0x434d4c
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x3c]
push ecx
push 0xa
push 2
push str.SoftwareClientsStartMenuInternet
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x850
ret