Function at 0x10044cd9
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov eax, 0x100bb686
call fcn.100a0664
sub esp, 0x838
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov eax, 0x1010c318
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x58], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.FCTB000056939.IEToolbar
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.10005257
cmp dword [ebp - 0x5c], 0x10
mov eax, dword [ebp - 0x70]
mov byte [ebp - 4], 3
jae 0x10044d24
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000b4b3
push 0x100cd204
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.1000274d
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.10028ff5
mov ecx, dword [ebp - 0x1c]
mov byte [ebp - 4], 7
cmp ecx, ebx
je 0x10044d62
call fcn.10003043
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
cmp byte [ebp + 8], bl
je 0x10044fb0
mov eax, dword [ebp - 0x34]
mov byte [ebp - 4], 8
cmp eax, ebx
je 0x10044d80
mov eax, dword [eax]
jmp 0x10044d82
xor eax, eax
push ebx
push ebx
mov esi, 0x2001f
push esi
push ebx
push ebx
push eax
mov edi, SysReAllocString
push edi
lea ecx, [ebp - 0x18]
call fcn.10001485
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0x100c503c
call fcn.100425b4
push ebx
push dword [0x1010c400]
lea ecx, [ebp - 0x18]
push str.CLSID
call fcn.100425b4
lea ecx, [ebp - 0x18]
call fcn.1000146a
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x10044dd3
mov eax, dword [eax]
jmp 0x10044dd5
xor eax, eax
push ebx
push ebx
push esi
push ebx
push ebx
push eax
push edi
lea ecx, [ebp - 0x18]
call fcn.10001485
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push 0x100c503c
call fcn.100425b4
push ebx
push dword [0x1010c400]
lea ecx, [ebp - 0x18]
push str.CLSID
call fcn.100425b4
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x10044e14
mov eax, dword [eax]
jmp 0x10044e16
xor eax, eax
push ebx
push eax
push str.CurVer
lea ecx, [ebp - 0x18]
call fcn.100425b4
lea ecx, [ebp - 0x18]
call fcn.1000146a
push ebx
push ebx
push esi
push ebx
push ebx
push str.CLSID
push edi
lea ecx, [ebp - 0x18]
call fcn.10001485
push ebx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x18]
push dword [0x1010c400]
call fcn.100425b4
lea ecx, [ebp - 0x18]
call fcn.1000146a
push str.CLSID_
lea ecx, [ebp - 0x1c]
call fcn.1000274d
push dword [0x1010c400]
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 9
call fcn.1000274d
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xa
call fcn.1000bfeb
mov ecx, dword [ebp - 0x30]
mov byte [ebp - 4], 9
cmp ecx, ebx
je 0x10044e99
call fcn.10003043
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x10044ea4
mov eax, dword [eax]
jmp 0x10044ea6
xor eax, eax
push ebx
push ebx
push esi
push ebx
push ebx
push eax
push edi
lea ecx, [ebp - 0x18]
call fcn.10001485
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x10044ec0
mov eax, dword [eax]
jmp 0x10044ec2
xor eax, eax
push ebx
push eax
push str.ProgID
lea ecx, [ebp - 0x18]
call fcn.100425b4
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x10044edc
mov eax, dword [eax]
jmp 0x10044ede
xor eax, eax
push ebx
push eax
push str.VersionIndependentProgID
lea ecx, [ebp - 0x18]
call fcn.100425b4
push ebx
push str.8518B5E9_EDF5_4BDA_B5D3_4AA044EC072D
push 0x100c487c
lea ecx, [ebp - 0x18]
call fcn.100425b4
push 0x3e8
lea eax, [ebp - 0x844]
push eax
push dword [0x1010dbb8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x844]
push eax
lea ecx, [ebp - 0x20]
call fcn.100057f4
push ebx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xb
call fcn.10003413
push ebx
push eax
mov edi, str.InprocServer32
push edi
lea ecx, [ebp - 0x18]
call fcn.100425b4
push str.ThreadingModel
push str.Apartment
push edi
lea ecx, [ebp - 0x18]
call fcn.100425b4
lea ecx, [ebp - 0x18]
call fcn.1000146a
push ebx
push ebx
push esi
push ebx
push ebx
push str.SYSTEMCurrentControlSetControlSession_Manager_
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
lea ecx, [ebp - 0x18]
call fcn.10001485
push str.PendingFileRenameOperations
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x18]
call fcn.1000146a
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
call fcn.10001ccd
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x10044fa7
call fcn.10003043
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 7
jmp 0x10045099
push ebx
push ebx
mov esi, 0x2001f
push esi
push ebx
push ebx
push str.CLSID_
mov edi, SysReAllocString
push edi
lea ecx, [ebp - 0x18]
call fcn.10001485
push dword [0x1010c400]
lea ecx, [ebp - 0x18]
call fcn.100025d8
push dword [0x1010c400]
lea ecx, [ebp - 0x18]
call fcn.1000140f
lea ecx, [ebp - 0x18]
call fcn.1000146a
push esi
push ebx
push edi
lea ecx, [ebp - 0x18]
call fcn.100014df
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x10045007
mov eax, dword [eax]
jmp 0x10045009
xor eax, eax
push eax
lea ecx, [ebp - 0x18]
call fcn.100025d8
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x1004501d
mov eax, dword [eax]
jmp 0x1004501f
xor eax, eax
push eax
lea ecx, [ebp - 0x18]
call fcn.1000140f
lea ecx, [ebp - 0x18]
call fcn.1000146a
push esi
push ebx
push edi
lea ecx, [ebp - 0x18]
call fcn.100014df
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x10045046
mov eax, dword [eax]
jmp 0x10045048
xor eax, eax
push eax
lea ecx, [ebp - 0x18]
call fcn.100025d8
mov eax, dword [ebp - 0x28]
cmp eax, ebx
je 0x1004505c
mov eax, dword [eax]
jmp 0x1004505e
xor eax, eax
push eax
lea ecx, [ebp - 0x18]
call fcn.1000140f
lea ecx, [ebp - 0x18]
call fcn.1000146a
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsUser_AgentPost_Platform
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
lea ecx, [ebp - 0x18]
call fcn.100014df
push 0x100c503c
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x18]
call fcn.1000146a
lea ecx, [ebp - 0x18]
call fcn.1000146a
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_LOCALMACHINE_LOCKDOWN
push SysReAllocString
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 0x24], ebx
je 0x100450f6
cmp byte [ebp + 8], bl
je 0x100450e8
push 4
lea eax, [ebp - 0x48]
push eax
push 4
push ebx
push str.iexplore.exe
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100450f6
push str.iexplore.exe
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftInternet_ExplorerToolbar
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp byte [ebp + 8], bl
je 0x1004513b
push 1
lea eax, [ebp - 0x29]
push eax
push 3
push ebx
push dword [0x1010c400]
mov byte [ebp - 0x29], bl
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1004514a
push dword [0x1010c400]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp + 8], bl
jne 0x100453e8
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
push esi
push str.SoftwareMicrosoftInternet_ExplorerSearch
push edi
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 0xc
call fcn.100014df
mov edi, 0x100c503c
cmp eax, ebx
jne 0x100451f3
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push edi
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push edi
mov byte [ebp - 4], 0xd
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push str.OldAssitant1
mov byte [ebp - 4], 0xe
call fcn.100057f4
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0xc
call fcn.10044254
add esp, 0x10
push ebx
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0xf
call fcn.10003413
push 0xffffffffffffffff
push ebx
push str.SearchAssistant
push eax
lea ecx, [ebp - 0x3c]
call fcn.10042522
lea ecx, [ebp - 0x3c]
call fcn.1000146a
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xc
call fcn.10001ccd
push esi
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocString
lea ecx, [ebp - 0x3c]
call fcn.100014df
cmp eax, ebx
jne 0x100453e0
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push edi
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push edi
mov byte [ebp - 4], 0x10
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str.OldAssitant5
mov byte [ebp - 4], 0x11
call fcn.100057f4
lea eax, [ebp - 0x1c]
push eax
mov byte [ebp - 4], 0xc
call fcn.10044254
add esp, 0x10
push ebx
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x12
call fcn.10003413
or esi, 0xffffffff
push esi
push ebx
push str.Use_Search_Asst
push eax
lea ecx, [ebp - 0x3c]
call fcn.10042522
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push edi
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push edi
mov byte [ebp - 4], 0x13
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push str.OldAssitant2
mov byte [ebp - 4], 0x14
call fcn.100057f4
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x12
call fcn.10044254
add esp, 0x10
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x15
call fcn.100046db
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x12
call fcn.10001ccd
push ebx
lea ecx, [ebp - 0x1c]
call fcn.10003413
push esi
push ebx
push str.Search_Page
push eax
lea ecx, [ebp - 0x3c]
call fcn.10042522
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push edi
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push edi
mov byte [ebp - 4], 0x16
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str.OldAssitant3
mov byte [ebp - 4], 0x17
call fcn.100057f4
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x12
call fcn.10044254
add esp, 0x10
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x18
call fcn.100046db
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x12
call fcn.10001ccd
push ebx
lea ecx, [ebp - 0x1c]
call fcn.10003413
push esi
push ebx
push str.Search_Bar
push eax
lea ecx, [ebp - 0x3c]
call fcn.10042522
push ecx
mov ecx, esp
mov dword [ebp - 0x14], esp
push edi
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp - 0x44], esp
push edi
mov byte [ebp - 4], 0x19
call fcn.100057f4
push ecx
mov ecx, esp
mov dword [ebp - 0x30], esp
push str.OldAssitant4
mov byte [ebp - 4], 0x1a
call fcn.100057f4
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x12
call fcn.10044254
add esp, 0x10
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x1b
call fcn.100046db
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0x12
call fcn.10001ccd
push ebx
lea ecx, [ebp - 0x1c]
call fcn.10003413
push esi
push ebx
push str.SearchAssistant
push eax
lea ecx, [ebp - 0x3c]
call fcn.10042522
lea ecx, [ebp - 0x3c]
call fcn.1000146a
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.10001ccd
lea ecx, [ebp - 0x3c]
call fcn.1000146a
mov ecx, dword [ebp - 0x34]
cmp ecx, ebx
je 0x100453f7
call fcn.10003043
mov dword [ebp - 0x34], ebx
mov ecx, dword [ebp - 0x28]
cmp ecx, ebx
je 0x10045406
call fcn.10003043
mov dword [ebp - 0x28], ebx
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.100033aa
push 0x1010c318
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.10001ccd
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret