Function at 0x4116dd
Capabilities:
Delete registry value
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x968
push ebx
push ebp
push esi
mov ebx, ecx
mov ecx, 0x450260
push edi
call fcn.00404e59
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.CoInternetSetFeatureEnabled
push edi
call esi
mov dword [0x45f28c], eax
mov ecx, dword [ebx + 4]
push 9
pop ebp
cmp ecx, 8
jne 0x411728
push 0x1c2
push edi
call esi
mov dword [0x45f294], eax
jmp 0x411743
cmp ecx, ebp
je 0x411736
cmp ecx, 0xa
je 0x411736
cmp ecx, 0xb
jne 0x411743
push 0x1c2
push edi
call esi
mov dword [0x45f290], eax
cmp dword [ebx + 4], 8
push str.NtSetInformationProcess
push str.ntdll.dll
setg byte [esp + 0x1f]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call esi
mov esi, eax
push 2
pop edi
test esi, esi
je 0x411788
cmp byte [esp + 0x17], 0
lea eax, [esp + 0x18]
push 4
mov ecx, edi
push eax
cmovne ecx, ebp
push 0x22
mov dword [esp + 0x24], ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov eax, dword [0x45f28c]
xor esi, esi
inc esi
xor ebp, ebp
test eax, eax
je 0x4117e7
push esi
push edi
push 9
call eax
push esi
push edi
push 0xa
call dword [0x45f28c]
push esi
push edi
push 0xf
call dword [0x45f28c]
push ebp
push edi
push 0xd
call dword [0x45f28c]
push ebp
push edi
push 5
call dword [0x45f28c]
push ebp
push edi
push 0xc
call dword [0x45f28c]
push esi
push edi
push edi
call dword [0x45f28c]
cmp dword [ebx + 4], 7
jl 0x4117e7
push esi
push edi
push 0x14
call dword [0x45f28c]
xor eax, eax
push 0x2ce
mov word [esp + 0x234], ax
lea eax, [esp + 0x236]
push ebp
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x28]
push 0x104
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
xor eax, eax
push 0x206
mov word [esp + 0x504], ax
lea eax, [esp + 0x506]
push ebp
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0x28]
push dword [ebx + 4]
push 0x4525f0
push eax
push str._s_hs_d
lea eax, [esp + 0x240]
push 0x168
push eax
call fcn.0040203a
add esp, 0x18
mov dword [esp + 0x18], 0x208
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x504]
push eax
lea eax, [esp + 0x28]
push eax
push str.last_check
push str.SoftwareKingsoftLBMINIRedirect_
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4118e5
cmp dword [esp + 0x20], esi
jne 0x4118e5
lea ecx, [esp + 0x230]
lea eax, [esp + 0x500]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4118d9
test dx, dx
je 0x4118d5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4118d9
add eax, 4
add ecx, 4
test dx, dx
jne 0x4118b3
mov eax, ebp
jmp 0x4118dd
sbb eax, eax
or eax, esi
test eax, eax
je 0x411cf8
push ecx
push ecx
push 0x20006
push ecx
push ecx
push str.SoftwareKingsoftLBMINIRedirectFeatureControl_
push SysReAllocStringLen
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], ebp
mov dword [esp + 0x38], ebp
call fcn.0041144e
test eax, eax
jne 0x411b7b
cmp dword [ebx + 4], 7
mov esi, dword [esp + 0x18]
jle 0x411935
imul eax, dword [ebx + 0x218], 0x3e8
mov edx, str.FEATURE_BROWSER_EMULATION
mov ecx, esi
push eax
push edi
call fcn.0041149f
pop ecx
pop ecx
cmp dword [ebx + 4], 8
jl 0x411b72
push 1
push edi
mov edx, str.FEATURE_DISABLE_SQM_UPLOAD_FOR_APP
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_XSSFILTER
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_RESTRICT_ABOUT_PROTOCOL_IE7
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_AJAX_CONNECTIONEVENTS
mov ecx, esi
call fcn.0041149f
push ebp
push edi
mov edx, str.FEATURE_SHOW_APP_PROTOCOL_WARN_DIALOG
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_FEEDS
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_VIEWLINKEDWEBOC_IS_UNSAFE
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_SCRIPTURL_MITIGATION
mov ecx, esi
call fcn.0041149f
add esp, 0x40
mov edx, str.FEATURE_INTERNET_SHELL_FOLDERS
mov ecx, esi
push ebp
push edi
call fcn.0041149f
push ebp
push edi
mov edx, str.FEATURE_BLOCK_LMZ_SCRIPT
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_BEHAVIORS
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_DISABLE_ISO_2022_JP_SNIFFING
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_DISABLE_MK_PROTOCOL
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_LOCALMACHINE_LOCKDOWN
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_MIME_HANDLING
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_MIME_SNIFFING
mov ecx, esi
call fcn.0041149f
add esp, 0x40
mov edx, str.FEATURE_OBJECT_CACHING
mov ecx, esi
push 1
push edi
call fcn.0041149f
push ebp
push edi
mov edx, str.FEATURE_PROTOCOL_LOCKDOWN
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_SAFE_BINDTOOBJECT
mov ecx, esi
call fcn.0041149f
push ebp
push edi
mov edx, str.FEATURE_WEBOC_POPUPMANAGEMENT
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_WINDOW_RESTRICTIONS
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_ZONE_ELEVATION
mov ecx, esi
call fcn.0041149f
push ebp
push edi
mov edx, str.FEATURE_ENABLE_SCRIPT_PASTE_URLACTION_IF_PROMPT
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_SECURITYBAND
mov ecx, esi
call fcn.0041149f
add esp, 0x40
mov ebp, str.FEATURE_TABBED_BROWSING
mov edx, ebp
mov ecx, esi
push 1
push edi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_VALIDATE_NAVIGATE_URL
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_WEBOC_DOCUMENT_ZOOM
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, ebp
mov ecx, esi
call fcn.0041149f
add esp, 0x20
xor ebp, ebp
cmp dword [ebx + 4], 9
jl 0x411b5b
push ebp
push edi
mov edx, str.FEATURE_USE_LEGACY_JSCRIPT
mov ecx, esi
call fcn.0041149f
push ebp
push edi
mov edx, str.FEATURE_LAYOUT9_QUIRKS_EMULATION
mov ecx, esi
call fcn.0041149f
push ebp
push edi
mov edx, str.Feature_Enable_Compat_Logging
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_ALIGNED_TIMERS
mov ecx, esi
call fcn.0041149f
push 1
push edi
mov edx, str.FEATURE_ALLOW_HIGHFREQ_TIMERS
mov ecx, esi
call fcn.0041149f
push ebp
push edi
mov edx, str.FEATURE_USE_WEBOC_OMNAVIGATOR_IMPLEMENTATION
mov ecx, esi
call fcn.0041149f
movzx eax, byte [ebx + 1]
mov edx, str.FEATURE_GPU_RENDERING
push eax
push edi
mov ecx, esi
call fcn.0041149f
add esp, 0x38
cmp dword [ebx + 4], 0xb
jne 0x411b72
push 1
push edi
mov edx, str.FEATURE_IGNORE_ZONE_WHEN_CONSTRUCTING_SECURITYID
mov ecx, esi
call fcn.0041149f
pop ecx
pop ecx
lea ecx, [esp + 0x18]
call fcn.00411434
push ecx
push ecx
push 0x20006
push ecx
push ecx
push str.SoftwareKingsoftLBMINIRedirect_
mov ebx, SysReAllocStringLen
mov dword [esp + 0x38], ebp
push ebx
lea ecx, [esp + 0x3c]
mov dword [esp + 0x40], ebp
call fcn.0041144e
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
test eax, eax
jne 0x411c3f
mov esi, dword [esp + 0x20]
mov edx, str.ActiveXFiltering
push ecx
push str.IsEnabled
mov ecx, esi
call fcn.0041151b
mov ebx, str.PhishingFilter
mov dword [esp], str.Enabled
mov edx, ebx
mov ecx, esi
call fcn.0041151b
mov edx, ebx
mov dword [esp], str.EnabledV8
mov ecx, esi
call fcn.0041151b
mov edx, ebx
mov dword [esp], str.EnabledV9
mov ecx, esi
call fcn.0041151b
pop ecx
pop ecx
push 0x14
mov ebp, str.LBMINI.URL
mov ebx, str.Progid
push ebp
push 1
push ebx
push str.UrlAssociationshttpUserChoice
push esi
call edi
push 0x14
push ebp
push 1
push ebx
push str.UrlAssociationshttpsUserChoice
push esi
call edi
push 0x14
push ebp
push 1
push ebx
push str.UrlAssociations_ftpUserChoice
push esi
call edi
lea ecx, [esp + 0x20]
call fcn.00411434
xor ebp, ebp
mov ebx, SysReAllocStringLen
lea eax, [esp + 0x28]
push eax
push str.__s_____1_
lea eax, [esp + 0x710]
push 0x136
push eax
call fcn.0040203a
lea esi, [esp + 0x718]
add esp, 0x10
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bp
jne 0x411c68
sub esi, ecx
lea eax, [esp + 0x708]
sar esi, 1
add esi, esi
push esi
push eax
push 1
push ebp
push str.SoftwareClassesLBMINI.HTML_shellopencommand
push ebx
call edi
push esi
lea eax, [esp + 0x70c]
push eax
push 1
push ebp
push str.SoftwareClassesLBMINI.URL_shellopencommand
push ebx
call edi
lea eax, [esp + 0x28]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
lea ecx, [esp + 0x230]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bp
jne 0x411cbc
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x234]
push eax
push 1
push str.last_check
push str.SoftwareKingsoftLBMINIRedirect_
push ebx
call edi
lea ecx, [esp + 0x20]
call fcn.00411434
lea ecx, [esp + 0x18]
call fcn.00411434
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret