Function at 0x100e2e80
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101adb45
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x1022c684]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 2
mov ecx, 0x1022ec24
call fcn.10005f70
push eax
lea ecx, [ebp - 0x18]
call fcn.10010910
mov byte [ebp - 4], 3
push 0x101d0214
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call fcn.10090bb0
add esp, 0xc
mov byte [ebp - 4], 4
movzx edx, byte [ebp + 8]
test edx, edx
je 0x100e31bd
lea ecx, [ebp - 0x234]
call fcn.10020e50
mov byte [ebp - 4], 5
push 0
push 0
push 0x2001f
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.10004390
push eax
push SysReAllocString
lea ecx, [ebp - 0x234]
call fcn.10021020
push 0
lea ecx, [ebp + 0xc]
call fcn.10004390
push eax
push 0x101d021c
lea ecx, [ebp - 0x234]
call fcn.100e4f70
push 0
mov ecx, 0x1022edbc
call fcn.100043a0
push eax
push 0x101d0220
lea ecx, [ebp - 0x234]
call fcn.100e4f70
lea ecx, [ebp - 0x234]
call fcn.10020fd0
push 0
push 0
push 0x2001f
push 0
push 0
lea ecx, [ebp - 0x18]
call fcn.10004390
push eax
push SysReAllocString
lea ecx, [ebp - 0x234]
call fcn.10021020
push 0
lea ecx, [ebp + 0xc]
call fcn.10004390
push eax
push 0x101d022c
lea ecx, [ebp - 0x234]
call fcn.100e4f70
push 0
mov ecx, 0x1022edbc
call fcn.100043a0
push eax
push 0x101d0230
lea ecx, [ebp - 0x234]
call fcn.100e4f70
push 0
lea ecx, [ebp - 0x1c]
call fcn.10004390
push eax
push str.CurVer
lea ecx, [ebp - 0x234]
call fcn.100e4f70
lea ecx, [ebp - 0x234]
call fcn.10020fd0
push 0
push 0
push 0x2001f
push 0
push 0
push 0x101d024c
push SysReAllocString
lea ecx, [ebp - 0x234]
call fcn.10021020
push 0
lea ecx, [ebp + 0xc]
call fcn.10004390
push eax
mov ecx, 0x1022edbc
call fcn.100043a0
push eax
lea ecx, [ebp - 0x234]
call fcn.100e4f70
lea ecx, [ebp - 0x234]
call fcn.10020fd0
push 0x101d0258
lea ecx, [ebp - 0x238]
call fcn.10005d80
mov byte [ebp - 4], 6
mov ecx, 0x1022edbc
call fcn.100043a0
push eax
lea ecx, [ebp - 0x238]
call fcn.10025620
push 0
push 0
push 0x2001f
push 0
push 0
lea ecx, [ebp - 0x238]
call fcn.10004390
push eax
push SysReAllocString
lea ecx, [ebp - 0x234]
call fcn.10021020
push 0
lea ecx, [ebp - 0x1c]
call fcn.10004390
push eax
push str.ProgID
lea ecx, [ebp - 0x234]
call fcn.100e4f70
push 0
lea ecx, [ebp - 0x18]
call fcn.10004390
push eax
push str.VersionIndependentProgID
lea ecx, [ebp - 0x234]
call fcn.100e4f70
push 0
push str.EC4085F2_8DB3_45a6_AD0B_CA289F3C5D7E
push 0x101d0300
lea ecx, [ebp - 0x234]
call fcn.100e4f70
push 0x104
lea eax, [ebp - 0x22c]
push eax
mov ecx, 0x1022ee50
call fcn.10098ab0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x22c]
push ecx
lea ecx, [ebp - 0x23c]
call fcn.10005d80
mov byte [ebp - 4], 7
push 0
lea ecx, [ebp - 0x23c]
call fcn.100043a0
push eax
push 0x101d0310
lea ecx, [ebp - 0x234]
call fcn.100e4f70
push str.ThreadingModel
push str.Apartment
push str.InprocServer32
lea ecx, [ebp - 0x234]
call fcn.100e4f70
lea ecx, [ebp - 0x234]
call fcn.10020fd0
push 0
push 0
push 0x2001f
push 0
push 0
push str.SYSTEMCurrentControlSetControlSession_Manager_
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x234]
call fcn.10021020
push str.PendingFileRenameOperations
lea ecx, [ebp - 0x234]
call fcn.10020fa0
lea ecx, [ebp - 0x234]
call fcn.10020fd0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x23c]
call fcn.10005e00
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x238]
call fcn.10005e00
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x234]
call fcn.10020e80
jmp 0x100e32fd
lea ecx, [ebp - 0x244]
call fcn.10020e50
mov byte [ebp - 4], 8
push 0
push 0
push 0x2001f
push 0
push 0
push 0x101d0424
push SysReAllocString
lea ecx, [ebp - 0x244]
call fcn.10021020
mov ecx, 0x1022edbc
call fcn.100043a0
push eax
lea ecx, [ebp - 0x244]
call fcn.10021110
mov ecx, 0x1022edbc
call fcn.100043a0
push eax
lea ecx, [ebp - 0x244]
call fcn.10020f10
lea ecx, [ebp - 0x244]
call fcn.10020fd0
push 0x2001f
push 0
push SysReAllocString
lea ecx, [ebp - 0x244]
call fcn.100210a0
lea ecx, [ebp - 0x1c]
call fcn.10004390
push eax
lea ecx, [ebp - 0x244]
call fcn.10021110
lea ecx, [ebp - 0x1c]
call fcn.10004390
push eax
lea ecx, [ebp - 0x244]
call fcn.10020f10
lea ecx, [ebp - 0x244]
call fcn.10020fd0
push 0x2001f
push 0
push SysReAllocString
lea ecx, [ebp - 0x244]
call fcn.100210a0
lea ecx, [ebp - 0x18]
call fcn.10004390
push eax
lea ecx, [ebp - 0x244]
call fcn.10021110
lea ecx, [ebp - 0x18]
call fcn.10004390
push eax
lea ecx, [ebp - 0x244]
call fcn.10020f10
lea ecx, [ebp - 0x244]
call fcn.10020fd0
push 0x2001f
push 0x101d0438
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x244]
call fcn.100210a0
push 0x101d04e4
lea ecx, [ebp - 0x244]
call fcn.10020fa0
lea ecx, [ebp - 0x244]
call fcn.10020fd0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x244]
call fcn.10020e80
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_LOCALMACHINE_LOCKDOWN
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 0x14], 0
je 0x100e3370
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100e3361
call fcn.100e4640
cmp eax, 1
je 0x100e335f
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push 0x101d0598
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100e3370
push 0x101d05b4
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push 0x101d05d0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100e33d0
mov byte [ebp - 0x245], 0
push 1
lea ecx, [ebp - 0x245]
push ecx
push 3
push 0
mov ecx, 0x1022edbc
call fcn.100043a0
push eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x100e33e5
mov ecx, 0x1022edbc
call fcn.100043a0
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx edx, byte [ebp + 8]
test edx, edx
jne 0x100e38b6
lea ecx, [ebp - 0x254]
call fcn.10020e50
mov byte [ebp - 4], 9
push 0x2001f
push str.SoftwareMicrosoftInternet_ExplorerSearch
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x254]
call fcn.100210a0
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x100e34f7
push ecx
mov ecx, esp
mov dword [ebp - 0x260], esp
push 0x101d0688
call fcn.10005d80
mov dword [ebp - 0x2b4], eax
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x2b8], eax
mov byte [ebp - 4], 0xa
push ecx
mov ecx, esp
mov dword [ebp - 0x264], esp
push 0x101d068c
call fcn.10005d80
mov dword [ebp - 0x2bc], eax
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp - 0x2c0], ecx
mov byte [ebp - 4], 0xb
push ecx
mov ecx, esp
mov dword [ebp - 0x268], esp
push str.OldAssitant1
call fcn.10005d80
mov dword [ebp - 0x2c4], eax
lea edx, [ebp - 0x258]
push edx
mov byte [ebp - 4], 9
call fcn.100e0810
add esp, 0x10
mov dword [ebp - 0x2c8], eax
mov byte [ebp - 4], 0xc
push 1
lea ecx, [ebp - 0x258]
call fcn.100043a0
push eax
push 0x101d06ac
lea ecx, [ebp - 0x254]
call fcn.100217a0
lea ecx, [ebp - 0x254]
call fcn.10020fd0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x258]
call fcn.10005e00
push 0x2001f
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocString
lea ecx, [ebp - 0x254]
call fcn.100210a0
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x100e385d
push ecx
mov ecx, esp
mov dword [ebp - 0x26c], esp
push 0x101d06cc
call fcn.10005d80
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2d0], eax
mov byte [ebp - 4], 0xd
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
push 0x101d0724
call fcn.10005d80
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x2d4]
mov dword [ebp - 0x2d8], ecx
mov byte [ebp - 4], 0xe
push ecx
mov ecx, esp
mov dword [ebp - 0x274], esp
push str.OldAssitant5
call fcn.10005d80
mov dword [ebp - 0x2dc], eax
lea edx, [ebp - 0x25c]
push edx
mov byte [ebp - 4], 9
call fcn.100e0810
add esp, 0x10
mov dword [ebp - 0x2e0], eax
mov byte [ebp - 4], 0xf
push 1
lea ecx, [ebp - 0x25c]
call fcn.100043a0
push eax
push str.Use_Search_Asst
lea ecx, [ebp - 0x254]
call fcn.100217a0
push ecx
mov ecx, esp
mov dword [ebp - 0x278], esp
push 0x101d0764
call fcn.10005d80
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x2e4]
mov dword [ebp - 0x2e8], eax
mov byte [ebp - 4], 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x27c], esp
push 0x101d0768
call fcn.10005d80
mov dword [ebp - 0x2ec], eax
mov ecx, dword [ebp - 0x2ec]
mov dword [ebp - 0x2f0], ecx
mov byte [ebp - 4], 0x11
push ecx
mov ecx, esp
mov dword [ebp - 0x280], esp
push str.OldAssitant2
call fcn.10005d80
mov dword [ebp - 0x2f4], eax
lea edx, [ebp - 0x284]
push edx
mov byte [ebp - 4], 0xf
call fcn.100e0810
add esp, 0x10
mov dword [ebp - 0x2f8], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x2fc], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x2fc]
push ecx
lea ecx, [ebp - 0x25c]
call fcn.10003ea0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x284]
call fcn.10005e00
push 1
lea ecx, [ebp - 0x25c]
call fcn.100043a0
push eax
push str.Search_Page
lea ecx, [ebp - 0x254]
call fcn.100217a0
push ecx
mov ecx, esp
mov dword [ebp - 0x288], esp
push 0x101d07a0
call fcn.10005d80
mov dword [ebp - 0x300], eax
mov edx, dword [ebp - 0x300]
mov dword [ebp - 0x304], edx
mov byte [ebp - 4], 0x13
push ecx
mov ecx, esp
mov dword [ebp - 0x28c], esp
push 0x101d07a4
call fcn.10005d80
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x30c], eax
mov byte [ebp - 4], 0x14
push ecx
mov ecx, esp
mov dword [ebp - 0x290], esp
push str.OldAssitant3
call fcn.10005d80
mov dword [ebp - 0x310], eax
lea ecx, [ebp - 0x294]
push ecx
mov byte [ebp - 4], 0xf
call fcn.100e0810
add esp, 0x10
mov dword [ebp - 0x314], eax
mov edx, dword [ebp - 0x314]
mov dword [ebp - 0x318], edx
mov byte [ebp - 4], 0x15
mov eax, dword [ebp - 0x318]
push eax
lea ecx, [ebp - 0x25c]
call fcn.10003ea0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x294]
call fcn.10005e00
push 1
lea ecx, [ebp - 0x25c]
call fcn.100043a0
push eax
push str.Search_Bar
lea ecx, [ebp - 0x254]
call fcn.100217a0
push ecx
mov ecx, esp
mov dword [ebp - 0x298], esp
push 0x101d07dc
call fcn.10005d80
mov dword [ebp - 0x31c], eax
mov ecx, dword [ebp - 0x31c]
mov dword [ebp - 0x320], ecx
mov byte [ebp - 4], 0x16
push ecx
mov ecx, esp
mov dword [ebp - 0x29c], esp
push 0x101d07e0
call fcn.10005d80
mov dword [ebp - 0x324], eax
mov edx, dword [ebp - 0x324]
mov dword [ebp - 0x328], edx
mov byte [ebp - 4], 0x17
push ecx
mov ecx, esp
mov dword [ebp - 0x2a0], esp
push str.OldAssitant4
call fcn.10005d80
mov dword [ebp - 0x32c], eax
lea eax, [ebp - 0x2a4]
push eax
mov byte [ebp - 4], 0xf
call fcn.100e0810
add esp, 0x10
mov dword [ebp - 0x330], eax
mov ecx, dword [ebp - 0x330]
mov dword [ebp - 0x334], ecx
mov byte [ebp - 4], 0x18
mov edx, dword [ebp - 0x334]
push edx
lea ecx, [ebp - 0x25c]
call fcn.10003ea0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x2a4]
call fcn.10005e00
push 1
lea ecx, [ebp - 0x25c]
call fcn.100043a0
push eax
push str.SearchAssistant
lea ecx, [ebp - 0x254]
call fcn.100217a0
lea ecx, [ebp - 0x254]
call fcn.10020fd0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x25c]
call fcn.10005e00
push 0x2001f
push str.SoftwareMicrosoftInternet_ExplorerToolbarWebBrowser_
push SysReAllocString
lea ecx, [ebp - 0x254]
call fcn.100210a0
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 0
jne 0x100e38a7
mov ecx, 0x1022edbc
call fcn.100043a0
push eax
lea ecx, [ebp - 0x254]
call fcn.10020fa0
lea ecx, [ebp - 0x254]
call fcn.10020fd0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x254]
call fcn.10020e80
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100e3937
push ecx
mov ecx, esp
mov dword [ebp - 0x2a8], esp
lea edx, [ebp + 0x18]
push edx
call fcn.10005d60
mov dword [ebp - 0x338], eax
mov eax, dword [ebp - 0x338]
mov dword [ebp - 0x33c], eax
mov byte [ebp - 4], 0x19
push ecx
mov ecx, esp
mov dword [ebp - 0x2ac], esp
lea edx, [ebp + 0x14]
push edx
call fcn.10005d60
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x344], eax
mov byte [ebp - 4], 0x1a
push ecx
mov ecx, esp
mov dword [ebp - 0x2b0], esp
lea edx, [ebp + 0xc]
push edx
call fcn.10005d60
mov dword [ebp - 0x348], eax
movzx eax, byte [ebp + 8]
push eax
mov byte [ebp - 4], 4
call fcn.100e49c0
add esp, 0x10
movzx ecx, byte [ebp + 8]
test ecx, ecx
jne 0x100e3952
lea edx, [ebp + 0xc]
push edx
push 0
call fcn.100e39b0
add esp, 8
call fcn.100e3db0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c]
call fcn.10005e00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x18]
call fcn.10005e00
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.10005e00
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x14]
call fcn.10005e00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x18]
call fcn.10005e00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.1016f6a2
mov esp, ebp
pop ebp
ret