Function at 0x100040b6
Capabilities:
Check if file exists
Delete registry key
Delete registry value
Set registry value

Disassembly:
mov eax, 0x10050c64
call fcn.100457f4
sub esp, 0x74
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.10006e81
pop ecx
xor ebx, ebx
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
mov esi, 0x20006
push esi
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_LOCALMACHINE_LOCKDOWN
push SysReAllocStringLen
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [ebp - 0x18], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
je 0x10004114
push 4
lea eax, [ebp - 0x24]
push eax
push 4
push ebx
push str.iexplore.exe
push dword [ebp - 0x18]
call edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftInternet_ExplorerToolbar
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp byte [ebp + 8], bl
je 0x10004163
mov ecx, dword [0x1006ce68]
cmp ecx, ebx
mov byte [ebp - 0xd], bl
je 0x10004150
call fcn.10001a3c
jmp 0x10004152
xor eax, eax
push 1
lea ecx, [ebp - 0xd]
push ecx
push 3
push ebx
push eax
push dword [ebp - 0x18]
call edi
jmp 0x10004180
mov ecx, dword [0x1006ce68]
cmp ecx, ebx
je 0x10004174
call fcn.10001a3c
jmp 0x10004176
xor eax, eax
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1006ce54
lea eax, [ebp - 0x1c]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push eax
call fcn.10004774
add esp, 0xc
push 0x1006ce50
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.100018c9
mov ecx, dword [eax]
cmp ecx, ebx
mov byte [ebp - 4], 1
je 0x100041c3
call fcn.10001a3c
jmp 0x100041c5
xor eax, eax
push ebx
lea ecx, [ebp - 0x18]
push ecx
push ebx
push esi
push ebx
push ebx
push ebx
push eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea ecx, [ebp - 0x20]
call fcn.100018b6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100018b6
cmp byte [ebp + 8], bl
je 0x1000433b
lea eax, [ebp - 0xe]
push eax
lea eax, [ebp - 0xd]
push eax
mov esi, 0x3e8
push esi
lea ecx, [ebp - 0x70]
mov byte [ebp - 0xd], bl
call fcn.10022ebd
mov eax, dword [0x1006cfa4]
push esi
push dword [ebp - 0x6c]
mov dword [ebp - 4], 2
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov al, byte [ebp + 0xb]
mov esi, dword [ebp - 0x6c]
push ebx
lea ecx, [ebp - 0x50]
mov byte [ebp - 0x50], al
call fcn.1002376b
push esi
call fcn.10045c20
pop ecx
push eax
push esi
lea ecx, [ebp - 0x50]
call fcn.100243fe
mov ecx, dword [0x1006ce5c]
cmp ecx, ebx
mov byte [ebp - 4], 3
je 0x10004263
call fcn.10001a3c
mov esi, eax
jmp 0x10004265
xor esi, esi
mov ecx, 0x1006ce5c
call fcn.10001a25
push eax
push esi
push 1
push ebx
push str.DisplayName
push dword [ebp - 0x18]
call edi
push 0x10066768
lea ecx, [ebp - 0x20]
call fcn.1000101a
mov eax, dword [ebp - 0x4c]
cmp eax, ebx
mov byte [ebp - 4], 4
jne 0x1000429b
mov eax, 0x10057508
push eax
lea ecx, [ebp - 0x2c]
call fcn.1000101a
push eax
lea eax, [ebp - 0x28]
push str.regsvr32__u__s__
push eax
mov byte [ebp - 4], 5
call fcn.10004774
add esp, 0xc
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.100018c9
lea ecx, [ebp - 0x28]
call fcn.100018b6
lea ecx, [ebp - 0x2c]
call fcn.100018b6
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 8
call fcn.100018b6
mov ecx, dword [ebp - 0x1c]
cmp ecx, ebx
je 0x100042f9
call fcn.10001a3c
mov esi, eax
jmp 0x100042fb
xor esi, esi
lea ecx, [ebp - 0x1c]
call fcn.10001a25
push eax
push esi
push 1
push ebx
push str.UninstallString
push dword [ebp - 0x18]
call edi
lea ecx, [ebp - 0x1c]
call fcn.100018b6
push 1
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 2
call fcn.1002376b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.100223c8
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x100043af
push str.DisplayName
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.UninstallString
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push 0x1006ce54
lea eax, [ebp - 0x28]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
push eax
call fcn.10004774
add esp, 0xc
push 0x1006ce50
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, eax
mov dword [ebp - 4], 0xb
call fcn.100018c9
mov ecx, dword [eax]
cmp ecx, ebx
mov byte [ebp - 4], 0xc
je 0x10004395
call fcn.10001a3c
jmp 0x10004397
xor eax, eax
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
lea ecx, [ebp - 0x2c]
call fcn.100018b6
lea ecx, [ebp - 0x28]
call fcn.100018b6
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
cmp byte [ebp + 8], bl
mov dword [ebp - 4], 0xd
je 0x100045f9
lea eax, [ebp - 0x28]
push eax
call fcn.10003dfc
mov dword [esp], str.favicon.ico
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0xe
call fcn.1001193b
push dword [eax]
lea ecx, [ebp + 8]
mov byte [ebp - 4], 0xf
call fcn.1000101a
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x12
call fcn.1001179b
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0x11
call fcn.1001179b
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x1000441d
call fcn.10001a3c
jmp 0x1000441f
xor eax, eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x100045ec
push 0x1006ce68
lea eax, [ebp - 0x1c]
push str.SOFTWAREMicrosoftInternet_ExplorerExtensions_
push eax
call fcn.10004774
add esp, 0xc
mov ecx, dword [eax]
cmp ecx, ebx
mov byte [ebp - 4], 0x13
je 0x10004455
call fcn.10001a3c
jmp 0x10004457
xor eax, eax
lea ecx, [ebp - 0x30]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push esi
mov dword [ebp - 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x10004485
lea ecx, [ebp - 0x14]
call fcn.100047cf
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0x11
call fcn.100018b6
mov ecx, dword [0x1006ce5c]
cmp ecx, ebx
je 0x100044a5
call fcn.10001a3c
mov dword [ebp - 0x1c], eax
jmp 0x100044a8
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push str.ButtonText
push dword [ebp - 0x14]
call edi
push str.1FBA04EE_3024_11d2_8F1F_0000F87ABD16.
call esi
inc eax
push eax
push str.1FBA04EE_3024_11d2_8F1F_0000F87ABD16.
push 1
push ebx
push str.CLSID
push dword [ebp - 0x14]
call edi
push 0x100666cc
call esi
inc eax
push eax
push 0x100666cc
push 1
push ebx
push str.Default_Visible
push dword [ebp - 0x14]
call edi
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x1000450c
call fcn.10001a3c
mov dword [ebp - 0x1c], eax
jmp 0x1000450f
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x1c]
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push str.HotIcon
push dword [ebp - 0x14]
call edi
mov ecx, dword [ebp + 8]
cmp ecx, ebx
je 0x10004537
call fcn.10001a3c
mov dword [ebp - 0x1c], eax
jmp 0x1000453a
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x1c]
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push str.Icon
push dword [ebp - 0x14]
call edi
mov ecx, dword [0x1006ce5c]
cmp ecx, ebx
je 0x10004565
call fcn.10001a3c
mov dword [ebp - 0x1c], eax
jmp 0x10004568
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x1c]
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push str.MenuStatusBar
push dword [ebp - 0x14]
call edi
mov ecx, dword [0x1006ce5c]
cmp ecx, ebx
je 0x10004593
call fcn.10001a3c
mov dword [ebp - 0x1c], eax
jmp 0x10004596
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x1c]
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push str.MenuText
push dword [ebp - 0x14]
call edi
mov ecx, dword [0x1006ce68]
cmp ecx, ebx
je 0x100045c1
call fcn.10001a3c
mov dword [ebp - 0x1c], eax
jmp 0x100045c4
mov dword [ebp - 0x1c], ebx
push dword [ebp - 0x1c]
call esi
inc eax
push eax
push dword [ebp - 0x1c]
push 1
push ebx
push str.ClsidExtension
push dword [ebp - 0x14]
call edi
cmp dword [ebp - 0x14], ebx
je 0x100045ec
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
lea ecx, [ebp + 8]
call fcn.100018b6
jmp 0x10004759
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWAREMicrosoftInternet_ExplorerExtensions
push esi
mov dword [ebp + 8], ebx
call edi
cmp eax, ebx
jne 0x1000462d
lea ecx, [ebp - 0x14]
call fcn.100047cf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [0x1006ce68]
cmp ecx, ebx
je 0x1000463e
call fcn.10001a3c
jmp 0x10004640
xor eax, eax
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 0x14], ebx
je 0x1000465b
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsUser_AgentPost_Platform
push esi
mov dword [ebp + 8], ebx
call edi
cmp eax, ebx
jne 0x10004689
lea ecx, [ebp - 0x14]
call fcn.100047cf
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov al, byte [ebp + 0xb]
push ebx
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x40], al
call fcn.1002376b
mov edi, 0x100664b8
push edi
call fcn.10045c20
pop ecx
push eax
push edi
lea ecx, [ebp - 0x40]
call fcn.100243fe
mov al, byte [ebp + 0xb]
push ebx
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x14
mov byte [ebp - 0x60], al
call fcn.1002376b
mov edi, str.UserAgent
push edi
call fcn.10045c20
pop ecx
push eax
push edi
lea ecx, [ebp - 0x60]
call fcn.100243fe
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x80]
push eax
mov byte [ebp - 4], 0x15
call fcn.100039b2
add esp, 0xc
push dword [0x1005750c]
lea ecx, [ebp - 0x40]
push ebx
push eax
mov byte [ebp - 4], 0x16
call fcn.10023391
push 1
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0x15
call fcn.1002376b
push 1
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x14
call fcn.1002376b
cmp dword [ebp - 0x38], ebx
je 0x1000473a
mov eax, dword [ebp - 0x3c]
cmp eax, ebx
jne 0x10004730
mov eax, 0x10057508
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [ebp - 0x14], ebx
je 0x1000474b
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 0xd
call fcn.1002376b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100047cf
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret