Function at 0x434590
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x850
push ebx
push ebp
push esi
mov esi, dword [esp + 0x860]
xor ebx, ebx
push edi
cmp esi, ebx
je 0x4345be
mov dword [esp + 0x10], str.TheWorld.AssocFile.HTM
mov dword [esp + 0x18], str.TheWorld.AssocFile.MHT
mov ebp, str.TheWorld.HTTP
jmp 0x4345d3
mov dword [esp + 0x10], str.IE.AssocFile.HTM
mov dword [esp + 0x18], str.IE.AssocFile.MHT
mov ebp, str.IE.HTTP
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x65a]
mov word [esp + 0x658], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x452]
mov word [esp + 0x450], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x42]
mov word [esp + 0x40], bx
rep stosd dword es:[edi], eax
mov ecx, dword [0x6dcf84]
push 0x104
stosw word es:[edi], ax
lea eax, [esp + 0x65c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x450]
push 0x104
lea eax, [esp + 0x65c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea ecx, [esp + 0x450]
lea edx, [esp + 0x40]
push ecx
push str._s_0
push 0x103
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
cmp esi, ebx
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
je 0x4347ff
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x40]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0x4ffec0
push str.IE.AssocFile.HTMDefaultIcon
push connect
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], 0x103
call edi
lea eax, [esp + 0x40]
push eax
call ebx
add esp, 4
lea ecx, [esp + 0x40]
shl eax, 1
push eax
push ecx
push 1
push 0x4ffec0
push str.TheWorld.AssocFile.HTMDefaultIcon
push connect
call esi
lea edx, [esp + 0x40]
push edx
call ebx
add esp, 4
shl eax, 1
push eax
lea eax, [esp + 0x44]
push eax
push 1
push 0x4ffec0
push str.TheWorld.HTTPDefaultIcon
push connect
call esi
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x40]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push 0x4ffec0
push str.IE.AssocFile.MHTDefaultIcon
push connect
mov dword [esp + 0x2c], 1
mov dword [esp + 0x34], 0x103
call edi
lea ecx, [esp + 0x40]
push ecx
call ebx
add esp, 4
lea edx, [esp + 0x40]
shl eax, 1
push eax
push edx
push 1
push 0x4ffec0
push str.TheWorld.AssocFile.MHTDefaultIcon
push connect
call esi
lea eax, [esp + 0x40]
push 0x104
lea ecx, [esp + 0x454]
push eax
push ecx
call fcn.004343f0
lea edx, [esp + 0x4c]
push edx
push str.open
push str.TheWorld.HTTPShell
call fcn.00434410
lea eax, [esp + 0x58]
push eax
push str.open
push str.TheWorld.AssocFile.HTMShell
call fcn.00434410
lea ecx, [esp + 0x64]
push ecx
push str.open
push str.TheWorld.AssocFile.MHTShell
call fcn.00434410
add esp, 0x30
push 8
push str.open
push 1
push 0x4ffec0
push str.TheWorld.HTTPShell
push connect
call esi
push 8
push str.open
push 1
push 0x4ffec0
push str.TheWorld.AssocFile.HTMShell
push connect
call esi
push 8
push str.open
push 1
push 0x4ffec0
push str.TheWorld.AssocFile.MHTShell
push connect
call esi
jmp 0x43482f
push str.TheWorld.HTTP
push connect
call fcn.004ae720
push str.TheWorld.AssocFile.HTM
push connect
call fcn.004ae720
push str.TheWorld.AssocFile.MHT
push connect
call fcn.004ae720
add esp, 0x18
push ebp
call ebx
add esp, 4
shl eax, 1
push eax
push ebp
push 1
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_ftpUserChoice
push reloc.DSOUND.dll_DirectSoundCreate
call esi
push ebp
call ebx
add esp, 4
shl eax, 1
push eax
push ebp
push 1
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push reloc.DSOUND.dll_DirectSoundCreate
call esi
push ebp
call ebx
add esp, 4
shl eax, 1
push eax
push ebp
push 1
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpsUserChoice
push reloc.DSOUND.dll_DirectSoundCreate
call esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x24a]
mov word [esp + 0x248], 0
rep stosd dword es:[edi], eax
lea edx, [esp + 0x24]
mov dword [esp + 0x28], str..htm
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0x40], 0x4ee710
stosw word es:[edi], ax
mov dword [esp + 0x44], str..shtm
mov dword [esp + 0x48], str..shtml
mov dword [esp + 0x4c], 0x4ebc40
mov dword [esp + 0x30], str..mht
mov dword [esp + 0x34], str..mhtml
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea edi, [esp + 0x28]
mov dword [esp + 0x14], 5
mov eax, dword [edi]
lea ecx, [esp + 0x248]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push str._s_sUserChoice
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea edx, [esp + 0x248]
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call ebp
mov eax, dword [esp + 0x10]
push eax
call ebx
mov ecx, dword [esp + 0x14]
add esp, 4
shl eax, 1
push eax
push ecx
push 1
lea edx, [esp + 0x254]
push str.Progid
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call esi
mov eax, dword [esp + 0x14]
add edi, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x434908
lea edi, [esp + 0x1c]
mov dword [esp + 0x10], 2
mov eax, dword [edi]
lea ecx, [esp + 0x248]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push str._s_sUserChoice
push 0x103
push ecx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
lea edx, [esp + 0x248]
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call ebp
mov eax, dword [esp + 0x18]
push eax
call ebx
mov ecx, dword [esp + 0x1c]
add esp, 4
shl eax, 1
push eax
push ecx
push 1
lea edx, [esp + 0x254]
push str.Progid
push edx
push reloc.DSOUND.dll_DirectSoundCreate
call esi
mov eax, dword [esp + 0x10]
add edi, 4
dec eax
mov dword [esp + 0x10], eax
jne 0x43497c
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x3c]
push ecx
push 0xa
push 2
push str.SoftwareClientsStartMenuInternet
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x850
ret