Function at 0x434df0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x24c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x25c]
push edi
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
shl eax, 1
push eax
push esi
push 1
push 0x500df0
push str.CLSID0002DF01_0000_0000_C000_000000000046LocalServer32
push closesocket
call ebx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x56]
mov word [esp + 0x54], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x54]
push 0x104
push eax
push esi
call fcn.004347c0
add esp, 0xc
push 0x10
push str.htmlfile
push 1
push 0x500df0
push str..htm
push closesocket
call ebx
push 0x10
push str.htmlfile
push 1
push 0x500df0
push 0x4ef3d0
push closesocket
call ebx
push 0x10
push str.htmlfile
push 1
push 0x500df0
push str..shtm
push closesocket
call ebx
push 0x10
push str.htmlfile
push 1
push 0x500df0
push str..shtml
push closesocket
call ebx
push 8
push str.open
push 1
push 0x500df0
push str.htmlfile_shell
push closesocket
call ebx
mov ebp, dword [esp + 0x264]
lea ecx, [esp + 0x54]
push ecx
push ebp
push str.htmlfile_shell
call fcn.004347e0
add esp, 0xc
push 0x20
push str.InternetShortcut
push 1
push 0x500df0
push 0x4ed8c4
push closesocket
call ebx
lea edx, [esp + 0x54]
push edx
push ebp
push str.InternetShortcut_shell
call fcn.004347e0
add esp, 0xc
push 0x12
push str.mhtmlfile
push 1
push 0x500df0
push str..mht
push closesocket
call ebx
push 0x12
push str.mhtmlfile
push 1
push 0x500df0
push str..mhtml
push closesocket
call ebx
lea eax, [esp + 0x54]
push eax
push ebp
push str.mhtmlfile_shell
call fcn.004347e0
lea ecx, [esp + 0x60]
push ecx
push ebp
push str.http_shell
call fcn.004347e0
lea edx, [esp + 0x6c]
push edx
push ebp
push str.https_shell
call fcn.004347e0
add esp, 0x24
lea eax, [esp + 0x14]
mov ecx, 0x10
mov esi, str._SystemRoot__system32url.dll_0
push 0x40
push eax
push 2
lea edi, [esp + 0x20]
push 0x500df0
push str.httpDefaultIcon
rep movsd dword es:[edi], dword [esi]
push closesocket
call ebx
lea ecx, [esp + 0x14]
push 0x40
push ecx
push 2
push 0x500df0
push str.httpsDefaultIcon
push closesocket
call ebx
lea edx, [esp + 0x54]
push edx
push ebp
push str.file_shell
call fcn.004347e0
push 0x4eeb30
push ebp
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 0x14
test eax, eax
je 0x434ffb
lea eax, [esp + 0x54]
push eax
push ebp
push str.ftp_shell
call fcn.004347e0
add esp, 0xc
push 0x10
push str.htmlfile
push 1
push 0x500df0
push str.SOFTWAREClasses.htm
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push 0x10
push str.htmlfile
push 1
push 0x500df0
push str.SOFTWAREClasses.html
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push 0x10
push str.htmlfile
push 1
push 0x500df0
push str.SOFTWAREClasses.shtm
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push 0x10
push str.htmlfile
push 1
push 0x500df0
push str.SOFTWAREClasses.shtml
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push 0x12
push str.mhtmlfile
push 1
push 0x500df0
push str.SOFTWAREClasses.mht
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
push 0x12
push str.mhtmlfile
push 1
push 0x500df0
push str.SOFTWAREClasses.mhtml
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
lea ecx, [esp + 0x10]
push ecx
push 0xa
push 2
push str.SoftwareClientsStartMenuInternet
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24c
ret