Function at 0x1000398e
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.10004f70
mov al, byte [0x10008acc]
push ebx
push esi
push edi
mov byte [ebp - 0x1004], al
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x1003]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, 0x800
lea eax, [ebp - 0x804]
push edi
push 0
push eax
mov dword [ebp - 4], 1
call sub.MSVCRT.dll_memset
mov ebx, dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0xc
cmp dword [ebp + 0x10], 0
mov esi, 0x7ff
je 0x100039ff
push dword [ebp + 0x10]
lea eax, [ebp - 0x1004]
push 0x100081ac
push esi
push eax
call ebx
add esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, 0xc9
cmp eax, ecx
ja 0x10003b64
je 0x10003b5a
dec eax
cmp eax, 9
ja case.default.0x10003dcd
jmp dword [eax*4 + 0x10003edf]
mov ecx, dword [0x10008abc]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 8], eax
jmp 0x10003b43
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x10003a45
push esi
call fcn.1000376e
pop ecx
cmp dword [ebp + 0xc], 1
jne 0x10003a74
push 1
call fcn.1000376e
pop ecx
mov dword [ebp + 0x10], esi
push 4
lea ecx, [ebp + 0x10]
pop eax
push eax
push ecx
push eax
push str.hideflash
push str.SoftwareyahooAssistantAssistOptions
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov eax, dword [0x10008abc]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 4], ecx
jmp 0x10003b43
mov ecx, dword [0x10008abc]
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x10003b43
mov ecx, dword [0x10008abc]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x20], eax
jmp 0x10003b43
mov ecx, dword [0x10008abc]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x24], eax
jmp 0x10003b43
mov ecx, dword [0x10008abc]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0xc], eax
jmp 0x10003b43
mov ecx, dword [0x10008abc]
mov eax, dword [ebp + 0xc]
mov dword [ecx + 0x10], eax
jmp 0x10003b43
push 4
lea ecx, [ebp + 0xc]
pop eax
push eax
push ecx
push eax
push str.hideflash
push str.SoftwareyahooAssistantAssistOptions
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
jmp 0x10003e8c
lea eax, [ebp - 0x1004]
push 0x10008724
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x10003e8c
mov esi, dword [sym.imp.MSVCRT.dll_atoi]
and byte [edi], 0
lea eax, [ebp - 0x1004]
push eax
call esi
inc edi
mov dword [ebp + 0x10], eax
push edi
call esi
pop ecx
pop ecx
movzx ecx, word [ebp + 0x10]
movzx eax, ax
shl ecx, 0x10
or eax, ecx
mov ecx, dword [0x10008abc]
mov dword [ecx + 0x18], eax
call fcn.10001fa4
jmp 0x10003e8c
push dword [ebp + 0xc]
call fcn.1000380d
jmp 0x10003e8b
mov ecx, 0x10008c98
jmp 0x10003cfb
mov ecx, 0x1f5
cmp eax, ecx
ja 0x10003dac
je 0x10003d9f
add eax, 0xffffff36
cmp eax, 0x12
ja case.default.0x10003dcd
jmp dword [eax*4 + 0x10003f07]
mov esi, 0x10008c98
jmp 0x10003d12
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.MSVCRT.dll__strlwr]
pop ecx
push eax
mov ecx, 0x10008c98
call fcn.10004ab0
test eax, eax
jne 0x10003bd4
push 3
pop esi
jmp 0x10003e93
lea eax, [ebp - 0x1004]
mov ecx, 0x10008c98
push eax
call fcn.10004b39
test eax, eax
je 0x10003e90
push str._URLCUSTOM_INCLUDE_
push str.eheulic.dat
jmp 0x10003d84
mov ecx, 0x10008c88
jmp 0x10003cfb
mov esi, 0x10008c88
jmp 0x10003d12
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.MSVCRT.dll__strlwr]
pop ecx
push eax
mov ecx, 0x10008c88
call fcn.10004ab0
test eax, eax
je 0x10003bb3
push str._URLCUSTOM_EXCLUDE_
push str.eheulec.dat
jmp 0x10003d84
lea eax, [ebp - 0x1004]
mov ecx, 0x10008c88
push eax
call fcn.10004b39
test eax, eax
je 0x10003e90
jmp 0x10003c14
mov ecx, 0x10008c78
jmp 0x10003cfb
mov esi, 0x10008c78
jmp 0x10003d12
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.MSVCRT.dll__strlwr]
pop ecx
push eax
mov ecx, 0x10008c78
call fcn.10004ab0
test eax, eax
je 0x10003bb3
push str._TITLECUSTOM_INCLUDE_
push str.ehetlic.dat
jmp 0x10003d84
lea eax, [ebp - 0x1004]
mov ecx, 0x10008c78
push eax
call fcn.10004b39
test eax, eax
je 0x10003e90
jmp 0x10003c73
mov ecx, 0x10008c68
jmp 0x10003cfb
mov esi, 0x10008c68
jmp 0x10003d12
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.MSVCRT.dll__strlwr]
pop ecx
push eax
mov ecx, 0x10008c68
call fcn.10004ab0
test eax, eax
je 0x10003bb3
push str._TITLECUSTOM_EXCLUDE_
push str.ehetlec.dat
jmp 0x10003d84
lea eax, [ebp - 0x1004]
mov ecx, 0x10008c68
push eax
call fcn.10004b39
test eax, eax
je 0x10003e90
jmp 0x10003ccc
mov ecx, 0x10008c08
call fcn.10004c30
test eax, eax
je 0x10003e90
jmp 0x10003e8c
mov esi, 0x10008c08
mov ecx, esi
call fcn.10004c23
test eax, eax
jne 0x10003d24
push 2
jmp 0x10003bb5
push eax
lea eax, [ebp - 0x804]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
mov ecx, esi
call fcn.10004c3f
jmp 0x10003e8c
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.MSVCRT.dll__strlwr]
pop ecx
push eax
mov ecx, 0x10008c08
call fcn.10004ab0
test eax, eax
jne 0x10003d7a
jmp 0x10003bb3
lea eax, [ebp - 0x1004]
mov ecx, 0x10008c08
push eax
call fcn.10004b39
test eax, eax
je 0x10003e90
push str._SEXURL_BYCUSTOM_
push str.ehecsq.dat
call fcn.100047f6
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x10008abc]
mov dword [ecx + 0x14], eax
jmp 0x10003e8c
mov eax, dword [0x10008abc]
push dword [eax + 8]
jmp 0x10003e44
mov ecx, 0x3e7
cmp eax, ecx
ja case.default.0x10003dcd
je 0x10003ec4
add eax, 0xfffffe0a
cmp eax, 8
ja case.default.0x10003dcd
jmp dword [eax*4 + 0x10003f53]
mov eax, dword [0x10008abc]
push dword [eax + 4]
jmp 0x10003e44
mov eax, dword [0x10008abc]
push dword [eax]
jmp 0x10003e44
mov eax, dword [0x10008abc]
push dword [eax + 0x20]
jmp 0x10003e44
mov eax, dword [0x10008abc]
push dword [eax + 0x24]
jmp 0x10003e44
mov eax, dword [0x10008abc]
push dword [eax + 0xc]
jmp 0x10003e44
mov eax, dword [0x10008abc]
push dword [eax + 0x10]
jmp 0x10003e44
push 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp + 8], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 4]
push eax
push str.hideflash
push str.SoftwareyahooAssistantAssistOptions
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x10003e41
and dword [ebp + 0x10], 0
push dword [ebp + 0x10]
push 0x100081b0
lea eax, [ebp - 0x804]
push esi
push eax
call ebx
add esp, 0x10
jmp 0x10003e8c
mov eax, dword [0x10008abc]
movzx ecx, word [eax + 0x18]
mov eax, dword [eax + 0x18]
push ecx
shr eax, 0x10
push eax
push str._d__d
lea eax, [ebp - 0x804]
push esi
push eax
call ebx
add esp, 0x14
jmp 0x10003e8c
lea eax, [ebp - 0x804]
push edi
push eax
call fcn.1000377c
pop ecx
pop ecx
xor esi, esi
jmp 0x10003e93
mov esi, dword [ebp - 4]
lea eax, [ebp - 0x804]
push eax
call sub.MSVCRT.dll_strlen
cmp dword [ebp + 0x14], 0
pop ecx
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
je 0x10003ec0
lea ecx, [ebp - 0x804]
push ecx
push 0x100081ac
push eax
push dword [ebp + 0x14]
call ebx
add esp, 0x10
mov eax, esi
jmp 0x10003eda
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0xc]
call fcn.10003858
add esp, 0xc
jmp 0x10003eda
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret