Function at 0x426716
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa70
cmp dword [ebp + 8], 0
push esi
je 0x426afc
push ebx
push edi
push 0x1c
mov esi, str.SoftwareClientsStartMenuInternet360
pop ecx
lea edi, [ebp - 0x9c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x25
mov esi, 0x43f5e4
pop ecx
lea edi, [ebp - 0x1a0]
rep movsd dword es:[edi], dword [esi]
push 0x21
mov esi, 0x43f55c
pop ecx
lea edi, [ebp - 0x44c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x24
mov esi, 0x43f4c8
pop ecx
lea edi, [ebp - 0x234]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1c
mov esi, 0x43f458
pop ecx
lea edi, [ebp - 0x344]
rep movsd dword es:[edi], dword [esi]
push 0x1b
mov esi, 0x43f3e8
pop ecx
lea edi, [ebp - 0x10c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1f
mov esi, 0x43f368
pop ecx
lea edi, [ebp - 0x3c4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x28
mov esi, str.360360
pop ecx
lea edi, [ebp - 0x2d4]
rep movsd dword es:[edi], dword [esi]
mov ebx, 0x43dd5c
lea edi, [ebp - 0x28]
mov esi, ebx
lea eax, [ebp - 0x9c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, str.360seURL
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x9c]
push eax
push 1
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push str.SOFTWARERegisteredApplications
push esi
call ebx
lea eax, [ebp - 0x2d4]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x2d4]
push eax
push 1
lea eax, [ebp - 0x9c]
push str.ApplicationDescription
push eax
push esi
call ebx
push dword [ebp + 0xc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x9c]
push dword [ebp + 0xc]
push 1
push str.ApplicationIcon
push eax
push esi
call ebx
lea eax, [ebp - 0x28]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x28]
push eax
push 1
lea eax, [ebp - 0x9c]
push str.ApplicationName
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push str..htm
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push str..html
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push str..shtml
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push str..xht
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x1a0]
push str..xhtml
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x234]
push 0x43f1d8
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x234]
push str.http
push eax
push esi
call ebx
lea eax, [ebp - 0x14]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
lea eax, [ebp - 0x234]
push str.https
push eax
push esi
call ebx
lea eax, [ebp - 0x28]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x28]
push eax
push 1
lea eax, [ebp - 0x44c]
push str.StartMenuInternet
push eax
push esi
call ebx
push dword [ebp + 0xc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x344]
push dword [ebp + 0xc]
push 1
push 0x43fcc4
push eax
push esi
call ebx
and word [ebp - 0x864], 0
mov edx, 0x82
mov ecx, edx
xor eax, eax
and word [ebp - 0x658], ax
lea edi, [ebp - 0x862]
push dword [ebp + 0xc]
and word [ebp - 0xa70], ax
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0x656]
rep stosd dword es:[edi], eax
mov ecx, edx
lea edi, [ebp - 0xa6e]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.MSVCRT.dll__snwprintf]
push str.__s___hide_icons_
lea eax, [ebp - 0x864]
push 0x104
push eax
mov dword [ebp + 8], 1
call edi
add esp, 0x10
lea eax, [ebp - 0x658]
push dword [ebp + 0xc]
push str.__s___make_default_browser_
push 0x104
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0xa70]
push dword [ebp + 0xc]
push str.__s___show_icons_
push 0x104
push eax
call edi
mov edi, dword [sym.imp.MSVCRT.dll_wcslen]
lea eax, [ebp - 0x864]
push eax
call edi
add esp, 0x14
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x864]
push eax
push 1
lea eax, [ebp - 0x10c]
push str.HideIconsCommand
push eax
push esi
call ebx
lea eax, [ebp + 8]
push 4
push eax
push 4
lea eax, [ebp - 0x10c]
push str.IconsVisible
push eax
push esi
call ebx
lea eax, [ebp - 0x658]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x658]
push eax
push 1
lea eax, [ebp - 0x10c]
push str.ReinstallCommand
push eax
push esi
call ebx
lea eax, [ebp - 0xa70]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xa70]
push eax
push 1
lea eax, [ebp - 0x10c]
push str.ShowIconsCommand
push eax
push esi
call ebx
push dword [ebp + 0xc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x3c4]
push dword [ebp + 0xc]
push 1
push 0x43fcc4
push eax
push esi
call ebx
pop edi
pop ebx
jmp 0x426b1e
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push 0x43f03c
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x43dd5c
push str.SOFTWARERegisteredApplications
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
pop esi
leave
ret