Function at 0x10067230
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.100669d0
test al, al
je 0x10067491
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x10067264
mov edi, str.360seURL
mov ebx, edi
mov esi, edi
jmp 0x10067273
mov edi, str.IE.FTP
mov ebx, str.IE.HTTP
mov esi, str.IE.HTTPS
mov ecx, edi
lea edx, [ecx + 2]
jmp 0x10067280
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10067280
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edi
push 1
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_ftpUserChoice
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100672b0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push 1
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100672e0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push esi
push 1
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpsUserChoice
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x10067331
mov edi, str.IE.AssocFile.HTM
mov ebx, str.IE.AssocFile.MHT
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], str..htm
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push SysReAllocString
mov dword [ebp - 0x218], str..html
mov dword [ebp - 0x214], str..shtm
mov dword [ebp - 0x210], str..shtml
mov dword [ebp - 0x228], str..mht
mov dword [ebp - 0x224], str..mhtml
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
lea ecx, [ecx]
push dword [ebp + esi*4 - 0x21c]
lea eax, [ebp - 0x20c]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push str._s_sUserChoice
push 0x103
push eax
call fcn.101fa29f
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, edi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100673d0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edi
push 1
push str.Progid
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
inc esi
cmp esi, 4
jl 0x10067390
xor esi, esi
jmp 0x10067410
push dword [ebp + esi*4 - 0x228]
lea eax, [ebp - 0x20c]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push str._s_sUserChoice
push 0x103
push eax
call fcn.101fa29f
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10067450
sub eax, edx
sar eax, 1
add eax, eax
push eax
push ebx
push 1
push str.Progid
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
inc esi
cmp esi, 2
jl 0x10067410
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4