Function at 0x434e70
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x6bf644]
sub esp, 0xa30
push esi
xor esi, esi
cmp eax, esi
push edi
jne 0x4350f6
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x21a]
mov word [esp + 0x218], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], si
rep stosd dword es:[edi], eax
mov ecx, dword [0x6dcf84]
push 0x104
stosw word es:[edi], ax
lea eax, [esp + 0x834]
mov dword [esp + 0x10], 1
push eax
push ecx
mov dword [esp + 0x14], 0x208
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x628]
push 0x104
lea eax, [esp + 0x834]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
call fcn.00434d30
test eax, eax
je 0x4350f6
cmp dword [0x6dbf24], esi
je 0x435086
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x10]
push edx
push eax
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push reloc.DSOUND.dll_DirectSoundCreate
call esi
mov edi, dword [sym.imp.MSVCRT.dll__wcsicmp]
test eax, eax
jne 0x434f5a
lea ecx, [esp + 0x10]
push str.TheWorld.HTTP
push ecx
call edi
add esp, 8
test eax, eax
jne 0x4350f6
lea edx, [esp + 8]
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x4ffec0
push str.SOFTWAREClientsStartMenuInternet
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 0x103
call esi
test eax, eax
jne 0x4350f6
lea edx, [esp + 0x628]
push 0x5c
push edx
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 8
test eax, eax
je 0x4350f6
lea ecx, [esp + 0x10]
add eax, 2
push ecx
push eax
call edi
add esp, 8
test eax, eax
jne 0x4350f6
lea edx, [esp + 8]
lea eax, [esp + 0x218]
push edx
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x4ffec0
push str.SOFTWAREClientsStartMenuInternet
push reloc.DSOUND.dll_DirectSoundCreate
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x208
call esi
cmp word [esp + 0x218], 0
je 0x435013
lea edx, [esp + 0x218]
lea eax, [esp + 0x10]
push edx
push eax
call edi
add esp, 8
test eax, eax
jne 0x4350f6
lea ecx, [esp + 0x10]
lea edx, [esp + 0x420]
push ecx
push str.SOFTWAREClientsStartMenuInternet_s_shellopencommand
push 0x104
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push eax
push ecx
push edx
lea eax, [esp + 0x42c]
push 0x4ffec0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x208
call esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x628]
push ecx
push edx
call edi
add esp, 8
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
add esp, 0xa30
ret
lea eax, [esp + 8]
lea ecx, [esp + 0x218]
push eax
lea edx, [esp + 0x10]
push ecx
push edx
push 0x4ffec0
push str.htmlfile_shellopencommand
push connect
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4350f6
lea eax, [esp + 0x420]
push 0x104
lea ecx, [esp + 0x62c]
push eax
push ecx
call fcn.004343f0
lea edx, [esp + 0x42c]
lea eax, [esp + 0x224]
push edx
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 0x14
test eax, eax
jne 0x4350f6
pop edi
mov eax, 1
pop esi
add esp, 0xa30
ret
pop edi
xor eax, eax
pop esi
add esp, 0xa30
ret