Function at 0x40f7f6
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x209c
call fcn.0041e510
push ebx
push esi
mov ebx, ecx
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push edi
xor edi, edi
push dword [ebx + 0xc]
push edi
push str.IsSave
push str.AddUnstall
call esi
test eax, eax
jne 0x40fb64
mov eax, dword [ebx + 4]
cmp dword [eax + 8], edi
jne 0x40fb64
mov word [ebp - 0x1054], di
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x1052]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 1
lea eax, [ebp - 8]
pop edi
mov dword [ebp - 8], 0x824
push eax
lea eax, [ebp - 0x1054]
push eax
lea eax, [ebp - 0xc]
push eax
push str.Start_Page
push str.SoftwareMicrosoftInternet_ExplorerMain
push SysReAllocString
mov dword [ebp - 0xc], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [0x424504]
mov ecx, ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.00410d1e
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ecx - 8], eax
je 0x40f8ad
cmp dword [0x42b324], eax
jne 0x40f8aa
cmp dword [0x42b32c], eax
je 0x40f8ad
mov dword [ebx + 0x6c], edi
cmp dword [ebx + 0x6c], eax
jne 0x40fa04
cmp word [ebp - 0x1054], ax
je 0x40f8d7
lea eax, [ebp - 0x1054]
push str.about:blank
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
pop ecx
test eax, eax
pop ecx
jne 0x40f901
mov esi, str.http:__hao.360.cn_
lea edi, [ebx + 0x64]
mov eax, esi
test eax, eax
je 0x40f8ec
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
mov ecx, edi
call fcn.00406047
mov dword [ebx + 0x5c], 3
jmp 0x40fb05
xor eax, eax
cmp dword [ebx + 0x6c], eax
jne 0x40fa04
lea ecx, [ebp - 0x1054]
lea esi, [ebx + 0x68]
test ecx, ecx
jne 0x40f921
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x40f930
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x1054]
push eax
call edi
lea ecx, [ebp - 0x1054]
push ecx
push eax
mov ecx, esi
call fcn.00406047
lea eax, [ebp - 0x1054]
mov ecx, ebx
push eax
call fcn.0040f561
test eax, eax
jne 0x40f8f5
mov esi, str.http:__hao.360.cn_
lea eax, [ebp - 0x1054]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x40f987
mov eax, esi
test eax, eax
je 0x40f971
push esi
call edi
push esi
push eax
lea ecx, [ebx + 0x64]
call fcn.00406047
mov dword [ebx + 0x5c], 4
jmp 0x40fb05
xor eax, eax
mov ecx, esi
cmp dword [ebx + 0x20], eax
jne 0x40f9a3
test ecx, ecx
je 0x40f997
push esi
call edi
push esi
push eax
lea ecx, [ebx + 0x64]
call fcn.00406047
jmp 0x40f9f8
test ecx, ecx
je 0x40f9aa
push esi
call edi
push esi
push eax
lea ecx, [ebx + 0x64]
call fcn.00406047
mov edi, 0x428b6c
mov eax, edi
test eax, eax
je 0x40f9c6
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [ebx + 0x64]
push edi
push eax
mov ecx, esi
call fcn.0040854e
lea eax, [ebp - 0x1054]
test eax, eax
je 0x40f9e9
lea eax, [ebp - 0x1054]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x1054]
push ecx
push eax
mov ecx, esi
call fcn.0040854e
mov dword [ebx + 0x5c], 1
jmp 0x40fb05
lea ecx, [ebp - 0x1054]
lea esi, [ebx + 0x68]
test ecx, ecx
je 0x40fa1e
lea eax, [ebp - 0x1054]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x1054]
push ecx
push eax
mov ecx, esi
call fcn.00406047
mov edi, 0x428b6c
mov eax, edi
test eax, eax
je 0x40fa3f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push eax
mov ecx, esi
call fcn.0040854e
mov eax, dword [ebp - 4]
mov ecx, esi
push eax
push dword [eax - 8]
call fcn.0040854e
mov esi, str.http:__hao.360.cn_
lea eax, [ebp - 0x1054]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x40fb12
push eax
push esi
lea ecx, [ebp - 4]
call fcn.00407351
cmp eax, 0xffffffff
jne 0x40fb12
mov eax, esi
test eax, eax
je 0x40fa91
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
lea ecx, [ebx + 0x64]
call fcn.00406047
mov eax, edi
test eax, eax
je 0x40faa8
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [ebx + 0x64]
push edi
push eax
mov ecx, esi
call fcn.0040854e
lea eax, [ebp - 0x1054]
test eax, eax
je 0x40facb
lea eax, [ebp - 0x1054]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x1054]
push ecx
push eax
mov ecx, esi
call fcn.0040854e
mov eax, edi
test eax, eax
je 0x40fae7
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push eax
mov ecx, esi
call fcn.0040854e
mov eax, dword [ebp - 4]
mov ecx, esi
push eax
push dword [eax - 8]
call fcn.0040854e
mov dword [ebx + 0x5c], 5
lea ecx, [ebp - 4]
call fcn.00403e0f
jmp 0x40fca5
lea eax, [ebp - 0x1054]
lea esi, [ebx + 0x64]
test eax, eax
je 0x40fb2c
lea eax, [ebp - 0x1054]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x1054]
push ecx
push eax
mov ecx, esi
call fcn.00406047
mov eax, edi
test eax, eax
je 0x40fb48
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push eax
mov ecx, esi
call fcn.0040854e
mov eax, dword [ebp - 4]
mov ecx, esi
push eax
push dword [eax - 8]
call fcn.0040854e
jmp 0x40f97b
mov word [ebp - 0x209c], di
mov ecx, 0x823
xor eax, eax
lea edi, [ebp - 0x209a]
push dword [ebx + 0xc]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x209c]
push 0x1047
push eax
push 0x42b2ec
mov edi, str.option
push str.HomePage
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [ebx + 0xc]
push 0
push str.IE6Mode
push edi
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov dword [ebp - 4], eax
mov esi, str.http:__hao.360.cn_
lea eax, [ebp - 0x209c]
push esi
push eax
call edi
test eax, eax
jne 0x40fc55
lea eax, [ebp - 0x209c]
push str.hao.360.cn
push eax
call edi
test eax, eax
jne 0x40fc55
push 1
lea edi, [ebx + 0x64]
pop eax
cmp dword [ebp - 4], eax
mov dword [ebx + 0x5c], eax
mov eax, esi
je 0x40fc91
test eax, eax
je 0x40fbff
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
mov ecx, edi
call fcn.00406047
mov edi, 0x428b6c
mov eax, edi
test eax, eax
je 0x40fc1a
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [ebx + 0x64]
push edi
push eax
mov ecx, esi
call fcn.0040854e
lea eax, [ebp - 0x209c]
test eax, eax
je 0x40fc3d
lea eax, [ebp - 0x209c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp - 0x209c]
push ecx
push eax
mov ecx, esi
call fcn.0040854e
mov dword [ebx + 0x5c], 5
jmp 0x40fca5
mov edi, dword [sym.imp.MSVCRT.dll__wcsicmp]
lea eax, [ebp - 0x209c]
push esi
push eax
mov dword [ebx + 0x5c], 2
call edi
pop ecx
test eax, eax
pop ecx
jne 0x40fc86
lea eax, [ebp - 0x209c]
push str.hao.360.cn
push eax
call edi
pop ecx
test eax, eax
pop ecx
je 0x40fca5
cmp dword [ebp - 4], 1
jne 0x40fca5
lea edi, [ebx + 0x64]
mov eax, esi
test eax, eax
je 0x40fc9c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push eax
mov ecx, edi
call fcn.00406047
pop edi
pop esi
pop ebx
leave
ret