Function at 0x10068480
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10067bb0
test al, al
je 0x100686e1
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
je 0x100684b4
mov edi, str.360seURL
mov ebx, edi
mov esi, edi
jmp 0x100684c3
mov edi, str.IE.FTP
mov ebx, str.IE.HTTP
mov esi, str.IE.HTTPS
mov ecx, edi
lea edx, [ecx + 2]
jmp 0x100684d0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100684d0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edi
push 1
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_ftpUserChoice
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10068500
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push ebx
push 1
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10068530
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push esi
push 1
push str.Progid
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpsUserChoice
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.102134e7
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x10068581
mov edi, str.IE.AssocFile.HTM
mov ebx, str.IE.AssocFile.MHT
lea eax, [ebp - 0x220]
mov dword [ebp - 0x21c], str..htm
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push SysReAllocString
mov dword [ebp - 0x218], str..html
mov dword [ebp - 0x214], str..shtm
mov dword [ebp - 0x210], str..shtml
mov dword [ebp - 0x228], str..mht
mov dword [ebp - 0x224], str..mhtml
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
lea ecx, [ecx]
push dword [ebp + esi*4 - 0x21c]
lea eax, [ebp - 0x20c]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push str._s_sUserChoice
push 0x103
push eax
call fcn.10068700
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, edi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10068620
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edi
push 1
push str.Progid
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
inc esi
cmp esi, 4
jl 0x100685e0
xor esi, esi
jmp 0x10068660
push dword [ebp + esi*4 - 0x228]
lea eax, [ebp - 0x20c]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push str._s_sUserChoice
push 0x103
push eax
call fcn.10068700
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100686a0
sub eax, edx
sar eax, 1
add eax, eax
push eax
push ebx
push 1
push str.Progid
lea eax, [ebp - 0x20c]
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
inc esi
cmp esi, 2
jl 0x10068660
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10212f74
mov esp, ebp
pop ebp
ret 4