Function at 0x411d52
Capabilities:
Delete registry key
Set registry value

Disassembly:
push esi
call fcn.00411d9f
call fcn.00412612
push 0x18
push str.IEXPLORE.EXE
push 1
push 0x543da0
mov esi, str.SOFTWAREClientsStartMenuInternet
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push esi
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
call fcn.00411fe3
call fcn.00452c1a
cmp dword [eax], 3
jl 0x411d9d
pop esi
jmp 0x41213a
pop esi
ret
push ebp
lea ebp, [esp - 0x1b8]
sub esp, 0x238
mov eax, dword [0x58569c]
xor eax, ebp
mov dword [ebp + 0x1b4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0xc
push str.IE.FTP
push 1
mov ebx, str.Progid
push ebx
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociations_ftpUserChoice
mov esi, 0x80000001
push esi
call edi
push 0xe
push str.IE.HTTP
push 1
push ebx
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
push esi
call edi
push 0x10
push str.IE.HTTPS
push 1
push ebx
push str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpsUserChoice
push esi
call edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x52]
push eax
call fcn.00506540
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push esi
mov dword [ebp - 0x80], str..htm
mov dword [ebp - 0x7c], str..html
mov dword [ebp - 0x78], str..shtm
mov dword [ebp - 0x74], str..shtml
mov dword [ebp - 0x70], str..mht
mov dword [ebp - 0x6c], str..mhtml
mov dword [ebp - 0x68], str..mhtm
mov dword [ebp - 0x64], str..xht
mov dword [ebp - 0x60], str..xhtml
call dword [0x52b010]
and dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x58]
push dword [ebp + eax*4 - 0x80]
lea eax, [ebp - 0x54]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push str._s_sUserChoice
push 0x103
push eax
call fcn.004ff336
add esp, 0x14
lea eax, [ebp - 0x54]
push eax
push esi
call dword [0x52b008]
push 0x20
push str.IE.AssocFile.HTM
push 1
push ebx
lea eax, [ebp - 0x54]
push eax
push esi
call edi
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 4
jl 0x412210
and dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x58]
push dword [ebp + eax*4 - 0x70]
lea eax, [ebp - 0x54]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push str._s_sUserChoice
push 0x103
push eax
call fcn.004ff336
add esp, 0x14
lea eax, [ebp - 0x54]
push eax
push esi
call dword [0x52b008]
push 0x20
push str.IE.AssocFile.MHT
push 1
push ebx
lea eax, [ebp - 0x54]
push eax
push esi
call edi
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 3
jl 0x41225b
and dword [ebp - 0x58], 0
mov eax, dword [ebp - 0x58]
push dword [ebp + eax*4 - 0x64]
lea eax, [ebp - 0x54]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts
push str._s_sUserChoice
push 0x103
push eax
call fcn.004ff336
add esp, 0x14
lea eax, [ebp - 0x54]
push eax
push esi
call dword [0x52b008]
push 0x20
push str.IE.AssocFile.XHT
push 1
push ebx
lea eax, [ebp - 0x54]
push eax
push esi
call edi
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 2
jl 0x4122a6
push dword [ebp - 0x5c]
call dword [0x52b018]
mov ecx, dword [ebp + 0x1b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fe191
add ebp, 0x1b8
leave
ret