Function at 0x4098d0
Capabilities:
Delete registry key
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x428b78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], ebx
mov eax, dword [0x4346e4]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x54], 1
push ecx
mov ecx, esi
call fcn.0040a940
test eax, eax
je 0x40a5b9
push 1
mov ecx, esi
call fcn.0040aa50
mov edx, dword [esp + 0x14]
cmp dword [edx - 8], ebx
jne 0x409ac4
push 0x433a18
lea ecx, [esp + 0x18]
call fcn.0041f0dc
lea eax, [esp + 0x24]
push 8
push eax
mov ecx, esi
call fcn.0040afe0
push 0x433a14
lea ecx, [esp + 0x20]
push eax
push ecx
mov byte [esp + 0x60], 2
call fcn.0041f1e8
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x58], 3
call fcn.0041f36b
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 2
call fcn.0041ef53
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 1
call fcn.0041ef53
lea edx, [esp + 0x1c]
push 4
push edx
mov ecx, esi
call fcn.0040afe0
push 0x433a14
push eax
lea eax, [esp + 0x2c]
mov byte [esp + 0x5c], 4
push eax
call fcn.0041f1e8
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x58], 5
call fcn.0041f36b
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 4
call fcn.0041ef53
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 1
call fcn.0041ef53
lea ecx, [esp + 0x1c]
push 4
push ecx
mov ecx, esi
call fcn.0040afe0
push 0x433a14
lea edx, [esp + 0x28]
push eax
push edx
mov byte [esp + 0x60], 6
call fcn.0041f1e8
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x58], 7
call fcn.0041f36b
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 6
call fcn.0041ef53
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 1
call fcn.0041ef53
lea eax, [esp + 0x1c]
push 4
push eax
mov ecx, esi
call fcn.0040afe0
push 0x433a14
mov byte [esp + 0x58], 8
push eax
lea ecx, [esp + 0x2c]
push ecx
call fcn.0041f1e8
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x58], 9
call fcn.0041f36b
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 8
call fcn.0041ef53
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 1
call fcn.0041ef53
lea edx, [esp + 0x1c]
push 0xc
push edx
mov ecx, esi
call fcn.0040afe0
push 0x433a10
push eax
lea eax, [esp + 0x2c]
mov byte [esp + 0x5c], 0xa
push eax
call fcn.0041f1e8
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x58], 0xb
call fcn.0041f36b
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 0xa
call fcn.0041ef53
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 1
call fcn.0041ef53
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 0x1c]
push ecx
push 0xf003f
push ebx
push str.SOFTWAREKingsaft
push 0x80000002
mov dword [esp + 0x30], ebx
call ebp
cmp eax, ebx
jne 0x409b06
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebx
je 0x409afa
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x1c]
cmp eax, ebx
mov dword [esp + 0x10], edx
je 0x409b4e
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x1c]
push eax
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWAREKingsaft
push 0x80000002
mov dword [esp + 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x409b84
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp ecx, ebx
je 0x409b42
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x1c]
cmp eax, ebx
mov dword [esp + 0x10], edx
jne 0x409b84
mov eax, dword [esp + 0x14]
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov eax, dword [esp + 0x14]
push edi
push 1
push ebx
push 0x433a0c
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x409b84
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
mov ecx, dword [0x4346e4]
mov dword [esp + 0x20], ecx
push str.ZVI_DUHcJsdzzhzcJSZLK
lea ecx, [esp + 0x1c]
mov byte [esp + 0x58], 0xc
call fcn.0041efc1
push 5
push ebx
lea edx, [esp + 0x20]
push 2
push edx
mov ecx, esi
mov byte [esp + 0x64], 0xd
call fcn.0040b3c0
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
push 0xf003f
push ebx
push ecx
push 0x80000002
mov dword [esp + 0x30], ebx
call ebp
cmp eax, ebx
jne 0x409c01
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x409bf1
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x10], edx
jmp 0x409c07
mov edx, dword [esp + 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], edx
jmp 0x409c07
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push eax
push ecx
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 0xe
call fcn.0040a8a0
cmp eax, ebx
jne 0x409c51
push str.Internet_Explorer
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x1c]
inc eax
push eax
push str.Internet_Explorer
push 1
push ebx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0xd
call fcn.00402460
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x409c6e
push eax
call edi
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x18]
push 0x4322a8
lea ecx, [esp + 0x2c]
push eax
push ecx
call fcn.0041f1e8
lea edx, [esp + 0x14]
mov byte [esp + 0x54], 0xf
push edx
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0041f182
mov eax, dword [eax]
lea ecx, [esp + 0x1c]
push ecx
push 0xf003f
push ebx
push eax
push 0x80000002
mov dword [esp + 0x30], ebx
call ebp
cmp eax, ebx
jne 0x409cc7
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x409cbf
push eax
call edi
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x10], edx
lea ecx, [esp + 0x24]
call fcn.0041ef53
lea ecx, [esp + 0x28]
mov byte [esp + 0x54], 0xd
call fcn.0041ef53
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x10]
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push str.Shell
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 0x10
call fcn.0040a8a0
cmp eax, ebx
jne 0x409d28
push 0x438170
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x1c]
inc eax
push eax
push 0x438170
push 1
push ebx
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0xd
call fcn.00402460
mov dword [esp + 0x1c], ebx
mov edx, dword [esp + 0x10]
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push str.ShellFolder
push edx
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 0x11
call fcn.0040a8a0
cmp eax, ebx
jne 0x409d6e
push ebx
push 0x438170
lea ecx, [esp + 0x24]
call fcn.0040a910
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0xd
call fcn.00402460
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x409d8b
push eax
call edi
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x18]
push 0x4322a8
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.0041f1e8
lea edx, [esp + 0x14]
mov byte [esp + 0x54], 0x12
push edx
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.0041f182
push 0x4339bc
lea ecx, [esp + 0x2c]
push eax
push ecx
mov byte [esp + 0x60], 0x13
call fcn.0041f1e8
mov eax, dword [eax]
lea edx, [esp + 0x1c]
push edx
push 0xf003f
push ebx
push eax
push 0x80000002
mov byte [esp + 0x68], 0x14
mov dword [esp + 0x30], ebx
call ebp
cmp eax, ebx
jne 0x409dfc
lea ecx, [esp + 0x10]
call fcn.00402460
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x28]
mov byte [esp + 0x54], 0x13
call fcn.0041ef53
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 0x12
call fcn.0041ef53
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 0xd
call fcn.0041ef53
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x2c]
push 4
push ecx
push 4
push ebx
push str.Attributes
push edx
mov dword [esp + 0x44], 0x10
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x409e57
push eax
call edi
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x18]
push 0x4322a8
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.0041f1e8
lea edx, [esp + 0x14]
mov byte [esp + 0x54], 0x15
push edx
push eax
lea eax, [esp + 0x30]
push eax
call fcn.0041f182
push 0x4339a8
lea ecx, [esp + 0x30]
push eax
push ecx
mov byte [esp + 0x60], 0x16
call fcn.0041f1e8
mov eax, dword [eax]
lea edx, [esp + 0x1c]
push edx
push 0xf003f
push ebx
push eax
push 0x80000002
mov byte [esp + 0x68], 0x17
mov dword [esp + 0x30], ebx
call ebp
cmp eax, ebx
jne 0x409ec8
lea ecx, [esp + 0x10]
call fcn.00402460
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 0x16
call fcn.0041ef53
lea ecx, [esp + 0x28]
mov byte [esp + 0x54], 0x15
call fcn.0041ef53
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 0xd
call fcn.0041ef53
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x10]
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push 0x4321ac
push ecx
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 0x18
call fcn.0040a8a0
cmp eax, ebx
jne 0x409f2a
push ebx
push 0x43399c
lea ecx, [esp + 0x24]
call fcn.0040a910
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0xd
call fcn.00402460
mov dword [esp + 0x1c], ebx
mov edx, dword [esp + 0x10]
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push str.Open
push edx
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 0x19
call fcn.0040a8a0
cmp eax, ebx
jne 0x409f70
push ebx
push 0x433984
lea ecx, [esp + 0x24]
call fcn.0040a910
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0xd
call fcn.00402460
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x10]
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push 0x433978
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 0x1a
call fcn.0040a8a0
cmp eax, ebx
jne 0x409fb6
push ebx
push 0x438170
lea ecx, [esp + 0x24]
call fcn.0040a910
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0xd
call fcn.00402460
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x409fd3
push eax
call edi
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x18]
push 0x4322a8
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.0041f1e8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x28]
push ecx
push eax
push edx
mov byte [esp + 0x60], 0x1b
call fcn.0041f182
push str.ShellOpen
push eax
lea eax, [esp + 0x34]
mov byte [esp + 0x5c], 0x1c
push eax
call fcn.0041f1e8
mov eax, dword [eax]
lea ecx, [esp + 0x1c]
push ecx
push 0xf003f
push ebx
push eax
push 0x80000002
mov byte [esp + 0x68], 0x1d
mov dword [esp + 0x30], ebx
call ebp
cmp eax, ebx
jne 0x40a044
lea ecx, [esp + 0x10]
call fcn.00402460
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x10], edx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 0x1c
call fcn.0041ef53
lea ecx, [esp + 0x28]
mov byte [esp + 0x54], 0x1b
call fcn.0041ef53
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 0xd
call fcn.0041ef53
mov edi, dword [esi + 0x18]
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x10]
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push str.Command
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 0x1e
call fcn.0040a8a0
cmp eax, ebx
jne 0x40a0a5
push ebx
push edi
lea ecx, [esp + 0x24]
call fcn.0040a910
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0xd
call fcn.00402460
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40a0ca
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
mov dword [esp + 0x10], ebx
jmp 0x40a0d0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
push 0x4322a8
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.0041f1e8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x28]
push ecx
push eax
push edx
mov byte [esp + 0x60], 0x1f
call fcn.0041f182
push str.ShellD
push eax
lea eax, [esp + 0x34]
mov byte [esp + 0x5c], 0x20
push eax
call fcn.0041f1e8
mov eax, dword [eax]
lea ecx, [esp + 0x1c]
push ecx
push 0xf003f
push ebx
push eax
push 0x80000002
mov byte [esp + 0x68], 0x21
mov dword [esp + 0x30], ebx
call ebp
cmp eax, ebx
jne 0x40a141
lea ecx, [esp + 0x10]
call fcn.00402460
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x10], edx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 0x20
call fcn.0041ef53
lea ecx, [esp + 0x28]
mov byte [esp + 0x54], 0x1f
call fcn.0041ef53
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 0xd
call fcn.0041ef53
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x10]
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push str.Command
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 0x22
call fcn.0040a8a0
cmp eax, ebx
jne 0x40a1a3
push ebx
push str.Rundll32.exe
lea ecx, [esp + 0x24]
call fcn.0040a910
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0xd
call fcn.00402460
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40a1c0
push eax
call edi
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x18]
push 0x4322a8
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.0041f1e8
lea ecx, [esp + 0x14]
lea edx, [esp + 0x28]
push ecx
push eax
push edx
mov byte [esp + 0x60], 0x23
call fcn.0041f182
push str.Shell_
push eax
lea eax, [esp + 0x34]
mov byte [esp + 0x5c], 0x24
push eax
call fcn.0041f1e8
mov eax, dword [eax]
lea ecx, [esp + 0x1c]
push ecx
push 0xf003f
push ebx
push eax
push 0x80000002
mov byte [esp + 0x68], 0x25
mov dword [esp + 0x30], ebx
call ebp
cmp eax, ebx
jne 0x40a231
lea ecx, [esp + 0x10]
call fcn.00402460
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x10], edx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 0x24
call fcn.0041ef53
lea ecx, [esp + 0x28]
mov byte [esp + 0x54], 0x23
call fcn.0041ef53
lea ecx, [esp + 0x24]
mov byte [esp + 0x54], 0xd
call fcn.0041ef53
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x10]
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push str.Command
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 0x26
call fcn.0040a8a0
cmp eax, ebx
jne 0x40a293
push ebx
push str.Rundll32.exe_Shell32.dll_Control_RunDLL_Inetcpl.cpl
lea ecx, [esp + 0x24]
call fcn.0040a910
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0xd
call fcn.00402460
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40a2b0
push eax
call edi
mov dword [esp + 0x10], ebx
push str._WHZ_ETIbQmktwwhzb_mpjw
lea ecx, [esp + 0x1c]
call fcn.0041f0dc
push 5
push ebx
lea ecx, [esp + 0x20]
push 3
push ecx
mov ecx, esi
call fcn.0040b3c0
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push 0xf003f
push ebx
push eax
push 0x80000002
mov dword [esp + 0x30], ebx
call ebp
cmp eax, ebx
jne 0x40a2ff
lea ecx, [esp + 0x10]
call fcn.00402460
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
lea edx, [esp + 0x2c]
mov ecx, esi
push edx
call fcn.0040b0f0
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x58], 0x27
call fcn.0041f08c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 0xd
call fcn.0041ef53
mov edi, dword [esp + 0x20]
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push eax
push ecx
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 0x28
call fcn.0040a8a0
cmp eax, ebx
jne 0x40a360
push ebx
push edi
lea ecx, [esp + 0x24]
call fcn.0040a910
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0xd
call fcn.00402460
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40a381
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
lea edx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push edx
push 0xf003f
push ebx
push str.CLSID
push 0x80000000
call ebp
cmp eax, ebx
jne 0x40a3b1
lea ecx, [esp + 0x10]
call fcn.00402460
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push ecx
push edx
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 0x29
call fcn.0040a8a0
cmp eax, ebx
jne 0x40a3e9
push ebx
push str.Internet_Explorer
lea ecx, [esp + 0x24]
call fcn.0040a910
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0xd
call fcn.00402460
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40a40a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x14]
lea ecx, [esp + 0x2c]
push eax
push str.CLSID_
push ecx
call fcn.0041f25c
mov eax, dword [eax]
lea edx, [esp + 0x1c]
push edx
push 0xf003f
push ebx
push eax
push 0x80000000
mov byte [esp + 0x68], 0x2a
mov dword [esp + 0x30], ebx
call ebp
cmp eax, ebx
jne 0x40a451
lea ecx, [esp + 0x10]
call fcn.00402460
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 0xd
call fcn.0041ef53
lea ecx, [esp + 0x30]
call fcn.0040dcaa
add esi, 0x118
push str.windows_system32iexplore.exe
lea ecx, [esp + 0x30]
push esi
push ecx
mov byte [esp + 0x60], 0x2b
call fcn.0041f1e8
mov eax, dword [eax]
push ebx
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x5c], 0x2c
call fcn.0040dd6d
lea ecx, [esp + 0x2c]
mov edi, eax
mov byte [esp + 0x54], 0x2b
call fcn.0041ef53
cmp edi, ebx
je 0x40a508
push str.windows_system32iexplore.exe__32528
lea edx, [esp + 0x30]
push esi
push edx
call fcn.0041f1e8
mov esi, dword [eax]
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x10]
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push str.DefaultIcon
push eax
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 0x2e
call fcn.0040a8a0
cmp eax, ebx
jne 0x40a4ef
push ebx
push esi
lea ecx, [esp + 0x24]
call fcn.0040a910
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0x2d
call fcn.00402460
mov byte [esp + 0x54], 0x2b
lea ecx, [esp + 0x2c]
jmp 0x40a565
push str.Program_FilesInternet_Exploreriexplore.exe__32528
lea ecx, [esp + 0x30]
push esi
push ecx
call fcn.0041f1e8
mov esi, dword [eax]
mov dword [esp + 0x1c], ebx
mov edx, dword [esp + 0x10]
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push str.DefaultIcon
push edx
lea ecx, [esp + 0x38]
mov byte [esp + 0x70], 0x30
call fcn.0040a8a0
cmp eax, ebx
jne 0x40a54e
push ebx
push esi
lea ecx, [esp + 0x24]
call fcn.0040a910
lea ecx, [esp + 0x1c]
mov byte [esp + 0x54], 0x2f
call fcn.00402460
mov byte [esp + 0x54], 0x2b
lea ecx, [esp + 0x2c]
call fcn.0041ef53
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40a57d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
push ebx
push ebx
push 0x2000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
lea ecx, [esp + 0x30]
mov byte [esp + 0x54], 0xd
call fcn.0040dce7
lea ecx, [esp + 0x18]
mov byte [esp + 0x54], 0xc
call fcn.0041ef53
mov byte [esp + 0x54], 1
lea ecx, [esp + 0x20]
jmp 0x40a863
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x20]
push eax
push 0xf003f
push ebx
push str.SOFTWAREKingsaft
push 0x80000002
mov dword [esp + 0x34], ebx
call ebp
cmp eax, ebx
jne 0x40a5f3
lea ecx, [esp + 0x10]
call fcn.00402460
mov ecx, dword [esp + 0x20]
cmp eax, ebx
mov dword [esp + 0x10], ecx
je 0x40a633
lea edx, [esp + 0x2c]
lea eax, [esp + 0x20]
push edx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWAREKingsaft
push 0x80000002
mov dword [esp + 0x44], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x40a66b
lea ecx, [esp + 0x10]
call fcn.00402460
mov ecx, dword [esp + 0x20]
cmp eax, ebx
mov dword [esp + 0x10], ecx
jne 0x40a66b
push str.XXXX
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x10]
inc eax
push eax
push str.XXXX
push 1
push ebx
push 0x433a0c
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40a66b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
push ebx
mov ecx, esi
call fcn.0040aa50
push str._WHZ_ETIbKreibKR_MJb
lea ecx, [esp + 0x1c]
call fcn.0041efc1
push 5
push ebx
lea eax, [esp + 0x20]
push 3
push eax
mov ecx, esi
mov byte [esp + 0x64], 0x31
call fcn.0040b3c0
lea ecx, [esp + 0x18]
push str.OpenHomePageCommand
lea edx, [esp + 0x30]
push ecx
push edx
call fcn.0041f1e8
mov eax, dword [eax]
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push eax
push 0x80000002
call edi
lea ecx, [esp + 0x2c]
call fcn.0041ef53
lea eax, [esp + 0x18]
push str.OpenHomePage
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.0041f1e8
mov eax, dword [eax]
push eax
push 0x80000002
call edi
lea ecx, [esp + 0x2c]
call fcn.0041ef53
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push edx
push 0xf003f
push ebx
push eax
push 0x80000002
mov dword [esp + 0x34], ebx
call ebp
cmp eax, ebx
jne 0x40a721
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40a719
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], ecx
push str.Open
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 0x10]
inc eax
push eax
push str.Open
push 1
push ebx
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x10]
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push str.Open
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x70], 0x32
call fcn.0040a8a0
cmp eax, ebx
jne 0x40a77a
push ebx
push 0x433984
lea ecx, [esp + 0x28]
call fcn.0040a910
lea ecx, [esp + 0x20]
mov byte [esp + 0x54], 0x31
call fcn.00402460
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40a79b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
lea ecx, [esp + 0x18]
push 0x4337a4
lea edx, [esp + 0x30]
push ecx
push edx
call fcn.0041f1e8
mov eax, dword [eax]
lea ecx, [esp + 0x20]
push ecx
push 0xf003f
push ebx
push eax
push 0x80000002
mov byte [esp + 0x68], 0x33
mov dword [esp + 0x34], ebx
call ebp
cmp eax, ebx
jne 0x40a7e2
lea ecx, [esp + 0x10]
call fcn.00402460
mov edx, dword [esp + 0x20]
mov dword [esp + 0x10], edx
lea ecx, [esp + 0x2c]
mov byte [esp + 0x54], 0x31
call fcn.0041ef53
mov esi, dword [esi + 0x18]
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x10]
push ebx
push ebx
push 0xf003f
push ebx
push ebx
push str.Command
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0x70], 0x34
call fcn.0040a8a0
cmp eax, ebx
jne 0x40a827
push ebx
push esi
lea ecx, [esp + 0x28]
call fcn.0040a910
lea ecx, [esp + 0x20]
mov byte [esp + 0x54], 0x31
call fcn.00402460
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40a848
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
push ebx
push ebx
push 0x2000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov byte [esp + 0x54], 1
lea ecx, [esp + 0x18]
call fcn.0041ef53
lea ecx, [esp + 0x14]
mov byte [esp + 0x54], bl
call fcn.0041ef53
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
cmp eax, ebx
pop ebx
je 0x40a888
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
add esp, 0x48
ret