Function at 0x40d2d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1048
call fcn.0041e550
mov eax, dword [0x43c060]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1038], ecx
mov dword [ebp - 0x102c], 0
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x102c]
push eax
push 0x4303d4
push 1
push 0
push 0x4303e4
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x1040], eax
cmp dword [ebp - 0x1040], 0
jl 0x40d5ec
mov dword [ebp - 0x1044], 1
mov dword [ebp - 0x1030], 0
push 1
mov ecx, dword [ebp - 0x102c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x102c]
push eax
mov ecx, dword [edx + 0x14]
call ecx
mov dword [ebp - 0x1040], eax
lea edx, [ebp - 0x1030]
push edx
push 1
mov eax, dword [ebp - 0x102c]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x102c]
push edx
mov eax, dword [ecx + 0x3c]
call eax
cmp dword [ebp - 0x1030], 0
jne 0x40d388
jmp 0x40d5f4
xor ecx, ecx
mov word [ebp - 0x804], cx
push 0x7fe
push 0
lea edx, [ebp - 0x802]
push edx
call sub.MSVCR110.dll_memset
add esp, 0xc
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
push 0x4262b8
push 0x400
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x10
movzx ecx, byte [ebp + 8]
test ecx, ecx
je 0x40d3da
mov dword [ebp - 0x1008], 1
jmp 0x40d3e4
mov dword [ebp - 0x1008], 0
xor edx, edx
mov word [ebp - 0x1004], dx
push 0x7fe
push 0
lea eax, [ebp - 0x1002]
push eax
call sub.MSVCR110.dll_memset
add esp, 0xc
push str.HideSCAHealth
push 0x4262c0
push 0x400
lea ecx, [ebp - 0x1004]
push ecx
call dword [sym.imp.MSVCR110.dll_swprintf_s]
add esp, 0x10
mov dword [ebp - 0x1034], 0
mov dword [ebp - 0x1048], 0
mov dword [ebp - 0x103c], 0
lea edx, [ebp - 0x1034]
push edx
push 0x20006
push 0
lea eax, [ebp - 0x804]
push eax
mov ecx, dword [ebp - 0x1030]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d496
push 0
lea edx, [ebp - 0x1034]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [ebp - 0x804]
push eax
mov ecx, dword [ebp - 0x1030]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x103c], eax
cmp dword [ebp - 0x103c], 0
jne 0x40d4c0
push 4
lea edx, [ebp - 0x1008]
push edx
push 4
push 0
lea eax, [ebp - 0x1004]
push eax
mov ecx, dword [ebp - 0x1034]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x1034]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x1030]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1028], 0x35378eac
mov ecx, 0x683f
mov word [ebp - 0x1024], cx
mov edx, 0x11d2
mov word [ebp - 0x1022], dx
mov byte [ebp - 0x1020], 0xa8
mov byte [ebp - 0x101f], 0x9a
mov byte [ebp - 0x101e], 0
mov byte [ebp - 0x101d], 0xc0
mov byte [ebp - 0x101c], 0x4f
mov byte [ebp - 0x101b], 0xbb
mov byte [ebp - 0x101a], 0xcf
mov byte [ebp - 0x1019], 0xa2
mov dword [ebp - 0x1018], 0xf6b957e
mov eax, 0x509e
mov word [ebp - 0x1014], ax
mov ecx, 0x11d1
mov word [ebp - 0x1012], cx
mov byte [ebp - 0x1010], 0xa7
mov byte [ebp - 0x100f], 0xcc
mov byte [ebp - 0x100e], 0
mov byte [ebp - 0x100d], 0
mov byte [ebp - 0x100c], 0xf8
mov byte [ebp - 0x100b], 0x75
mov byte [ebp - 0x100a], 0x71
mov byte [ebp - 0x1009], 0xe3
lea edx, [ebp - 0x1018]
push edx
lea eax, [ebp - 0x1028]
push eax
push 1
push 0
mov ecx, dword [ebp - 0x102c]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x102c]
push eax
mov ecx, dword [edx + 0x1c]
call ecx
mov edx, dword [ebp - 0x102c]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x102c]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x1038]
cmp dword [eax], 0
je 0x40d5ec
push 1
push 0x4262c8
push 0x4262e0
mov ecx, dword [ebp - 0x1038]
mov ecx, dword [ecx]
call fcn.004162a0
push 0
call dword [sym.imp.USERENV.dll_RefreshPolicy]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041db86
mov esp, ebp
pop ebp
ret 4