Function at 0x403ce0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x46d040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.00403c00
sub esp, 0xc
push 0x46dab8
push ecx
lea ecx, [ebp - 0xbc]
call fcn.004105c0
mov edi, eax
test edi, edi
js 0x403ff4
mov ecx, dword [esi + 0x18]
mov edx, str._systeminformer.exe_0
call fcn.00405480
mov dword [ebp - 0xc4], 0x180016
mov dword [ebp - 0xc0], str.DisplayIcon
mov ecx, dword [eax]
add ecx, 2
push ecx
push dword [eax + 4]
lea eax, [ebp - 0xc4]
push 1
push 0
push eax
push dword [ebp - 0xbc]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 0x20
push str.System_Informer
push 1
push 0
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xc4], 0x180016
push eax
push dword [ebp - 0xbc]
mov dword [ebp - 0xc0], str.DisplayName
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov eax, 0x2e
mov dword [ebp - 0xb0], 8
push 0xa
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xa0], 3
mov dword [ebp - 0x98], 0
lea edx, [eax - 0x27]
mov word [ebp - 0x88], ax
mov dword [ebp - 0x80], 8
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x68], 0
mov word [ebp - 0x58], ax
mov dword [ebp - 0x50], 8
mov dword [ebp - 0x40], 0x5edb
mov dword [ebp - 0x38], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x10], 0
call fcn.00407c80
mov dword [ebp - 0xc4], 0x1e001c
mov dword [ebp - 0xc0], str.DisplayVersion
mov ecx, dword [eax]
add ecx, 2
push ecx
push dword [eax + 4]
lea eax, [ebp - 0xc4]
push 1
push 0
push eax
push dword [ebp - 0xbc]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 0x4e
push str.https:__systeminformer.sourceforge.io_
push 1
push 0
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xc4], 0x120010
push eax
push dword [ebp - 0xbc]
mov dword [ebp - 0xc0], str.HelpLink
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov ecx, dword [esi + 0x18]
mov edx, 0x46542c
call fcn.00405480
mov dword [ebp - 0xc4], 0x20001e
mov dword [ebp - 0xc0], str.InstallLocation
mov ecx, dword [eax]
add ecx, 2
push ecx
push dword [eax + 4]
lea eax, [ebp - 0xc4]
push 1
push 0
push eax
push dword [ebp - 0xbc]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 0x48
push str.Winsider_Seminars__Solutions__Inc.
push 1
push 0
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xc4], 0x140012
push eax
push dword [ebp - 0xbc]
mov dword [ebp - 0xc0], str.Publisher
call dword [sym.imp.ntdll.dll_NtSetValueKey]
mov ecx, dword [esi + 0x18]
mov edx, str._systeminformer_setup.exe
call fcn.00405480
mov ebx, eax
test ebx, ebx
je 0x403f22
push dword [ebx + 4]
push str.__s___uninstall
call fcn.004071f0
mov esi, eax
lea ecx, [ebx - 8]
add esp, 8
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x403f33
call fcn.004060e0
nop
jmp 0x403f33
push 0
push str.__s___uninstall
call fcn.004071f0
add esp, 8
mov esi, eax
mov ecx, dword [esi]
lea eax, [ebp - 0xc4]
add ecx, 2
mov dword [ebp - 0xc4], 0x20001e
push ecx
push dword [esi + 4]
mov dword [ebp - 0xc0], str.UninstallString
push 1
push 0
push eax
push dword [ebp - 0xbc]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 4
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb4], 1
push eax
push 4
push 0
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xc4], 0x120010
push eax
push dword [ebp - 0xbc]
mov dword [ebp - 0xc0], str.NoModify
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 4
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb8], 1
push eax
push 4
push 0
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xc4], 0x120010
push eax
push dword [ebp - 0xbc]
mov dword [ebp - 0xc0], str.NoRepair
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push dword [ebp - 0xbc]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, edi
mov ecx, dword ds:[ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00421733
mov esp, ebp
pop ebp
ret