Function at 0x432a00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e1466
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x258], ecx
mov eax, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
call fcn.004830b0
add esp, 0xc
mov dword [ebp - 0x234], 7
xor eax, eax
mov dword [ebp - 0x238], 0
invalid
lea ecx, [ebp - 0x248]
mov word [ebp - 0x248], ax
push 0x26
push str.BD2F4D93_5414_4182_A2D5_96BD9C51B5B6
call fcn.00402650
mov dword [ebp - 4], 0
call fcn.0047337c
test al, al
je 0x432ac0
outsb dx, byte [esi]
test dword [ebx], edx
xchg ebp, eax
je 0x432a77
invalid
call fcn.0047355f
test al, al
je 0x432adf
add al, 0xd9
jns 0x432a8c
outsd dx, dword [esi]
jge 0x432a7d
invalid
call fcn.004734d5
test al, al
je 0x432b00
and al, 0x70
or edi, dword [edi - 0x2f9a0332]
bound ecx, qword [ebx]
jb 0x432b35
pushfd
add eax, 0x84a767ef
in al, dx
inc eax
jmp 0x212bbb76
call fcn.00473925
test al, al
je 0x432b23
cdq
push ebp
pop ebx
pop ecx
dec edx
sahf
scasb al, byte es:[edi]
call 0xe6bc0d47
lodsd eax, dword [esi]
invalid
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x250]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push ecx
push 0
push 0xf013f
push 0
add byte [ebp - 0x2477b], cl
dec dword [edi]
inc ebx
test dword [eax + 0x6afffffd], edi
add byte [ecx + 0x6a], dl
add byte [eax + 0x3f], ch
add dword [edi], ecx
add byte [edx], ch
push 0
push 0
push eax
push dword [ebp - 0x254]
call esi
test eax, eax
jne 0x432c0e
push 0x17
push str.ZhiNeng_Shell_Extension
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
call fcn.00402650
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x432ba7
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432bc1
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e87f0
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x432c0e
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402750
call fcn.00473811
test al, al
je 0x432c31
fldcw word [ecx]
sbb al, 0xe8
inc edx
adc al, al
xchg ebp, eax
cmp al, 0xdc
mov al, byte [0xf39031ac]
pushfd
push es
mov al, 0x54
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
xor eax, sym.imp.ADVAPI32.dll_RegCreateKeyExW
call fcn.0047396a
test al, al
je 0x432c4b
ja 0x432c2c
add eax, 0x629d7cdc
xchg byte [esi + eax*8], dl
adc al, 0xee
adc eax, 0xb318d940
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x432da7
push 0
lea ecx, [ebp - 0x24c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.InprocServer32
push eax
call esi
test eax, eax
jne 0x432d8c
call fcn.004022d0
mov ecx, eax
call fcn.004710c9
push eax
lea ecx, [ebp - 0x230]
call fcn.00403b30
mov eax, dword [ebp - 0x258]
lea ecx, [ebp - 0x230]
push 0xffffffffffffffff
push 0
add eax, 0x18
mov byte [ebp - 4], 1
push eax
call fcn.00405600
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x432cd0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432cf0
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e87f0
push dword [ebp - 0x24c]
call esi
movups xmm0, xmmword [str.Apartment]
mov eax, dword [0x5ebe50]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x208], eax
lea edx, [ecx + 2]
movups xmmword [ebp - 0x218], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432d43
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.ThreadingModel
push dword [ebp - 0x24c]
call esi
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x432d8c
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402750
mov eax, dword [ebp - 0x24c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x432d9f
push eax
call esi
push dword [ebp - 0x250]
call esi
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x432dc5
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402750
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 4