Function at 0x431650
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df822
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x268], ecx
mov eax, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x258], 0
call fcn.00480640
add esp, 0xc
mov dword [ebp - 0x234], 7
xor eax, eax
mov dword [ebp - 0x238], 0
lea ecx, [ebp - 0x248]
mov word [ebp - 0x248], ax
push 1
push 0x5e9dec
call fcn.00402ad0
push 0x24
push 0x5e9df0
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
inc ebp
cld
add byte [eax], al
add byte [eax], al
call fcn.00405da0
push 1
push 0x5e9e3c
lea ecx, [ebp - 0x248]
call fcn.00405da0
call fcn.004522c7
test al, al
je 0x431756
sahf
pop esi
add byte [ebp - 0x24773], cl
invalid
mul byte [eax - 0x43]
movsd dword es:[edi], dword [esi]
jmp 0x4316dc
call fcn.004520e4
test al, al
je 0x43177d
popal
lcall 0xe16c, 0x88c06357
mov bh, dl
retf 0x4585
call fcn.004521b3
test al, al
je 0x4317a5
cmp al, 0xce
int1
out 0x3f, al
mov ebp, edx
shr byte [ecx + 0x11], cl
fdivr qword [ebx - 0x2e]
fimul word [ebx - 0x10]
popfd
aad 0x5a
jbe 0x43171c
jae 0x43172b
int3
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x24c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push ecx
push 0
push 0xf013f
push 0
push 0
push 0
push eax
push dword [ebp - 0x264]
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x431934
push 2
xor eax, eax
mov dword [ebp - 0x21c], 7
push 0x5e9e40
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00402ad0
push 0x14
push str.OverlayIconWanNengWB
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.00405da0
push 6
push str._Class
lea ecx, [ebp - 0x230]
call fcn.00405da0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop dword [eax]
pop ds
add byte [edi], cl
mov bh, 1
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x431860
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431880
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x24c]
call ebx
call fcn.00451f46
test al, al
je 0x4318c4
clc
jle 0x4318bf
ror byte [ebx + 0x518666ec], cl
adc ecx, dword [ecx - 0x5d76282]
jle 0x43185e
sub dl, bh
imul edi, dword [ecx + 0x13], 0xffffff8d
mov ebp, 0xfffffde8
mov ecx, 0x13
lea edi, [ebp - 0x218]
mov esi, str.20853498_9FFE_40D2_B62D_D480ADAF337E
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
movsw word es:[edi], word [esi]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4318e1
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.AppID
push dword [ebp - 0x24c]
call ebx
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x43192e
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402c20
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x431f60
push 0
lea ecx, [ebp - 0x250]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.InprocServer32
push eax
call edi
test eax, eax
jne 0x431ad3
mov esi, dword [ebp - 0x268]
lea ecx, [ebp - 0x230]
push 0xffffffffffffffff
push eax
push esi
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
call fcn.004029b0
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x30]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x230]
call fcn.00405c90
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4319c5
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4319e0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x250]
call ebx
call fcn.004523db
test al, al
je 0x431a31
push ebx
sub bl, 0xb3
cmp byte [esi], 0x8c
cmp dword [ebx - 0x4b], 0xc8a97794
retf
invalid
call fcn.004524ef
test al, al
je 0x431a5e
lcall 0xf314, 0x103c8970
je 0x431a2f
mov ebp, 0x2dc92d3e
inc eax
iretd
movups xmm0, xmmword [str.Apartment]
mov eax, dword [0x5e9c64]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x208], eax
lea edx, [ecx + 2]
movups xmmword [ebp - 0x218], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431a80
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.ThreadingModel
push dword [ebp - 0x250]
call ebx
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x431ad3
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402c20
push 0
lea eax, [ebp - 0x254]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.ProgID
push dword [ebp - 0x24c]
call edi
test eax, eax
jne 0x431be9
push str.OverlayIconWanNengWB
lea ecx, [ebp - 0x230]
call fcn.004041e0
push 1
push 0x5e8848
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 3
call fcn.00405da0
push 2
push 0x5e9e40
lea ecx, [ebp - 0x230]
call fcn.00405da0
push 0x14
push str.OverlayIconWanNengWB
lea ecx, [ebp - 0x230]
call fcn.00405da0
push 2
push 0x5e9ef4
lea ecx, [ebp - 0x230]
call fcn.00405da0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x431b74
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431b90
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x254]
call ebx
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x431be9
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402c20
push 0
lea eax, [ebp - 0x260]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.Programmable
push dword [ebp - 0x24c]
call edi
push 0
lea eax, [ebp - 0x25c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.TypeLib
push dword [ebp - 0x24c]
call edi
test eax, eax
jne 0x431cfd
push 0x5e9dec
lea ecx, [ebp - 0x230]
call fcn.004041e0
push 0x24
push str.7A3B0D6F_8BB3_4007_B032_BD7782EEAD56
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 4
call fcn.00405da0
push 1
push 0x5e9e3c
lea ecx, [ebp - 0x230]
call fcn.00405da0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x431c90
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431cb0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x25c]
call ebx
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x431cfd
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402c20
call fcn.004521f8
test al, al
je 0x431d21
adc eax, 0xd70e635
xchg ebx, eax
mov esi, 0xd26ff5f2
dec eax
mov bh, 0x56
retf 0x7010
call fcn.0045209f
test al, al
je 0x431d48
stosd dword es:[edi], eax
push ecx
lcall 0x94fa, 0xd30ac7d3
xchg dword [esi + 0x4c], edx
fdivr dword [eax + 0x49]
push ecx
pop esi
sub al, 0xa6
xor al, 0x68
pop ecx
cmp byte [esi], 0x26
xchg esp, eax
sal dword [edi + 0x6a4c81], 0x8d
test dword [eax + 0x50fffffd], ebp
push 0
lea eax, [ebp - 0x258]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.VersionIndependentProgID
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x431e61
push str.OverlayIconWanNengWB
lea ecx, [ebp - 0x230]
call fcn.004041e0
push 1
push 0x5e8848
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 5
call fcn.00405da0
push 2
push 0x5e9e40
lea ecx, [ebp - 0x230]
call fcn.00405da0
push 0x14
push str.OverlayIconWanNengWB
lea ecx, [ebp - 0x230]
call fcn.00405da0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x431de0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431e00
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x258]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x431e67
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402c20
jmp 0x431e67
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0045209f
test al, al
je 0x431e8f
adc bh, byte [edi + 0x53]
inc eax
nop edi
dec ecx
adc eax, 0x980b88d1
cmp byte [ecx - 0x2b6040c1], dh
invalid
mov eax, dword [ebp - 0x25c]
test eax, eax
je 0x431e9c
push eax
call esi
call fcn.00452351
test al, al
je 0x431ebc
add al, 0x44
push cs
rcl byte [edi - 0x2ac7dd7e]
clc
nop
xchg ebx, eax
mov bh, 0xce
or ebp, dword [edi - 5]
invalid
call fcn.004520e4
test al, al
je 0x431edd
xor byte [ebp + edi*8 + 0x594bd89d], bl
invalid
call fcn.0045216e
test al, al
je 0x431efe
sub ah, byte [eax + 0x5b]
xor esi, dword [eax + 0x1325e0d8]
mov esi, ebx
sbb al, 1
xor eax, 0xcad904c9
aam 0xd1
adc al, 0xa6
test al, 0x8b
test dword [eax - 0x74000003], esp
sbb eax, sym.imp.ADVAPI32.dll_RegCloseKey
mov eax, dword [ebp - 0x260]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x431f11
push eax
call ebx
call fcn.0045230c
test al, al
je 0x431f2c
outsb dx, byte [esi]
movhps xmm4, qword [0x35bc3827]
xchg dword [esi], ebx
cli
sub al, 0xc1
cmp dword [0x8bf3812a], edx
test dword [eax - 0x7a000003], esi
sal byte [ebx + eax + 0x50], 0xff
shr eax, cl
cmp eax, dword [esi]
add al, byte [eax]
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x431f39
push eax
call ebx
call fcn.00452579
test al, al
je 0x431f52
int1
sbb ecx, ebp
xchg edi, eax
imul edi, dword [edi + 0x22bc8b57], 0xffffffb4
mov al, 0x94
movsd dword es:[edi], dword [esi]
rcl byte [eax], 0xff
mov ch, 0xb4
std
invalid
push dword [ebp - 0x24c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x431f7e
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402c20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d81d
mov esp, ebp
pop ebp
ret 4