Function at 0x4323b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df861
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], ecx
mov eax, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x258], 0
call fcn.00480620
add esp, 0xc
call fcn.00452215
test al, al
je 0x43246d
invalid
call fcn.004520bc
test al, al
je 0x432494
mov es, ebp
sub eax, 0x2ed0f166
sbb esi, ecx
push esi
ficom word [ebx + ebx*4 + 0x634bd91c]
out 0x8d, al
mov esi, 0x8fd2b966
or esi, esi
dec ebp
sbb ebp, ebp
xchg ebp, eax
push 1
xor eax, eax
mov dword [ebp - 0x234], 7
push 0x5e9df4
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
call fcn.00402ac0
push 0x24
push str.7A3B0D6F_8BB3_4007_B032_BD7782EEAD56
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.00405c20
push 1
push 0x5e9e44
lea ecx, [ebp - 0x248]
call fcn.00405c20
call fcn.0045250c
test al, al
je 0x432508
push ecx
pop es
add dword [esi], ebp
int1
loope 0x432571
mov dword [0xce6d10a6], eax
sub ch, dh
clc
neg byte [edi - 0x18]
or ch, bh
add dword [eax], eax
call fcn.00452215
test al, al
je 0x432530
insb byte es:[edi], dx
pop esi
or esi, dword [edx + 0x4113cf45]
pop es
inc edi
pop esi
xchg ebp, esi
xor byte [eax], dh
insb byte es:[edi], dx
mov dh, 0x10
sub ecx, edx
push es
or eax, edx
cmpsd dword [esi], dword es:[edi]
add esp, dword [ebx - 0x75b08045]
test al, 0xe8
std
cli
add dword [eax], eax
call fcn.00452032
test al, al
je 0x43254f
les esi, [ecx + 0x8b44eeb]
ret
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x268]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push dword [ebp - 0x26c]
call esi
test eax, eax
jne 0x432bd4
call fcn.004520bc
test al, al
je 0x4325b8
jb 0x432537
daa
leave
add byte [esp + ebp*8 + 0x55], al
push esi
push cs
sahf
and edi, dword [ecx - 0x10]
aad 0xd6
ljmp 0xa23f
push 0
lea eax, [ebp - 0x24c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5e6b4c
push dword [ebp - 0x268]
call esi
test eax, eax
jne 0x432b76
call fcn.0045236e
test al, al
je 0x432603
push ecx
inc edi
adc eax, 0x5d655f7
add eax, dword [edi]
loop 0x4325c0
xchg edx, eax
xor bp, word [ebx]
xchg esp, ebp
cmp byte [0xdd5bdf32], dl
call fcn.00452101
test al, al
je 0x432624
xchg dword [ecx - 0x79], esp
xor ebx, esp
in al, dx
cmp al, 0x8d
and dword [esi + 0x904cee2], esp
sub al, 0x99
outsd dx, dword [esi]
mov ecx, 0xca5ec3d4
cdq
push ss
call fcn.0045218b
test al, al
je 0x432645
or al, 0xb
outsd dx, dword [esi]
stc
lea edx, [ebx + edi*2 + 0x7c4845a9]
jae 0x432698
cdq
and bl, byte [eax]
sal dword [ebx], 1
sal dword [ecx + ebx*4], 1
add eax, 0x1d8b2e8d
js 0x4326a9
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x250]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
pop esi
add byte [ebp - 0x24f7b], cl
jmp [edx]
push 0x5e6b60
push dword [ebp - 0x24c]
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x432925
call fcn.00452329
test al, al
je 0x43269d
sbb dword [esi], edx
sub edx, dword [edx]
imul ebp, edi, 0xb7f11a7b
jne 0x43261c
jmp 0x432661
xor eax, sym.imp.ADVAPI32.dll_RegSetValueExW
push 0
lea eax, [ebp - 0x254]
push eax
push 0
push 0xf003f
push 0
aas
add byte [edi], cl
add byte [edx], ch
push 0
push 0
push str.win32
push dword [ebp - 0x250]
call ebx
test eax, eax
jne 0x4327ac
call fcn.00452596
test al, al
je 0x4326e7
fstpnce st(4), st(0)
mov edi, 0x77fe5a32
cld
call 0xaff5e0e9
push esi
ficomp word [esi - 0x75]
sbb eax, sym.imp.ADVAPI32.dll_RegCreateKeyExW
xor eax, eax
mov dword [ebp - 0x21c], 7
push 0xffffffffffffffff
push eax
push dword [ebp - 0x260]
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.004029a0
push str.WOver32.dll
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.0040aa00
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x432746
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432760
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x254]
call esi
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00447330
call fcn.004524c7
test al, al
je 0x4327d3
dec esp
xor byte [eax - 0x1c], bl
sal dword [edx], cl
cld
jno 0x432814
sub ah, al
invalid
push 0
lea eax, [ebp - 0x258]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.win64
push dword [ebp - 0x250]
call ebx
test eax, eax
jne 0x4328b7
push 0xffffffffffffffff
push eax
push dword [ebp - 0x260]
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
call fcn.004029a0
push str.WOver64.dll
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.0040aa00
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
add byte [eax], al
add byte [ecx - 0x21f7b], cl
jmp dword [esi - 0x77]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x432857
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432871
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x258]
call esi
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00447330
call fcn.004523f8
test al, al
je 0x4328db
shr dword [ebx], cl
mov dl, 6
dec ebp
ficomp dword [edi + 0x5da72556]
add byte [esi + 0x6a], 0xdc
cwde
mov al, 0xef
movsd dword es:[edi], dword [esi]
push 0x388d1bda
retf 0xe820
call fcn.0045225a
test al, al
je 0x4328f9
invalid
call fcn.004523b3
test al, al
je 0x432914
or al, 0x1a
lodsb al, byte [esi]
cmp edx, edi
sub ecx, dword [ebp - 0x1085d63d]
wait
mov byte [0xb5d5f066], al
mov ecx, dword [ebx - 0x24f7b]
inc dword [ebp + 0x500774c0]
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x432925
test dword [eax - 0x7a000003], esi
sal byte [edi + eax + 0x50], 0xff
adc eax, sym.imp.ADVAPI32.dll_RegCloseKey
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004523f8
test al, al
je 0x432949
xlatb
iretd
call fcn.0045225a
test al, al
je 0x432967
cmp byte [ecx], bl
jecxz 0x4329be
sub dword ds:[ecx - 0x20], 0x36
jg 0x432915
test eax, 0xb1e19d6b
or byte [esi], cl
inc esi
adc byte [edx + 0x1fa47e8], ch
add byte [eax + eax*8 - 0x4a6ed8c], al
call fcn.004523b3
test al, al
je 0x432982
pop ecx
sti
pop ss
push ebp
dec ebp
wait
scasb al, byte es:[edi]
pop ebx
cld
mov edx, dword [0x44809dca]
salc
mov al, byte [0x8d006ace]
test dword [ebp + edi*8 + 0x6a50ffff], esp
add byte [eax + 0x3f], ch
add byte [edi], cl
add byte [edx], ch
push 0
lea eax, [ebp - 0x25c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.FLAGS
push dword [ebp - 0x24c]
call ebx
test eax, eax
jne 0x4329fb
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], 0x30
lea edx, [ecx + 2]
nop dword [eax]
inc eax
add byte [esi - 0x75], ah
add dword [ebx - 0x7a99fd3f], eax
sal byte [ebp - 0xb], 0x2b
retf 0xf9d1
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4329c0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004522e4
test al, al
je 0x432a18
out dx, eax
or eax, 0x632f33
lcall 0xd2d4, 0x53bdf454
inc esi
in al, 0x32
xor esi, eax
cdq
inc eax
call fcn.00452101
test al, al
je 0x432a3f
add dword [ecx + 0x52f0dea], edx
aam 2
out dx, al
cmpsd dword [esi], dword es:[edi]
cmpsd dword [esi], dword es:[edi]
fbstp tbyte [edx + edx*8]
sbb byte [edi], ch
dec ecx
cmp al, 0x17
das
xchg edx, eax
xchg edx, eax
cmp cl, byte [edx + 0x445aa2ce]
xchg edx, eax
ret
call fcn.004521d0
test al, al
je 0x432a67
int 0x6e
cdq
scasd eax, dword es:[edi]
xchg edi, eax
pop esi
dec ebx
mov byte [0x7299a7cb], al
out 0x23, al
xchg edx, eax
or ecx, eax
das
dec ebp
leave
xchg dword [edx], edi
in eax, 0xdb
stc
imul esp, dword [edi - 0x2701526c], 0x6a
add byte [ebp - 0x2637b], cl
call dword [eax + 0x6a]
add byte [eax + 0x3f], ch
add byte [edi], cl
add byte [edx], ch
push 0
lea eax, [ebp - 0x264]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.HELPDIR
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x432b4a
push 0xffffffffffffffff
push eax
push dword [ebp - 0x260]
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
call fcn.004029a0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x432ae0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432b00
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x264]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea ecx, [ebp - 0x230]
call fcn.00447330
jmp 0x432b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pushal
pop esi
add al, ch
push cs
hlt
call fcn.00451f63
test al, al
je 0x432b69
mov ch, 0x91
jae 0x432bda
imul esp, ebp, 0x3ea102a6
xchg ecx, eax
jg 0x432b4d
or al, 0xb2
into
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x432b76
push eax
call ebx
call fcn.004523f8
test al, al
je 0x432b9c
lodsd eax, dword [esi]
rcr byte [ecx - 0x7a], 0x81
cmp ecx, dword [edx]
fcom qword [eax + 0x20]
adc dh, byte [0xf879bcbd]
push ds
pop ecx
ret
call fcn.0045250c
test al, al
je 0x432bc3
sbb esp, ebp
mov ch, byte [edx + 0x39]
jmp 0xdedff0a7
mov eax, dword [ebp - 0x268]
test eax, eax
je 0x432bd4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x432bf2
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret 4