Function at 0x4025f0
Capabilities:
Delete registry key
Delete registry value
Persist via aedebug registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1028
call fcn.00436be0
mov eax, dword [0x455008]
xor eax, ebp
mov dword [ebp - 8], eax
mov al, byte [ebp + 8]
xorps xmm0, xmm0
push ebx
push esi
push edi
push 0x1000
mov byte [ebp - 0x1015], al
mov ebx, edx
lea eax, [ebp - 0x1014]
movq qword [ebp - 0x14], xmm0
push 0
push eax
mov word [ebp - 0xc], 0
call fcn.00417b90
add esp, 0xc
mov byte [ebp - 0x1016], 0
xor edi, edi
mov dword [ebp - 0x101c], 0
mov dword [ebp - 0x1020], 0
test ebx, ebx
je 0x402945
lea eax, [ebp - 0x1024]
mov dword [ebp - 0x1024], edi
push eax
movzx eax, byte [ebp - 0x1015]
inc eax
shl eax, 8
or eax, 3
push eax
push edi
push 0x44511c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, 0x445130
mov ecx, 0x44514c
test eax, eax
je 0x4026b4
cmp byte [ebp - 0x1015], 0
mov eax, esi
cmove eax, ecx
push eax
push 0x4456a0
call fcn.00401380
add esp, 8
jmp 0x40275b
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x1020]
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 0x1016], 1
push eax
lea eax, [ebp - 0x101c]
mov dword [ebp - 0x1020], 5
push eax
push 0
push 0x4450fc
push dword [ebp - 0x1024]
call edi
test eax, eax
jne 0x4026f9
cmp dword [ebp - 0x101c], 1
je 0x4026ff
xor eax, eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x101c], 0
push eax
lea eax, [ebp - 0x1014]
mov dword [ebp - 0x1020], 0x800
push eax
lea eax, [ebp - 0x101c]
push eax
push 0
push 0x445108
push dword [ebp - 0x1024]
call edi
mov edi, eax
test edi, edi
jne 0x402746
cmp dword [ebp - 0x101c], 1
je 0x40274f
xor eax, eax
mov word [ebp - 0x1014], ax
push dword [ebp - 0x1024]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402761
sub ecx, edx
sar ecx, 1
je 0x4027c4
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x14]
push eax
push 1
push 0
push 0x4450fc
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x4027d0
cmp byte [ebp - 0x1015], 0
mov ebx, 0x44514c
cmove esi, ebx
push esi
push 0x445448
call fcn.00401380
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00415f69
mov esp, ebp
pop ebp
ret
push 0x4450fc
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x1014]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4027e0
sub ecx, edx
sar ecx, 1
je 0x402846
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x1014]
push eax
push 1
push 0
push 0x445108
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x402852
cmp byte [ebp - 0x1015], 0
mov ebx, 0x44514c
cmove esi, ebx
push esi
push 0x4454e8
call fcn.00401380
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00415f69
mov esp, ebp
pop ebp
ret
push 0x445108
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp byte [ebp - 0x1016], 0
je 0x40288e
push 0x44511c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edi, eax
mov ebx, 0x44514c
test edi, edi
je 0x402893
cmp byte [ebp - 0x1015], 0
mov eax, esi
cmove eax, ebx
push eax
push 0x445150
call fcn.00401380
add esp, 8
jmp 0x402893
mov ebx, 0x44514c
push 0x4457b4
call fcn.00401380
add esp, 4
cmp byte [ebp - 0x1015], 0
cmove esi, ebx
push esi
push 0x4455a8
call fcn.00401380
lea ecx, [ebp - 0x14]
add esp, 8
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4028c0
sub ecx, edx
sar ecx, 1
je 0x4028e4
lea eax, [ebp - 0x14]
push eax
push 0x445628
call fcn.00401380
add esp, 8
jmp 0x4028f1
push 0x4457d0
call fcn.00401380
add esp, 4
lea ecx, [ebp - 0x1014]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402900
sub ecx, edx
sar ecx, 1
je 0x402938
lea eax, [ebp - 0x1014]
push eax
push 0x445660
call fcn.00401380
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00415f69
mov esp, ebp
pop ebp
ret
push 0x445818
call fcn.00401380
add esp, 4
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415f69
mov esp, ebp
pop ebp
ret