Function at 0x432140
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e27e6
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x258], ecx
mov eax, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
call fcn.00483520
add esp, 0xc
mov dword [ebp - 0x234], 7
xor eax, eax
mov dword [ebp - 0x238], 0
lea ecx, [ebp - 0x248]
mov word [ebp - 0x248], ax
push 0x26
push str.B2A6906E_67AA_4613_B7ED_1CEB63834F37
call fcn.00402b90
mov dword [ebp - 4], 0
call fcn.00453bb5
test al, al
je 0x4321f7
invalid
call fcn.004538be
test al, al
je 0x43221f
cdq
xchg ebx, eax
pop ecx
and al, 0x84
sbb eax, 0xe17a3912
sub byte [eax - 0x14], dh
das
mov bl, 0x15
pmullw mm3, qword [ecx + 0x689c231c]
ret
call fcn.004536db
test al, al
je 0x43223e
push ss
insb byte es:[edi], dx
or ebx, edi
lodsb al, byte [esi]
enter 0x440, 0x43
imul esi, dword [0x606b3858], 0x4ae8d47b
test byte [edi + 9], bh
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x250]
push 0
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push eax
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43232d
push 0x19
push str.WanNengWB_Shell_Extension
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
call fcn.00402b90
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4322c0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4322e0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e9978
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x43232d
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402ce0
call fcn.00453cc9
test al, al
je 0x432349
mov ebp, 0x8fe01cfd
or al, 0x17
inc eax
in al, dx
invalid
call fcn.00453c3f
test al, al
je 0x43236d
sal ebx, cl
or dword ds:[ecx + 0x46b6a47d], eax
mov eax, 0x8e4a64db
mov bl, 0x1c
clc
and esi, dword [esi + 0x52c5bc50]
arpl word [esi - 0x7717dace], sp
sbb byte [edx], al
add byte [eax + eax*8 + 0x668a1974], al
push ss
call fcn.00453bfa
test al, al
je 0x43238f
mov ah, byte [esi + 0x16]
and byte [esi + 0x21], cl
add dword [edi - 0x71], eax
int1
pop dword [ecx - 0x7089dd25]
push es
mov eax, dword [0x2ce40fe6]
push 0x858bc160
mov al, 0xfd
invalid
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x4324e7
push 0
lea ecx, [ebp - 0x24c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.InprocServer32
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4324cc
call fcn.004023e0
mov ecx, eax
call fcn.00474b54
push eax
lea ecx, [ebp - 0x230]
call fcn.00404170
mov eax, dword [ebp - 0x258]
lea ecx, [ebp - 0x230]
push 0xffffffffffffffff
push 0
add eax, 0x18
mov byte [ebp - 4], 1
push eax
call fcn.00405c20
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x432416
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432430
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e9978
push dword [ebp - 0x24c]
call esi
movups xmm0, xmmword [str.Apartment]
mov eax, dword [0x5ece64]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x208], eax
lea edx, [ecx + 2]
movups xmmword [ebp - 0x218], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432483
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.ThreadingModel
push dword [ebp - 0x24c]
call esi
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x4324cc
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402ce0
mov eax, dword [ebp - 0x24c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4324df
push eax
call esi
push dword [ebp - 0x250]
call esi
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x432505
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402ce0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047070c
mov esp, ebp
pop ebp
ret 4