Function at 0x4317d1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
call fcn.0043d81c
test al, al
je 0x431804
stosb byte es:[edi], al
invalid
call fcn.0043d792
test al, al
je 0x431828
and eax, dword [esi - 0x1d]
jbe 0x4317f2
out dx, eax
test al, 0xf8
push ebx
xor edx, 0x6f2199ea
jl 0x431831
pop eax
mov ebp, 0xe809cb4a
fnstenv [esi]
adc al, 0x6f
call fcn.0043d74d
test al, al
je 0x43184a
cmp ch, byte [ebx + 0x2d632385]
enter 0x3951, 0xffffffffffffff99
jge 0x4318ab
pop ss
mov esp, 0x37d3f864
and ebx, edx
xchg edx, eax
sbb byte [ecx - 0x65], cl
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
push dword [ebp + 0xc]
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x431a34
call fcn.0043d67e
test al, al
je 0x431886
arpl word [edi], bp
invalid
cmpsb byte [esi], byte es:[edi]
sub esp, dword [ebx + 0x70]
wait
ljmp 0xd167
call fcn.0043d342
test al, al
je 0x4318aa
mov ch, 0x94
mov edi, ebx
or byte [eax + edi*2 + 0x14bddc9c], 0x2d
lodsd eax, dword ds:[esi]
add dword [edx - 0x34], edi
invalid
call fcn.0043d342
test al, al
xchg ebx, eax
mov edx, 0xc0840000
je 0x4318ce
out dx, eax
jae 0x4318ce
fistp word [ecx - 0xa]
loope 0x431878
pop edi
mov eax, dword [0x677982a2]
retf 0x5d34
lea eax, [ebp - 8]
mov ebx, 0xf013f
push eax
push ebx
xor edi, edi
push edi
push 0x5a8224
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4318fb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x431a34
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x43192a
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call esi
push dword [ebp - 4]
cld
call esi
jmp 0x431a34
call fcn.0043d387
test al, al
je 0x431946
mov byte [edx + ebx*2 + 0x2a1f3532], dl
sbb bh, dl
xchg edi, eax
loop 0x431903
sbb dword [edx - 0x59], esi
sbb esi, dword [0xb2e8ff33]
mov ecx, 0xc0840000
call fcn.0043d2fd
test al, al
je 0x431965
push 0x69d62e7e
aad 0xf6
fcom dword [ebx + 0x4c]
jne 0x431990
imul ecx, esi, 0x54eb68c9
ja 0x431922
mov esi, 0x458d5746
invalid
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0xf013f
push edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x431990
push dword [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x43191b
push dword [ebp + 0x18]
call fcn.004549d7
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x18]
push 1
push edi
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0xc]
call edi
call fcn.0043d6c3
test al, al
je 0x4319dc
dec esi
salc
jmp 0xc9bb102a
call fcn.0043d411
test al, al
je 0x4319fc
in al, 0xfc
fisttp qword [esi + 0x7f]
ficom dword [eax + 0x733150e]
mov byte [0x3cefa316], al
test al, 0x7d
pop ebx
adc bl, byte [edi - 0x3f]
and al, 0xe8
cld
mov eax, 0xc0840000
call fcn.0043d2fd
test al, al
je 0x431a2a
sbb esi, ebx
sub eax, 0xfc632163
push dword [ebp - 8]
call edi
push dword [ebp - 4]
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret