Function at 0x411dd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5c0e78
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x64b9b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x24], ebx
push ecx
call fcn.004126d0
call fcn.00402810
mov ecx, eax
test ecx, ecx
jne 0x411e18
push 0x80004005
call fcn.004022b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push 0x622f48
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push str.Frien_same
push eax
call fcn.004043e0
add esp, 0xc
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.00412640
mov byte [ebp - 4], 1
or esi, 0xffffffff
mov eax, dword [ebx + 4]
mov edi, dword [ebx]
mov dword [ebp - 0x38], eax
cmp edi, eax
je 0x412056
call fcn.00402810
test eax, eax
je 0x411e0e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x14]
push dword [ebp + 8]
push dword [edi]
push str._s__s
push eax
call fcn.004043e0
mov edx, edi
lea ecx, [ebp - 0x2c]
call fcn.004124b0
push eax
mov edx, str.SOFTWAREClasses_
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x10]
call fcn.00414570
add esp, 0x14
mov byte [ebp - 4], 5
mov eax, esi
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x411ecc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x10]
push 0
push dword [ebp - 0x14]
call fcn.00411a80
push edi
lea eax, [ebp - 0x34]
mov ecx, ebx
push eax
call fcn.00412980
mov esi, eax
push str.DefaultIcon
lea edx, [ebp - 0x10]
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x30]
call fcn.00407900
add esp, 4
mov edx, dword [eax]
push 0
push dword [esi]
call fcn.00411a80
mov edx, dword [ebp - 0x30]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x411f26
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
mov eax, ebx
mov edx, dword [ebp - 0x34]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x411f44
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00402810
test eax, eax
je 0x411e0e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
push str.ellop
mov byte [ebp - 4], 7
lea eax, [ebp - 0x1c]
push dword [ebp - 0x10]
push str._s_sh_sen
push eax
call fcn.004043e0
mov ebx, dword [ebp - 0x1c]
add esp, 0x10
mov edx, ebx
push dword [ebp - 0x18]
push dword [ebp + 0xc]
call fcn.00411a80
call fcn.00402810
test eax, eax
je 0x411e0e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
push str.ellopenco
mov byte [ebp - 4], 8
lea eax, [ebp - 0x20]
push dword [ebp - 0x10]
push str._s_sh_smmand
push eax
call fcn.004043e0
mov esi, dword [ebp - 0x20]
add esp, 0x10
mov edx, esi
push 0
push dword [ebp - 0x28]
call fcn.00411a80
mov byte [ebp - 4], 7
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x411fed
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
or esi, 0xffffffff
mov byte [ebp - 4], 5
add ebx, 0xfffffff0
mov eax, esi
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x41200b
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
mov eax, esi
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x412029
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov eax, esi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x412047
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x24]
add edi, 4
cmp edi, dword [ebp - 0x38]
jne 0x411e62
call fcn.00402810
mov ecx, eax
test ecx, ecx
jne 0x41206b
push 0x80004005
call fcn.004022b0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp + 8], eax
push str.tionAssociation
push str.tVersionA
lea eax, [ebp + 8]
mov byte [ebp - 4], 9
push str.SOFTWAREMicrosoftWindowsCurren_spplica_sToasts
push eax
call fcn.004043e0
add esp, 0x10
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 0xa
mov esi, dword [ebp + 8]
push eax
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push esi
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4120ea
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 0
mov edi, dword [ebx]
mov ebx, dword [ebx + 4]
cmp edi, ebx
je 0x41242c
mov esi, dword [edi]
mov ecx, 0x6230b4
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412126
test dx, dx
je 0x412122
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412126
add eax, 4
add ecx, 4
test dx, dx
jne 0x412100
xor eax, eax
jmp 0x41212b
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
jne 0x412314
mov ecx, 0x6230bc
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412166
test dx, dx
je 0x412162
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412166
add eax, 4
add ecx, 4
test dx, dx
jne 0x412140
xor eax, eax
jmp 0x41216b
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
jne 0x412314
mov ecx, 0x6230c4
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4121a6
test dx, dx
je 0x4121a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4121a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x412180
xor eax, eax
jmp 0x4121ab
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
jne 0x412314
mov ecx, str.heic
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4121e6
test dx, dx
je 0x4121e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4121e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4121c0
xor eax, eax
jmp 0x4121eb
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
jne 0x412314
mov ecx, 0x6230d8
mov eax, esi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412226
test dx, dx
je 0x412222
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412226
add eax, 4
add ecx, 4
test dx, dx
jne 0x412200
xor eax, eax
jmp 0x41222b
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
jne 0x412314
mov eax, str.jfif
nop dword [eax]
mov cx, word [esi]
cmp cx, word [eax]
jne 0x412266
test cx, cx
je 0x412262
mov cx, word [esi + 2]
cmp cx, word [eax + 2]
jne 0x412266
add esi, 4
add eax, 4
test cx, cx
jne 0x412240
xor eax, eax
jmp 0x41226b
sbb eax, eax
or eax, 1
test eax, eax
sete al
test al, al
jne 0x412314
mov edx, 0x6230ec
mov ecx, edi
call fcn.004078b0
test al, al
jne 0x412314
mov edx, str.jpeg
mov ecx, edi
call fcn.004078b0
test al, al
jne 0x412314
mov edx, 0x623100
mov ecx, edi
call fcn.004078b0
test al, al
jne 0x412314
mov edx, 0x623108
mov ecx, edi
call fcn.004078b0
test al, al
jne 0x412314
mov edx, 0x623110
mov ecx, edi
call fcn.004078b0
test al, al
jne 0x412314
mov edx, 0x623118
mov ecx, edi
call fcn.004078b0
test al, al
jne 0x412314
mov edx, str.tiff
mov ecx, edi
call fcn.004078b0
test al, al
jne 0x412314
mov edx, 0x62312c
mov ecx, edi
call fcn.004078b0
test al, al
jne 0x412314
mov edx, str.avif
mov ecx, edi
call fcn.004078b0
test al, al
je 0x412384
call fcn.00402810
test eax, eax
je 0x411e0e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
mov byte [ebp - 4], 0xb
lea eax, [ebp + 0xc]
push dword [edi]
push str.3hnxtbyyps62jhe9
push str.AppX4_ssqpdzxn1790zetc_._s
push eax
call fcn.004043e0
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x38]
add esp, 0x10
mov dword [ebp - 0x38], 0
push 4
push eax
push 4
push 0
push esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 0xa
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x412384
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.00402810
test eax, eax
je 0x411e0e
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp + 0xc], eax
mov edx, edi
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x34]
call fcn.004124b0
mov byte [ebp - 4], 0xd
push dword [edi]
push dword [eax]
lea eax, [ebp + 0xc]
push str._s_._s
push eax
call fcn.004043e0
mov byte [ebp - 4], 0xc
add esp, 0x10
mov edx, dword [ebp - 0x34]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4123e4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x38]
push 4
push eax
push 4
push 0
push esi
push dword [ebp - 0x44]
mov dword [ebp - 0x38], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 0xa
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x41241e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 4
cmp edi, ebx
jne 0x4120f7
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x41243a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or ebx, 0xffffffff
mov byte [ebp - 4], 1
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x412458
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
mov eax, ebx
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x412476
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x412495
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc