Function at 0x408ac0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5383f8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x58d140]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push str.IsWow64Process
xor ebx, ebx
push str.kernel32
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, ebx
je 0x408b17
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp + 8]
neg esi
sbb esi, esi
push ecx
and esi, 0xffffff00
lea ecx, [ebp - 0x10]
add esi, 0x200
call fcn.00405f00
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00405f00
mov byte [ebp - 4], 1
mov edi, dword [ebp - 0x10]
mov dword [ebp + 8], SysReAllocStringLen
cmp dword [edi - 0xc], ebx
jl 0x408ba1
push str.HKEY_LOCAL_MACHINE
push edi
call fcn.0050eae8
add esp, 8
cmp eax, ebx
je 0x408b7a
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
jle 0x408b7a
mov dword [ebp + 8], reloc.OLEAUT32.dll_SysReAllocString
cmp dword [edi - 0xc], ebx
jl 0x408ba1
push str.HKEY_CURRENT_USER
push edi
call fcn.0050eae8
add esp, 8
cmp eax, ebx
je 0x408ba1
sub eax, edi
sar eax, 1
cmp eax, 0xffffffff
jle 0x408ba1
mov dword [ebp + 8], SysReAllocStringLen
push 0x567edc
push 0x568298
lea ecx, [ebp - 0x10]
call fcn.00402bd0
push 0x567edc
push 0x567ee0
lea ecx, [ebp - 0x10]
call fcn.00402bd0
push 0x56802c
push str.HKEY_CURRENT_USER_
lea ecx, [ebp - 0x10]
call fcn.00402bd0
push 0x56802c
push str.HKEY_LOCAL_MACHINE_
lea ecx, [ebp - 0x10]
call fcn.00402bd0
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax - 0xc]
mov edi, dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push ecx
push eax
call edi
cmp eax, ebx
jne 0x408c0f
call fcn.00401580
mov edx, dword [ebp + 8]
mov ecx, esi
or ecx, 0x2001f
push ecx
push eax
push edx
lea ecx, [ebp - 0x24]
call fcn.00409960
cmp eax, ebx
je 0x408cc8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx - 0xc]
push eax
push ecx
call edi
cmp eax, ebx
jne 0x408c40
call fcn.00401580
push ebx
push ebx
or esi, 0xf003f
push esi
push ebx
push ebx
push eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x24]
call fcn.004096f0
test eax, eax
je 0x408cc8
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x408c6a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408c8c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408cb2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov ecx, dword [eax - 0xc]
push ecx
push eax
call edi
mov esi, eax
cmp esi, ebx
jne 0x408cdf
call fcn.00401580
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax - 0xc]
push ecx
push eax
call edi
mov edi, eax
cmp edi, ebx
jne 0x408cf6
call fcn.00401580
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push esi
mov esi, dword [ebp - 0x24]
push 1
push ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
sete byte [ebp + 0xb]
cmp esi, ebx
je 0x408d22
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], bl
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408d44
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x408d6a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov al, byte [ebp + 0xb]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc