Function at 0x401e80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a998
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x4213d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
test byte [0x4237a4], 1
lea esi, [ebx + 0xf]
jne 0x401ef0
or dword [0x4237a4], 1
mov dword [ebp - 4], ebx
push 0x20
push str.E1A60273F0F84e9a9EB231E844EBABD9
mov ecx, 0x423788
mov dword [0x42379c], esi
mov dword [0x423798], ebx
mov byte [0x423788], bl
call fcn.004063d0
push 0x41ad30
call fcn.0040a456
add esp, 4
test byte [0x4237a4], 2
jne 0x401f37
or dword [0x4237a4], 2
mov dword [ebp - 4], 1
push 0x20
push str.36D6DD7C52F14c81A1C4186971A6BB5B
mov ecx, 0x42376c
mov dword [0x423780], esi
mov dword [0x42377c], ebx
mov byte [0x42376c], bl
call fcn.004063d0
push 0x41ad00
call fcn.0040a456
add esp, 4
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov ecx, 0x423788
lea edi, [ebp - 0x34]
mov dword [ebp - 4], 2
call fcn.00401c00
test al, al
je 0x401f86
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov ecx, 0x42376c
lea edi, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.00401c00
test al, al
jne 0x401faa
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x401f86
push eax
call fcn.0040a478
add esp, 4
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x401f96
push eax
call fcn.0040a478
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0x14], ebx
mov edi, 7
test byte [0x4237a4], al
jne 0x401ffe
or dword [0x4237a4], eax
mov byte [ebp - 4], al
xor eax, eax
mov word [0x423750], ax
push 0x32
mov eax, str.SOFTWAREAntimalwareSolutionBrandScanningService
mov esi, 0x423750
mov dword [0x423764], edi
mov dword [0x423760], ebx
call fcn.00405560
push 0x41acc0
call fcn.0040a456
add esp, 4
mov byte [ebp - 4], 3
test byte [0x4237a4], 8
jne 0x402045
or dword [0x4237a4], 8
mov byte [ebp - 4], 5
xor ecx, ecx
push 0x2c
mov eax, str.SOFTWAREAntimalwareSolutionBrandAssistant
mov esi, 0x423734
mov dword [0x423748], edi
mov dword [0x423744], ebx
mov word [0x423734], cx
call fcn.00405560
push 0x41ac80
call fcn.0040a456
add esp, 4
cmp dword [0x423764], 8
mov eax, dword [0x423750]
jae 0x402058
mov eax, 0x423750
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4020b1
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x402089
push eax
call fcn.0040a478
add esp, 4
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x401f96
push eax
call fcn.0040a478
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub edx, esi
sar edx, 1
add edx, edx
push edx
push esi
push 3
push ebx
push str.mode
push eax
call edi
test eax, eax
je 0x402116
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x4020f1
push eax
call fcn.0040a478
add esp, 4
cmp esi, ebx
je 0x401f96
push esi
call fcn.0040a478
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
cmp dword [0x423748], 8
mov eax, dword [0x423734]
jae 0x402135
mov eax, 0x423734
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40217c
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
sub ecx, eax
sar ecx, 1
add ecx, ecx
push ecx
push eax
push 3
push ebx
push str.mode
push edx
call edi
test eax, eax
je 0x4021a0
mov eax, dword [ebp - 0x10]
push eax
call esi
lea esi, [ebp - 0x24]
call fcn.00405170
lea esi, [ebp - 0x34]
call fcn.00405170
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
push ecx
call esi
lea esi, [ebp - 0x24]
call fcn.00405170
lea esi, [ebp - 0x34]
call fcn.00405170
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret