Function at 0x8467910
Capabilities:
Contain obfuscated stackstrings
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1b0
mov eax, dword [0x184002c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, ecx
push edi
mov dword [ebp - 0x1b0], eax
call fcn.08471520
test eax, eax
jne 0x846794f
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], str.APPID
push eax
push 1
push 0x65
push dword [0x18403f5c]
mov dword [ebp - 0x10], str.4031db0c_b05e_43bd_ac1b_e1f4d5da0516
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call fcn.08478270
test eax, eax
js 0x8467fb6
push 0x20006
sub esp, 0xc
mov dword [ebp - 0x70], 0x31385447
mov ecx, esp
mov dword [ebp - 0x6c], 0x32595147
lea eax, [ebp - 0x16]
mov dword [ebp - 0x68], 0x6d74574d
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0x44345342
push dword [ebp - 0xa0]
mov dword [ebp - 0x60], 0x54416a49
push eax
lea eax, [ebp - 0x70]
mov dword [ebp - 0x5c], 0x48775444
mov dword [ebp - 0x58], 0x70635250
mov dword [ebp - 0x54], 0x464d794d
mov dword [ebp - 0x50], 0x78777845
mov dword [ebp - 0x4c], 0x36417a45
mov dword [ebp - 0x48], 0x39777742
mov dword [ebp - 0x44], 0x76556948
mov dword [ebp - 0x40], 0x6d394741
mov dword [ebp - 0x3c], 0x686b7a44
mov dword [ebp - 0x38], 0x79386e45
mov dword [ebp - 0x34], 0x58594449
mov dword [ebp - 0x30], 0x4563444f
mov dword [ebp - 0x2c], 0x685a7747
mov dword [ebp - 0x28], 0x306b544e
mov dword [ebp - 0x24], 0x6f34515a
mov dword [ebp - 0x20], 0x4e55514e
mov dword [ebp - 0x1c], 0x41414141
mov word [ebp - 0x18], 0x674f
push eax
movq qword [ebp - 0x9c], xmm0
mov dword [ebp - 0x94], 0
push 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.08405280
lea eax, [ebp - 0x10]
push eax
call fcn.0844ba20
add esp, 0x10
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub eax, ecx
sar eax, 1
je 0x8467fc9
push ecx
push SysReAllocStringLen
lea ecx, [ebp - 0x9c]
call fcn.084657b0
mov ecx, dword [ebp - 0x10]
mov esi, eax
test ecx, ecx
je 0x8467aca
push ecx
call fcn.0849b460
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x9c]
test esi, esi
je 0x8467aea
push esi
call fcn.084498b0
add esp, 4
mov esi, eax
jmp 0x8467fad
push 0
push 0
push 0x2001f
push 0
push 0
xorps xmm0, xmm0
mov dword [ebp - 0x94], 0
push str.4031db0c_b05e_43bd_ac1b_e1f4d5da0516
movq qword [ebp - 0x9c], xmm0
lea ecx, [ebp - 0x9c]
push edi
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
call fcn.0844ac00
mov ebx, dword [ebp - 0x9c]
test eax, eax
je 0x8467b55
push eax
call fcn.084498b0
add esp, 4
mov esi, eax
jmp 0x8467f98
push 0
sub esp, 0xc
mov dword [ebp - 0x1a8], 0x6d414346
mov ecx, esp
mov dword [ebp - 0x1a4], 0x5234534d
lea eax, [ebp - 0xa2]
mov dword [ebp - 0x1a0], 0x6773694c
mov dword [ebp - 0x19c], 0x336f4350
push dword [ebp - 0xa0]
mov dword [ebp - 0x198], 0x50637846
push eax
lea eax, [ebp - 0x1a8]
mov dword [ebp - 0x194], 0x59776e42
mov dword [ebp - 0x190], 0x686b674f
mov dword [ebp - 0x18c], 0x67706747
mov dword [ebp - 0x188], 0x6e413241
mov dword [ebp - 0x184], 0x5667534f
mov dword [ebp - 0x180], 0x4a556750
mov dword [ebp - 0x17c], 0x4e516743
mov dword [ebp - 0x178], 0x67317a45
mov dword [ebp - 0x174], 0x64517946
mov dword [ebp - 0x170], 0x45514348
mov dword [ebp - 0x16c], 0x2f56684a
mov dword [ebp - 0x168], 0x4a6b485a
mov dword [ebp - 0x164], 0x41415841
mov dword [ebp - 0x160], 0x51453241
mov dword [ebp - 0x15c], 0x3435684a
mov dword [ebp - 0x158], 0x33684449
mov dword [ebp - 0x154], 0x314e694d
mov dword [ebp - 0x150], 0x734d784c
mov dword [ebp - 0x14c], 0x36456747
mov dword [ebp - 0x148], 0x4863774a
mov dword [ebp - 0x144], 0x4e77444a
mov dword [ebp - 0x140], 0x75454150
mov dword [ebp - 0x13c], 0x2f556a4c
mov dword [ebp - 0x138], 0x526b7859
mov dword [ebp - 0x134], 0x386f515a
mov dword [ebp - 0x130], 0x7059444b
mov dword [ebp - 0x12c], 0x41675461
mov dword [ebp - 0x128], 0x5a45684c
mov dword [ebp - 0x124], 0x4e6b4841
mov dword [ebp - 0x120], 0x4b77794e
mov dword [ebp - 0x11c], 0x724d4741
mov dword [ebp - 0x118], 0x6e637a4f
mov dword [ebp - 0x114], 0x2b307a43
mov dword [ebp - 0x110], 0x54387a4c
mov dword [ebp - 0x10c], 0x4f734461
mov dword [ebp - 0x108], 0x2f676a47
mov dword [ebp - 0x104], 0x7438324e
mov dword [ebp - 0x100], 0x7549444b
mov dword [ebp - 0xfc], 0x546f7a4c
mov dword [ebp - 0xf8], 0x2b73444d
mov dword [ebp - 0xf4], 0x39526742
mov dword [ebp - 0xf0], 0x3535334e
mov dword [ebp - 0xec], 0x6a685749
mov dword [ebp - 0xe8], 0x62496a62
mov dword [ebp - 0xe4], 0x4463774e
mov dword [ebp - 0xe0], 0x38394841
mov dword [ebp - 0xdc], 0x4a554147
mov dword [ebp - 0xd8], 0x34415444
mov dword [ebp - 0xd4], 0x7239774e
mov dword [ebp - 0xd0], 0x50347a4b
mov dword [ebp - 0xcc], 0x4d555347
mov dword [ebp - 0xc8], 0x54386a50
mov dword [ebp - 0xc4], 0x44416843
mov dword [ebp - 0xc0], 0x676f534d
mov dword [ebp - 0xbc], 0x55776e45
mov dword [ebp - 0xb8], 0x79645446
mov dword [ebp - 0xb4], 0x616b774a
mov dword [ebp - 0xb0], 0x6e30674b
mov dword [ebp - 0xac], 0x6f775444
mov dword [ebp - 0xa8], 0x41414141
mov word [ebp - 0xa4], 0x4174
push eax
push 0
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
call fcn.08405280
lea eax, [ebp - 0x10]
push eax
call fcn.0844ba20
add esp, 0x10
mov ecx, eax
call fcn.08417430
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x10]
call fcn.0840b0f0
cmp byte [ebp + 8], 0
je 0x8467f96
mov esi, dword [ebp - 0x1b0]
lea edx, [ebp - 0x15]
push 1
mov dword [ebp - 0x90], 0x6d414346
mov dword [ebp - 0x8c], 0x5234534d
lea eax, [esi + 0x2c]
mov dword [ebp - 0x88], 0x6773694c
push eax
push 0
sub esp, 0xc
mov dword [ebp - 0x84], 0x336f4350
mov ecx, esp
mov dword [ebp - 0x80], 0x63634159
lea eax, [ebp - 0x1a9]
mov dword [ebp - 0x7c], 0x50517a64
mov dword [ebp - 0x78], 0x6b304844
push eax
push edx
lea eax, [ebp - 0x90]
mov dword [ebp - 0x74], 0x65455363
push eax
mov dword [ebp - 0x70], 0x32594241
mov dword [ebp - 0x6c], 0x30355841
mov dword [ebp - 0x68], 0x41305246
mov dword [ebp - 0x64], 0x316b6747
mov dword [ebp - 0x60], 0x6a64784d
mov dword [ebp - 0x5c], 0x57306946
mov dword [ebp - 0x58], 0x57636749
mov dword [ebp - 0x54], 0x6245674d
mov dword [ebp - 0x50], 0x314a7946
mov dword [ebp - 0x4c], 0x6d784843
mov dword [ebp - 0x48], 0x53454146
mov dword [ebp - 0x44], 0x6745545a
mov dword [ebp - 0x40], 0x5673794b
mov dword [ebp - 0x3c], 0x5067534a
mov dword [ebp - 0x38], 0x3330434a
mov dword [ebp - 0x34], 0x366b584f
mov dword [ebp - 0x30], 0x4741784e
mov dword [ebp - 0x2c], 0x47495243
mov dword [ebp - 0x28], 0x32674449
mov dword [ebp - 0x24], 0x6f4d6845
mov dword [ebp - 0x20], 0x7a644450
mov dword [ebp - 0x1c], 0x41415161
mov word [ebp - 0x18], 0x4541
mov byte [ebp - 0x16], 0x77
call fcn.08409550
lea eax, [ebp - 0x10]
push eax
call fcn.0844ba20
add esp, 0x10
mov ecx, eax
call fcn.08417430
push eax
lea ecx, [ebp - 0x9c]
call fcn.0846cfe0
lea ecx, [ebp - 0x10]
call fcn.0840b0f0
mov ecx, esi
call fcn.0845fa70
test eax, eax
jne 0x8467f96
mov esi, 0x80004005
jmp 0x8467f98
xor esi, esi
test ebx, ebx
je 0x8467fa7
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
jmp 0x8467fad
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x8467fb4
push edi
call ebx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0849cd1e
mov esp, ebp
pop ebp
ret 4
push str.invalid_vector_T__subscript
call fcn.0847ecf2
int3