Function at 0x418b40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
call fcn.0042af76
test al, al
je 0x418b73
xor esi, dword [edi + 0x19523c8f]
invalid
call fcn.0042aeec
test al, al
je 0x418b97
sti
lahf
aas
sbb esp, dword [eax]
mov byte [ebx + 0x5d0a6ddc], bh
lodsb al, byte [esi]
or esp, dword [esi + 0x53]
retf 0x107c
call fcn.0042aea7
test al, al
je 0x418bb9
jno 0x418bc1
sub dword [ecx + 0x7d], ecx
xchg ecx, eax
cld
dec esi
mov ch, ah
xchg dword [esi - 0x4a], edi
jnp 0x418bb7
or ah, byte [edx]
mov word [edi - 0x19], gs
ret 0x9a5
aas
add dword [ebp + 0x6850fc45], ecx
aas
add dword [edi], ecx
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
add byte [edx], ch
push dword [ebp + 0xc]
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x418da3
call fcn.0042add8
test al, al
je 0x418bf5
jg 0x418be5
xchg esi, eax
jg 0x418c64
cmp dl, cl
outsb dx, byte [esi]
cld
cli
invalid
call fcn.0042aa9c
test al, al
je 0x418c19
add al, cl
jg 0x418bfe
push edi
out 0x87, al
sub dword [edi - 0x22b8d155], eax
xor eax, 0x4dc2b3b1
lea edx, [edx + edi*4]
xchg ebp, eax
mov al, byte [0x4a822037]
call fcn.0042aa9c
test al, al
je 0x418c3d
cmc
std
push eax
mov byte [0xc9b8ecd8], al
push esp
salc
hlt
lea eax, [ebp - 8]
mov ebx, 0xf013f
push eax
push ebx
xor edi, edi
push edi
push str.SoftWare
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x418c6a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x418da3
add cl, ch
cmp dword [ecx], eax
add byte [eax], al
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x418c99
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
call esi
push dword [ebp - 4]
call esi
jmp 0x418da3
call fcn.0042aae1
test al, al
je 0x418cb5
enter 0xffffffffffffcf3e, 0xfffffffffffffff1
inc ecx
xchg esp, eax
cmc
ret
call fcn.0042aa57
test al, al
je 0x418cd4
sbb byte [ecx], bl
nop
fiadd word [edi + 0x7f]
invalid
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push 0xf013f
push edi
push edi
push edi
push dword [ebp + 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x418cff
push dword [ebp - 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x418c8a
push dword [ebp + 0x18]
call fcn.00578706
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x18]
push 1
push edi
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0xc]
call edi
call fcn.0042ae1d
test al, al
je 0x418d4b
sub byte [edx - 0x7d6ddb8e], ah
shr dword [ebx + eax*8], 0xac
mov edi, 0xdcbcad70
sub al, ch
sbb ebx, dword [esi]
add dword [eax], eax
call fcn.0042ab6b
test al, al
je 0x418d6b
hlt
call fcn.0042aa57
test al, al
je 0x418d99
push edi
dec ebp
int 0xdc
mov byte [ebx], bl
jp 0x418d54
pop ecx
mov edx, 0xdafc13e7
int3
push dword [ebp - 8]
call edi
push dword [ebp - 4]
call edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret