Function at 0x434b50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e1611
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x676314]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x258], 0
call fcn.004830b0
add esp, 0xc
call fcn.0047337c
test al, al
je 0x434c06
xchg ebp, eax
das
in eax, 0xe
push esp
adc eax, 0x35f01278
retf 0x4295
call fcn.0047355f
test al, al
je 0x434c25
adc bl, byte [edi]
cmp ecx, ebx
shl byte [ecx + 0x357d862], cl
mov bh, 0x32
mov ebx, 0xafebe0c1
cwde
push ds
test al, 0x2c
add al, 0xe8
stosd dword es:[edi], eax
call 0xc0c74c2f
call fcn.004734d5
test al, al
je 0x434c46
mov al, byte [0xfcc1789]
push cs
aad 0x16
imul eax, esp, 0x1e
mov ebp, 0xa94c18c5
retf
call fcn.00473925
test al, al
je 0x434c69
into
and al, 0x3e
ret 0x4945
push 1
xor eax, eax
mov dword [ebp - 0x234], 7
push 0x5ebfd8
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], 0
add byte [eax], al
mov word [ebp - 0x248], ax
call fcn.00402650
push 0x24
push str.32CFDBDB_9FA1_44CE_887B_5E4917AAF92B
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.00405710
push 1
push 0x5ec02c
lea ecx, [ebp - 0x248]
call fcn.00405710
call fcn.00473811
test al, al
je 0x434ce0
xlatb
mov eax, dword [0x800dec9b]
mov word [edi], ds
jp 0x434d15
imul ebp, dword [edx], 0x7b14bd6e
imul esp, dword [edx - 0x137a17b1], 3
add byte [eax + eax*8 - 0x2e3ee8c], al
call fcn.0047396a
test al, al
je 0x434cfa
sbb al, 0xfd
cmp esp, dword [edi - 0x7673040d]
jno 0x434c8a
mov ch, 0x15
in eax, 0xdd
mov eax, dword [0xbd83e26a]
int3
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x264]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push ecx
push 0
push 0xf003f
push 0
test dword [eax + 0x6afffffd], edi
add byte [ecx + 0x6a], dl
add byte [eax + 0x3f], ch
add byte [edi], cl
add byte [edx], ch
push 0
push 0
push eax
push dword [ebp - 0x268]
call ebx
test eax, eax
jne 0x4352e4
call fcn.004732ad
test al, al
je 0x434d59
into
push es
ja 0x434cfa
mov cl, 0xb6
mov esp, 0xdd119de7
cmp ebp, esp
insd dword es:[edi], dx
push eax
ja 0x434d85
xor ah, dh
cmp eax, dword [ebp + 0x31]
hlt
call fcn.00473742
test al, al
je 0x434d7e
nop
invalid
push 0
lea eax, [ebp - 0x250]
push eax
push 0
push 0xf003f
push 0
call dword [eax + 0x6a]
add byte [eax + 0x3f], ch
add byte [edi], cl
add byte [edx], ch
push 0
push 0
push 0x5e8a44
push dword [ebp - 0x264]
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x4352bc
call fcn.0047355f
test al, al
je 0x434dd3
out 3, eax
add byte [eax + eax*8 - 0x595fe48c], al
ja 0x434d54
mov al, byte [0xb79877a6]
out dx, eax
mov bh, 0xef
and esp, ebp
mov ah, 0xd1
xor dword [esi - 0xe], esp
ljmp 0xde0a
push 0
lea eax, [ebp - 0x24c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5e8a4c
push dword [ebp - 0x250]
call ebx
test eax, eax
jne 0x43508c
call fcn.0047337c
test al, al
je 0x434e2b
stosb byte es:[edi], al
bound esi, qword [ecx]
pop edx
salc
inc esi
aam 0x8c
xor ecx, dword [eax - 0x2e]
cmpsd dword [esi], dword es:[edi]
in eax, dx
mov byte [0x11349745], al
aaa
mov bh, 0x6e
push cs
lds esi, [esi + 0x31e220c1]
insb byte es:[edi], dx
jl 0x434db1
sbb eax, sym.imp.ADVAPI32.dll_RegCreateKeyExW
call fcn.0047351a
test al, al
je 0x434e4c
ret
push 0
lea eax, [ebp - 0x254]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.win32
push dword [ebp - 0x24c]
call ebx
test eax, eax
jne 0x434f2e
call fcn.004022d0
mov ecx, eax
call fcn.004710c9
push eax
lea ecx, [ebp - 0x230]
call fcn.00403b30
push str.NSExt32.dll
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.0040aae0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x434ec0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434ee0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e87f0
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x254]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00448f80
jmp 0x434f34
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
lea eax, [ebp - 0x258]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.win64
push dword [ebp - 0x24c]
call ebx
test eax, eax
jne 0x43503c
call fcn.004736fd
test al, al
je 0x434f86
pop es
invalid
call fcn.004022d0
mov ecx, eax
call fcn.004710c9
push eax
lea ecx, [ebp - 0x230]
call fcn.00403b30
push str.NSExt64.dll
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.0040aae0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x434fd0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434ff0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e87f0
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x258]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00448f80
cmp dword [ebp - 0x24c], 0
je 0x43508c
call fcn.004737cc
test al, al
je 0x435064
fild word [ebx + 0x35]
pushfd
invalid
call fcn.004735e9
test al, al
je 0x435084
in eax, 3
add byte [eax + eax*8 - 0x1bace88c], al
dec ebp
push ebx
in al, 0x4d
jle 0x435066
invalid
push dword [ebp - 0x24c]
call edi
call fcn.004732ad
test al, al
je 0x4350ae
lds ebx, [edx - 0x52]
sbb ecx, dword [esi + 0x70571b1]
mov dword [0xab77401e], eax
scasd eax, dword es:[edi]
mov ebp, 0xaa7f8c34
ljmp 0xe68f
call fcn.00473742
test al, al
je 0x4350ce
invalid
call fcn.004732ad
test al, al
je 0x4350ee
jae 0x435123
sub dword [edx - 0x23], esi
mov al, 0x6e
and dl, byte [esi + 0x48]
in al, 0x66
hlt
push 0
lea eax, [ebp - 0x25c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.FLAGS
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43516b
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], 0x30
lea edx, [ecx + 2]
nop dword [eax]
invalid
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435130
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e87f0
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
adc eax, sym.imp.ADVAPI32.dll_RegSetValueExW
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00473811
test al, al
je 0x435188
dec ebp
mov eax, 0xf0b75f01
add eax, 0x7e2f1701
in eax, dx
sub al, 0x27
xchg dword [ebp + 0x73], esp
or ebp, dword [edx + 0x3e7dde8]
add byte [eax + eax*8 - 0x4f2fee8c], al
aam 0xa2
or byte [esi - 0x36bc260], ch
push edx
call fcn.0047396a
test al, al
je 0x4351a2
sal byte [eax - 0x51f75d2c], 1
mov al, byte [0x52fc943d]
js 0x43515a
lcall 0x8d00, 0x6a7f669b
test dword [eax + 0x50fffffd], esp
push 0
lea eax, [ebp - 0x260]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.HELPDIR
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x435266
call fcn.004022d0
mov ecx, eax
call fcn.004710c9
push eax
lea ecx, [ebp - 0x230]
call fcn.00403b30
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x435203
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x435220
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e87f0
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x230]
call fcn.00448f80
call fcn.004732ad
test al, al
je 0x435284
push ecx
dec ebp
test dword [ebx + 0x39], edx
ja 0x435203
in al, dx
fmul qword [esi]
dec esi
xor al, byte [edx]
dec ebx
cmp al, byte [ebx + 0x108eaba]
call fcn.00473742
test al, al
je 0x4352a9
inc esi
sub eax, 0x6f0e1469
push esi
inc eax
pushal
pushfd
adc dword [esi], edi
dec edi
mov ecx, 0xf9c28993
mov eax, dword [0x5eb30732]
invalid
mov eax, dword [ebp - 0x250]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4352bc
push eax
call edi
call fcn.00473856
test al, al
je 0x4352d7
inc ebp
sbb eax, 0x415b61be
dec esp
invalid
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x4352e4
push eax
call edi
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x435302
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402750
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ce06
mov esp, ebp
pop ebp
ret 4