Function at 0x431970
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5dba32
mov eax, dword fs:[0]
push eax
sub esp, 0x258
mov eax, dword [0x66f33c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x260], edi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x258], 0
call fcn.0047be90
add esp, 0xc
mov dword [ebp - 0x234], 7
xor eax, eax
mov dword [ebp - 0x238], 0
lea ecx, [ebp - 0x248]
mov word [ebp - 0x248], ax
push 1
push 0x5e616c
call fcn.00403000
push 0x24
push 0x5e6170
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.00405290
push 1
push 0x5e61bc
lea ecx, [ebp - 0x248]
call fcn.00405290
call fcn.004547b0
test al, al
je 0x431a6e
pop eax
push esi
pop eax
pop esp
pop edx
pop ebp
pop ebx
push edi
push edx
push edi
pop edx
push edx
push ebp
push eax
push ebp
push edx
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x24c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push ecx
push 0
push 0xf013f
push 0
push 0
push 0
push eax
push esi
call ebx
test eax, eax
jne 0x431c3d
push 2
push 0x5e61c0
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
call fcn.00403000
push 0x1d
push str.WindowsResetMasterOverlayIcon
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.00405290
push 6
push str._Class
lea ecx, [ebp - 0x230]
call fcn.00405290
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x431b15
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431b30
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e266c
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.004546e1
test al, al
je 0x431b7a
push esp
pop esp
pop ecx
pop eax
pop ecx
push esi
pop esp
push edx
push esi
pop ecx
pop eax
pop ebp
pop edx
push edx
pop esi
push ebx
pop edx
pop ecx
call fcn.004546e1
test al, al
je 0x431ba3
push ecx
push ebx
pop ecx
pop eax
pop eax
push ebp
push ebp
push ebp
push eax
pop eax
push ebx
pop ecx
pop ebx
pop edx
pop edx
pop edi
push edx
push edx
push eax
push eax
push edi
push ecx
pop ebx
pop eax
pop ebp
pop ecx
push eax
pop ecx
pop esp
push eax
pop esp
pop edi
call fcn.0045483a
test al, al
je 0x431bbf
pop ebx
pop ecx
push eax
pop edx
push edx
push edx
pop edx
pop eax
pop ecx
push esp
push esi
pop ecx
pop edi
push ecx
push ebx
push esp
push esp
push ebx
pop ebp
mov ecx, 0x13
lea edi, [ebp - 0x218]
mov esi, str.AF586CFE_FDFC_4A7B_A08E_F7FB4C08AF7D
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
movsw word es:[edi], word [esi]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431be0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.AppID
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x431c31
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00403100
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [ebp - 0x260]
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x432212
push 0
lea ecx, [ebp - 0x250]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.InprocServer32
push eax
call ebx
test eax, eax
jne 0x431dd0
push 0xffffffffffffffff
push eax
push edi
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
call fcn.00402ee0
push 0xffffffffffffffff
push 0
lea eax, [edi + 0x30]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x230]
call fcn.00405180
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x431cd0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431cf0
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e266c
push dword [ebp - 0x250]
call edi
call fcn.004543ea
test al, al
je 0x431d3a
push edi
pop esi
push ebx
push esi
push ebx
pop eax
push esi
push esp
push ebp
push edi
pop esi
push ebx
pop esp
pop esi
pop ebp
push esp
call fcn.00454726
test al, al
je 0x431d5f
push ebp
push ebx
push ebp
pop ebx
pop esi
push edi
pop edi
push edx
pop edi
pop eax
push edi
pop ebp
pop esp
pop esp
push edi
pop ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movups xmm0, xmmword [str.Apartment]
mov eax, dword [0x5e5fe0]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x208], eax
lea edx, [ecx + 2]
movups xmmword [ebp - 0x218], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431d81
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.ThreadingModel
push dword [ebp - 0x250]
call edi
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x431dd6
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00403100
jmp 0x431dd6
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
lea eax, [ebp - 0x254]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.ProgID
push dword [ebp - 0x24c]
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x431ef5
push str.WindowsResetMasterOverlayIcon
lea ecx, [ebp - 0x230]
call fcn.00403740
push 1
push 0x5e4818
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 3
call fcn.00405290
push 2
push 0x5e61c0
lea ecx, [ebp - 0x230]
call fcn.00405290
push 0x1d
push str.WindowsResetMasterOverlayIcon
lea ecx, [ebp - 0x230]
call fcn.00405290
push 2
push 0x5e6284
lea ecx, [ebp - 0x230]
call fcn.00405290
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x431e80
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431ea0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e266c
push dword [ebp - 0x254]
call edi
push dword [ebp - 0x254]
call esi
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x431ef5
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00403100
push 0
lea eax, [ebp - 0x264]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.Programmable
push dword [ebp - 0x24c]
call ebx
push 0
lea eax, [ebp - 0x25c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.TypeLib
push dword [ebp - 0x24c]
call ebx
test eax, eax
jne 0x431ffd
push 0x5e616c
lea ecx, [ebp - 0x230]
call fcn.00403740
push 0x24
push str.20829028_3AA4_4A37_857D_5AD484DEDE83
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 4
call fcn.00405290
push 1
push 0x5e61bc
lea ecx, [ebp - 0x230]
call fcn.00405290
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x431f95
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431fb0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e266c
push dword [ebp - 0x25c]
call edi
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x431ffd
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00403100
call fcn.00454a62
test al, al
je 0x43201f
push edx
push ecx
pop ecx
pop ecx
push ecx
push esp
push esi
pop ebp
pop ebp
push ebp
pop ecx
pop eax
push ecx
push eax
push edi
push eax
pop ebx
pop ebx
push esp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push 0
lea eax, [ebp - 0x258]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.VersionIndependentProgID
push dword [ebp - 0x24c]
call ebx
test eax, eax
jne 0x432125
push str.WindowsResetMasterOverlayIcon
lea ecx, [ebp - 0x230]
call fcn.00403740
push 1
push 0x5e4818
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 5
call fcn.00405290
push 2
push 0x5e61c0
lea ecx, [ebp - 0x230]
call fcn.00405290
push 0x1d
push str.WindowsResetMasterOverlayIcon
lea ecx, [ebp - 0x230]
call fcn.00405290
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4320b0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4320d0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e266c
push dword [ebp - 0x258]
call edi
push dword [ebp - 0x258]
call esi
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x432125
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00403100
call fcn.00454a62
test al, al
je 0x432141
push esi
push edx
push eax
pop ebp
pop edx
pop edx
push edx
pop ebx
push ebp
pop eax
pop ebp
push eax
push esi
pop eax
pop esp
pop ecx
pop ecx
pop ebx
push ebp
mov eax, dword [ebp - 0x25c]
test eax, eax
je 0x43214e
push eax
call esi
call fcn.00454543
test al, al
je 0x43216e
pop ecx
pop eax
pop edx
pop esi
pop ebx
push edi
push esi
push esi
pop edx
pop eax
pop esp
push ebx
pop ecx
pop ebx
pop ebp
pop edx
push ebx
pop eax
pop eax
pop ebp
push eax
pop ebp
push esi
call fcn.004544b9
test al, al
je 0x432188
pop esi
push edx
push edx
pop edi
pop esi
pop eax
pop esi
push edi
push esi
pop edx
pop edi
push ebx
pop esp
push edi
pop ecx
push eax
pop edx
call fcn.0045483a
test al, al
je 0x4321ab
push edx
pop edi
push esp
push eax
push eax
pop esp
pop ebp
pop edi
pop eax
push edx
pop edx
push esi
push ecx
push eax
push edx
push ebp
pop edi
push ebx
pop edi
pop eax
push esi
pop edx
pop edx
pop esp
pop ebp
push edi
mov eax, dword [ebp - 0x264]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4321be
push eax
call esi
call fcn.004549d8
test al, al
je 0x4321e1
push eax
push edi
pop edi
push ecx
pop ebx
push edi
pop edi
pop eax
pop esp
pop eax
pop edx
push eax
pop ebp
pop esp
pop ecx
push esi
pop edx
pop ebx
push edi
pop ebx
push eax
pop ecx
push ebx
pop edi
push esi
push eax
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x4321ee
push eax
call esi
call fcn.00454a62
test al, al
je 0x43220a
push ecx
push ebp
push eax
pop esp
pop ecx
push edx
pop esp
pop ebp
pop ecx
push esp
push ebx
push edx
pop edi
pop esp
pop ebp
pop edx
push edx
push ecx
pop ecx
push dword [ebp - 0x24c]
call esi
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x432230
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00403100
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045132d
mov esp, ebp
pop ebp
ret 4