Function at 0x431fa0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df871
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], ecx
mov eax, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x268], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x258], 0
call fcn.00480640
add esp, 0xc
call fcn.004521f8
test al, al
je 0x43205d
adc eax, 0xe97f3054
sbb al, 0x31
push cs
in al, dx
or ebx, dword [ecx + esi*4 - 0x6e]
jns 0x432050
jns 0x432050
pop esp
and bl, byte [esi]
or dword fs:[esi + 0x439e6b41], esi
in al, 0xe8
cmp eax, 0x84000200
sal byte [esi + ebx - 0x51], 0x4b
call fcn.0045209f
test al, al
je 0x432084
scasd eax, dword es:[edi]
dec ebx
scasb al, byte es:[edi]
in eax, dx
fldenv [ebp - 0x40ad6cfa]
xlatb
sbb al, 0x4e
imul ecx, dword [0xddd42a64], 0xa6033866
pop ds
dec eax
lea edx, [ecx]
mov cl, 0xee
jbe 0x4320ef
push 1
xor eax, eax
mov dword [ebp - 0x234], 7
push 0x5e9dec
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
call fcn.00402ad0
push 0x24
push str.7A3B0D6F_8BB3_4007_B032_BD7782EEAD56
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.00405da0
push 1
push 0x5e9e3c
lea ecx, [ebp - 0x248]
call fcn.00405da0
call fcn.004524ef
test al, al
je 0x4320f8
add dword [ebx], esi
rol bh, 0x85
int3
add byte [ebp + 0xcfd9153], ch
xchg edx, esi
lea edi, [ebp + 0x65836892]
add byte [edx + 0x37], 0xe8
sti
add byte [edx], al
add byte [eax + eax*8 - 0x4254e08c], al
invalid
call fcn.004521f8
test al, al
je 0x432120
stosd dword es:[edi], eax
mov ebp, 0xd161bf8f
push 0xffffffffffffffc4
dec ebx
and al, 0x70
sbb al, dh
mov dword [0xeb6ed7e8], eax
push 0x7f8b5815
invalid
call fcn.00452015
test al, al
je 0x43213f
imul ebx, edx, 8
or dword [ebp + 0x4d], ebp
cmc
xor eax, 0x1766b1e7
sbb dword [edx + 0x3f6a5a9], ebx
mov ah, 0xbb
dec edx
add eax, dword [ebx - 0x23343]
dec dword [eax]
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x268]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push dword [ebp - 0x26c]
call esi
test eax, eax
jne 0x4327c4
call fcn.0045209f
test al, al
je 0x4321a8
dec ecx
invalid
push 0
lea eax, [ebp - 0x24c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5e9fa8
push dword [ebp - 0x268]
call esi
test eax, eax
jne 0x432766
call fcn.00452351
test al, al
je 0x4321f3
mov ebp, 0x890d8887
mov dl, 0x3b
sub ebx, esi
fcomp dword [edi + 0x429fcc2d]
mov es, word [edi + 0x6c0486f7]
mov ch, al
in al, dx
inc byte [ecx]
add byte [eax + eax*8 + 0x33c91874], al
lodsd eax, dword [esi]
cmp esi, dword [eax + 0x2f3b577]
scasb al, byte es:[edi]
cmp cl, bh
sbb byte [edi - 0x377b3934], bl
call 0xbd22c211
jg 0x4321fd
call fcn.004520e4
test al, al
je 0x432214
leave
xor ebp, dword [ebp - 0x4a884fc5]
add ch, byte [esi - 0x60e706c8]
int3
call fcn.0045216e
test al, al
je 0x432235
push ebp
inc dword [ecx]
add byte [eax + eax*8 - 0xa64e78c], al
wait
cmc
and edi, dword [edi + 0x1f01fce6]
mov bl, 0xd9
xchg eax, esp
in al, dx
add eax, 0x5ef569e7
stosb byte es:[edi], al
mov ah, 0x9e
jae 0x432267
nop
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x250]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5e6b58
push dword [ebp - 0x24c]
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x432515
test dword [ecx - 0x17fffffe], ebp
wait
add byte [edx], al
add byte [eax + eax*8 - 0x2e08e78c], al
call fcn.0045230c
test al, al
je 0x43228d
not ecx
jmp 0xa97fa3b4
push 0
lea eax, [ebp - 0x254]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.win32
push dword [ebp - 0x250]
call ebx
test eax, eax
jne 0x43239c
call fcn.00452579
test al, al
je 0x4322d7
stosb byte es:[edi], al
mov al, 0xcd
outsb dx, byte [esi]
cmpsd dword [esi], dword es:[edi]
or al, ch
xchg esp, eax
scasd eax, dword es:[edi]
xor edi, dword [edx + 9]
frstor dword [edx + esi*8]
bound ecx, qword [ebx + 0x5e60781d]
add byte [ebx], dh
rol bh, 0x85
in al, 0xfd
invalid
xor eax, eax
mov dword [ebp - 0x21c], 7
push 0xffffffffffffffff
push eax
push dword [ebp - 0x260]
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.004029b0
push str.WOver32.dll
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.0040aae0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x432336
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432350
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x254]
call esi
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00403710
call fcn.004524aa
test al, al
je 0x4323c3
jl 0x4323fd
push ss
clc
push esi
lea edx, [ebx + 0xf]
imul esi, esp, 0x17
xor byte [esi + 0x4bd4708d], ch
invalid
push 0
lea eax, [ebp - 0x258]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.win64
push dword [ebp - 0x250]
call ebx
test eax, eax
jne 0x4324a7
push 0xffffffffffffffff
push eax
push dword [ebp - 0x260]
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
call fcn.004029b0
push str.WOver64.dll
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.0040aae0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x432447
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432461
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x258]
call esi
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00403710
call fcn.004523db
test al, al
je 0x4324cb
mov esi, 0x133e2ce3
invalid
call fcn.0045223d
test al, al
je 0x4324e9
add byte [eax + eax*8 - 0x5e76ea8c], al
int3
mov dword [ecx - 0x4b3af934], esp
lodsd eax, dword [esi]
adc byte [esi + edx*2 - 0x5dbb0ad5], al
sbb eax, 0x764ccea4
xchg edi, eax
mov ch, al
test al, 0xfe
add dword [eax], eax
call fcn.00452396
test al, al
je 0x432504
sti
xor esp, dword [ecx + 0x33]
sar byte [ecx], cl
mov cl, 0x77
add al, 0x8c
pushfd
js 0x43251b
push ecx
popfd
pushfd
push eax
push edx
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x432515
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004523db
test al, al
je 0x432539
sal byte [ebx + ebx + 0x12], 0xcd
adc cl, ch
jnp 0x43256a
int1
cmp al, 0x7b
push cs
mov ah, 0xcf
inc esp
jmp 0x9e576c03
call fcn.0045223d
test al, al
je 0x432557
inc ebp
loope 0x4324cf
fst dword [ebp + ecx*8 - 0x6b]
rol dword [esi + 0x21], 1
retf 0xab45
call fcn.00452396
test al, al
je 0x432572
adc byte [edx - 0x4a], dl
sub dword [eax], ebp
cli
les eax, [eax - 0x7141f499]
pop eax
inc bl
or edi, dword [esi - 0x3c01a772]
xchg esi, eax
movsd dword es:[edi], dword [esi]
push 0
lea eax, [ebp - 0x25c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.FLAGS
push dword [ebp - 0x24c]
call ebx
test eax, eax
jne 0x4325eb
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], 0x30
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4325b0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004522c7
test al, al
je 0x432608
movsb byte es:[edi], byte [esi]
int1
xchg dword [edx + 0x4b], edx
pop esp
push ss
pushal
out dx, al
adc dword [edi + 0x71], ebx
dec edi
sar dword [ecx + eax*2 + 0x13], cl
mov ch, 0x22
xchg eax, ebp
xlatb
cli
add dword [eax], eax
call fcn.004520e4
test al, al
je 0x43262f
push edx
push ecx
sal byte [edx + edx*4], 0x85
jg 0x432662
ja 0x432668
cmpsd dword [esi], dword es:[edi]
xor cl, byte [esi + 0x52]
adc byte [esi - 0x72], bl
sbb byte [ecx + 0x3b], bl
mov bl, 0x10
xlatb
in al, 0x58
mov ebp, 0xe840aeee
scasb al, byte es:[edi]
inc eax
call fcn.004521b3
jg 0x43262d
add dword [eax], eax
test al, al
je 0x432657
in al, 0xe9
sal dword [ecx], cl
fistp qword es:[esi - 0xdf640b8]
jns 0x432630
aam 0x55
push esi
sub eax, 0x2dc473ed
test al, 0x31
les ecx, [edi - 0x7f5dc999]
mov dl, 0x6a
add byte [ebp - 0x2637b], cl
call dword [eax + 0x6a]
add byte [eax + 0x3f], ch
add byte [edi], cl
add byte [edx], ch
push 0
lea eax, [ebp - 0x264]
push eax
push 0
push 0xf003f
push 0
add byte [edx], ch
push 0
push 0
push str.HELPDIR
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43273a
push 0xffffffffffffffff
push eax
push dword [ebp - 0x260]
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
call fcn.004029b0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4326d0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4326f0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x264]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x264]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
lea ecx, [ebp - 0x230]
call fcn.00403710
jmp 0x432740
mov ch, 0x9c
std
invalid
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00451f46
test al, al
je 0x432759
popfd
lea ebp, [ebp + 0x62f2e457]
ja 0x432722
je 0x4326e7
adc al, 0x7a
int3
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x432766
push eax
call ebx
call fcn.004523db
test al, al
je 0x43278c
pushfd
push 0x78
scasb al, byte es:[edi]
and eax, ecx
sub bl, byte [edx + 0x26034bdb]
aas
aas
and byte [esi - 2], 9
mov esp, 0x6dd9e9f2
and edi, dword [edi + ecx*8 - 0x28]
inc eax
mov byte [0x1fd5ee8], al
add byte [eax + eax*8 + 0x729d1e74], al
jecxz 0x432720
call fcn.004524ef
test al, al
je 0x4327b3
popfd
jb 0x43277b
xchg edi, ebx
int 0x80
push cs
outsb dx, byte [esi]
xchg ebp, eax
lock xor byte [ecx - 0x4508f907], ch
aaa
retf
invalid
mov eax, dword [ebp - 0x268]
test eax, eax
je 0x4327c4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x4327e2
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402c20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d81d
mov esp, ebp
pop ebp
ret 4