Function at 0x405271
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x416040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x200
push 0
push 0x402b04
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, eax
test ebx, ebx
jne 0x4052cc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov edi, 0x80070000
test esi, esi
jle 0x4052b7
movzx esi, si
or esi, edi
push esi
push 0x402b30
push 0x402b90
call fcn.00408d6a
add esp, 0xc
jmp 0x40531c
push 0x402bb8
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, 0x80070000
test eax, eax
jne 0x4052fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4052f2
movzx esi, si
or esi, edi
push esi
push 0x402b30
jmp 0x405308
call eax
mov esi, eax
test esi, esi
jns 0x405315
push esi
push 0x402bd0
push 0x402b90
call fcn.00408d6a
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test esi, esi
js 0x40560e
push 0x27
lea eax, [ebp - 0x54]
push eax
push 0x4025f8
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x40534f
push 0x402c38
push 0x402c88
call fcn.00408d6a
pop ecx
pop ecx
mov esi, 0x80004005
test esi, esi
js 0x40560e
push 0x403324
mov edx, 0x104
lea ecx, [ebp - 0x25c]
call fcn.004040c5
mov esi, eax
test esi, esi
js 0x4055f6
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x25c]
call fcn.00403fc1
mov esi, eax
test esi, esi
js 0x4055f6
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x260]
push eax
xor eax, eax
push eax
push 0xf003f
push eax
push eax
push eax
lea eax, [ebp - 0x25c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x405443
push 0x50
push str.Internet_Explorer_ETW_Collector_Service
push 1
push 0
push 0x403320
push dword [ebp - 0x260]
call ebx
test eax, eax
jne 0x405415
push 0x4e
lea eax, [ebp - 0x54]
push eax
push 1
push 0
push 0x4025a4
push dword [ebp - 0x260]
call ebx
test eax, eax
je 0x405435
jg 0x405401
mov esi, eax
jmp 0x405406
movzx esi, ax
or esi, edi
push esi
lea eax, [ebp - 0x25c]
push eax
push 0x402ca0
jmp 0x40542d
jg 0x40541b
mov esi, eax
jmp 0x405420
movzx esi, ax
or esi, edi
push esi
lea eax, [ebp - 0x25c]
push eax
push 0x402d20
call fcn.00408d6a
add esp, 0xc
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x405463
jg 0x405449
mov esi, eax
jmp 0x40544e
movzx esi, ax
or esi, edi
push esi
lea eax, [ebp - 0x25c]
push eax
push 0x402da0
call fcn.00408d6a
add esp, 0xc
test esi, esi
js 0x4055f6
push 0x402e10
mov edx, 0x104
lea ecx, [ebp - 0x25c]
call fcn.004040c5
mov esi, eax
test esi, esi
js 0x4055f6
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x25c]
call fcn.00403fc1
mov esi, eax
test esi, esi
js 0x4055f6
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x260]
push eax
xor eax, eax
push eax
push 0xf003f
push eax
push eax
push eax
lea eax, [ebp - 0x25c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4055d2
push 0x2c
push str.IEEtwCollectorService
push 1
push eax
push 0x402e20
push dword [ebp - 0x260]
call ebx
test eax, eax
jne 0x4055b8
push 0x90
push 0x416f88
push 3
push eax
push 0x402e3c
push dword [ebp - 0x260]
call ebx
test eax, eax
jne 0x40559e
push 0x90
push 0x416ef8
push 3
push eax
push 0x402e60
push dword [ebp - 0x260]
call ebx
test eax, eax
jne 0x405584
push 4
lea eax, [ebp - 0x264]
mov dword [ebp - 0x264], 2
push eax
push 4
push 0
push 0x402e84
push dword [ebp - 0x260]
call ebx
test eax, eax
je 0x405577
jg 0x405563
mov esi, eax
jmp 0x405568
movzx esi, ax
or esi, edi
push esi
lea eax, [ebp - 0x25c]
push eax
push 0x402eb0
jmp 0x4055ea
push 0x402f48
call fcn.00408d6a
pop ecx
jmp 0x4055f2
jg 0x40558a
mov esi, eax
jmp 0x40558f
movzx esi, ax
or esi, edi
push esi
lea eax, [ebp - 0x25c]
push eax
push 0x402fb0
jmp 0x4055ea
jg 0x4055a4
mov esi, eax
jmp 0x4055a9
movzx esi, ax
or esi, edi
push esi
lea eax, [ebp - 0x25c]
push eax
push 0x403048
jmp 0x4055ea
jg 0x4055be
mov esi, eax
jmp 0x4055c3
movzx esi, ax
or esi, edi
push esi
lea eax, [ebp - 0x25c]
push eax
push 0x4030e0
jmp 0x4055ea
jg 0x4055d8
mov esi, eax
jmp 0x4055dd
movzx esi, ax
or esi, edi
push esi
lea eax, [ebp - 0x25c]
push eax
push 0x402da0
call fcn.00408d6a
add esp, 0xc
test esi, esi
jns 0x40560e
push esi
push 0x403170
push 0x402b90
call fcn.00408d6a
add esp, 0xc
call fcn.00405624
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408929
mov esp, ebp
pop ebp
ret