Function at 0x432c10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df8a6
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 0x250], 0
push 0
push eax
mov dword [ebp - 0x24c], 0
call fcn.00480620
add esp, 0xc
call fcn.00452551
test al, al
je 0x432c8d
pop eax
invalid
push 0x4f
xor eax, eax
mov dword [ebp - 0x21c], 7
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers_
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00402ac0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x250]
push ecx
push 0xf013f
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
cmovae eax, dword [ebp - 0x230]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x432ebc
call fcn.00452620
test al, al
je 0x432d1d
stosb byte es:[edi], al
push ds
add dh, byte [eax - 0x6a5e7bb]
inc edi
sar byte [edi + esi*8 + 0x78], 1
pop ebx
add eax, dword [edi - 0x50c44649]
cld
fist dword [eax - 0xf]
pop eax
dec ebp
retf
push 4
push 0x5ea088
lea ecx, [ebp - 0x230]
call fcn.00402ac0
push 0x14
push str.OverlayIconWanNengWB
lea ecx, [ebp - 0x230]
call fcn.00405c20
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x24c]
push 0
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push 0
push eax
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x432e4d
push 0x5e9df4
lea ecx, [ebp - 0x248]
call fcn.00404060
push 0x24
push 0x5e9df8
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 1
call fcn.00405c20
push 1
push 0x5e9e44
lea ecx, [ebp - 0x248]
call fcn.00405c20
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x248]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x248]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x432dd2
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432df0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x234]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x432e4d
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402c10
call fcn.00452482
test al, al
je 0x432e68
pop ss
pop ss
int1
jb 0x432ecd
mov eax, 0x8c49fc92
invalid
call fcn.00452146
test al, al
je 0x432e8c
jmp 0x432e42
call fcn.00452146
test al, al
je 0x432eb0
adc byte [esi + eax*4 + 0x7fb80955], 0xdf
inc ebx
sub ah, bl
cmp eax, 0x3d4f3b72
xor byte [edi], 0xbb
lcall 0x6796, 0x8febf4ab
pop ecx
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x432eda
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402c10
call dword [eax - 1]
mov ch, 0xd0
std
invalid
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret