Function at 0x4152e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x62d040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0x20]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0
push 0
push 0x62de40
push 0xfffffffffffffff7
push 0x20006
push eax
call sym.SystemInformer.exe_PhCreateKey
mov esi, eax
test esi, esi
jns 0x4153fc
cmp esi, 0xc0000022
je 0x41535e
cmp esi, 0xc0000005
je 0x41535e
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x41534c
movzx eax, si
jmp 0x415368
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x41536c
mov eax, esi
jmp 0x415368
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x415377
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x415385
push eax
lfence
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x4153cf
lfence
lfence
push dword [esi + 4]
push 0x5cc434
push str.Unable_to_execute_the_program.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4155d0
lfence
jmp 0x4155cb
push str.Unable_to_execute_the_program.
push 0x5cc434
push 0x10
push edi
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret 8
mov ecx, ebx
call fcn.004f8100
mov esi, eax
mov dword [esp + 0x10], 0x10000e
lea eax, [esp + 0x10]
mov dword [esp + 0x14], str.LastKey
mov ecx, dword [esi]
add ecx, 2
push ecx
push dword [esi + 4]
push 1
push 0
push eax
push dword [esp + 0x3c]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push dword [esp + 0x28]
call dword [sym.imp.ntdll.dll_NtClose]
or ebx, 0xffffffff
lea ecx, [esi - 8]
mov eax, ebx
lock xadd dword [ecx + 4], eax
dec eax
jne 0x415452
call fcn.004fbd80
lea eax, [esp + 0x18]
push eax
call sym.SystemInformer.exe_PhGetSystemRoot
mov esi, dword [esp + 0x18]
push 0
push 0
mov dword [esp + 0x1c], 0
lea eax, [esi + 0x18]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
call sym.SystemInformer.exe_PhCreateString3
push esi
push dword [esp + 0x20]
mov dword [esp + 0x14], eax
push dword [eax + 4]
call fcn.00580c90
mov eax, dword [esp + 0x18]
add esp, 0xc
mov ecx, dword [eax + 4]
mov eax, dword [str._regedit.exe]
add ecx, esi
mov dword [ecx], eax
mov eax, dword [0x5cfa18]
mov dword [ecx + 4], eax
mov eax, dword [0x5cfa1c]
mov dword [ecx + 8], eax
mov eax, dword [0x5cfa20]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5cfa24]
mov dword [ecx + 0x10], eax
mov eax, dword [0x5cfa28]
mov dword [ecx + 0x14], eax
lea eax, [esp + 0x18]
push eax
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
mov ecx, dword [esp + 0xc]
push 0
push 0
test dword [eax + 4], 1
mov eax, dword [ecx + 4]
je 0x4154eb
push 0
jmp 0x4154ed
push 1
push 5
push 0
push 0
push eax
push edi
call sym.SystemInformer.exe_PhShellExecuteEx
mov esi, eax
test esi, esi
jns 0x4155bc
cmp esi, 0xc0000022
je 0x41553e
cmp esi, 0xc0000005
je 0x41553e
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x41552c
movzx eax, si
jmp 0x415548
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x41554c
mov eax, esi
jmp 0x415548
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x415557
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x415565
push eax
lfence
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
lfence
test esi, esi
je 0x4155a7
lfence
push dword [esi + 4]
push 0x5cc434
push str.Unable_to_execute_the_program.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
mov eax, ebx
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4155bc
lfence
call fcn.004fbd80
jmp 0x4155bc
push str.Unable_to_execute_the_program.
push 0x5cc434
push 0x10
push edi
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], ebx
dec ebx
jne 0x4155d0
call fcn.004fbd80
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0057e94f
mov esp, ebp
pop ebp
ret 8