Function at 0x431260
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df7b6
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x258], ecx
mov eax, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
call fcn.00480640
add esp, 0xc
mov dword [ebp - 0x234], 7
xor eax, eax
mov dword [ebp - 0x238], 0
lea ecx, [ebp - 0x248]
mov word [ebp - 0x248], ax
invalid
mov eax, 0x66fffffd
mov dword [ebp - 0x248], eax
push 0x26
push str.B2A6906E_67AA_4613_B7ED_1CEB63834F37
call fcn.00402ad0
mov dword [ebp - 4], 0
call fcn.004524ef
test al, al
je 0x431317
cdq
push cs
mov bh, 0
push esp
inc esp
js 0x431292
fild word [ebx + 0x2b]
popfd
mov dword [0xdce823c5], eax
push cs
add al, byte [eax]
call fcn.004521f8
test al, al
je 0x43133f
push edi
sahf
push ebx
dec eax
retf 0xc676
call fcn.00452015
test al, al
je 0x43135e
jo 0x43130f
dec ecx
das
je 0x43139e
push eax
jb 0x43134d
imul ebx, dword [edx + 0x41a79722], 0x4fc270c1
das
jne 0x4312df
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x250]
push 0
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push eax
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43144d
push 0x19
push str.WanNengWB_Shell_Extension
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
call fcn.00402ad0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
sbb dword [eax], ebp
pushfd
pop esi
add byte [ebp - 0x22f73], cl
inc edi
test esp, esp
std
invalid
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4313e0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431400
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x43144d
invalid
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402c20
call fcn.00452603
test al, al
je 0x431469
imul esi, dword [ebp - 0x51], 0xe3358323
pushfd
lodsd eax, dword [esi]
pushfd
in al, 0x92
or byte [edi], ch
jb 0x4314ac
cli
popfd
in eax, 0xe8
or edx, dword [ecx]
add al, byte [eax]
call fcn.00452579
test al, al
je 0x43148d
lodsb al, byte [esi]
mov bh, 2
rol dword [edx - 7], 1
pop ecx
test esi, edx
test eax, 0x11fe323f
out dx, al
ja 0x4314bf
loope 0x4314a7
jp 0x431427
xor bh, byte [ebx]
push cs
sbb ebx, dword [eax]
call fcn.00452534
test al, al
je 0x4314af
xchg edi, eax
and bh, byte [eax - 0x5bb8989e]
cld
daa
test byte [edx + 0x55], bl
ret
pop edx
sar eax, 0xd8
aam 0x77
add al, 0x41
ja 0x4314b2
inc ecx
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x431607
std
invalid
push 0
lea ecx, [ebp - 0x24c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.InprocServer32
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4315ec
call fcn.00402320
mov ecx, eax
call fcn.00471d44
push eax
lea ecx, [ebp - 0x230]
call fcn.004041e0
mov eax, dword [ebp - 0x258]
lea ecx, [ebp - 0x230]
push 0xffffffffffffffff
push 0
add eax, 0x18
mov byte [ebp - 4], 1
push eax
call fcn.00405c90
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x431536
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431550
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x24c]
call esi
movups xmm0, xmmword [str.Apartment]
mov eax, dword [0x5e9c64]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x208], eax
lea edx, [ecx + 2]
movups xmmword [ebp - 0x218], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4315a3
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.ThreadingModel
push dword [ebp - 0x24c]
call esi
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x4315ec
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402c20
mov eax, dword [ebp - 0x24c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4315ff
push eax
call esi
push dword [ebp - 0x250]
call esi
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x431625
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402c20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d81d
mov esp, ebp
pop ebp
ret 4