Function at 0x466722
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.00452620
test al, al
je 0x466758
mov ch, 0x71
stosb byte es:[edi], al
stc
pop eax
das
lodsb al, byte [esi]
jne 0x4667bc
and byte [esi], al
mov bh, 0x93
push esp
pop ss
inc ebp
jns 0x4667a3
out 0x41, eax
push esp
inc esp
cmp al, 0xa7
dec esp
lcall 0xfc45, 0x8ddb33c2
lea eax, [ebp - 4]
mov esi, 0xf013f
push eax
push esi
push ebx
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46685c
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push esi
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4667a3
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46685c
call fcn.00452482
test al, al
je 0x4667be
and dh, bh
lodsd eax, dword [esi]
ljmp 0x2224
mov al, 0x27
call fcn.00452146
test al, al
je 0x4667e2
adc ah, byte [edi + 0x6a]
fsubr dword [edx]
cmp ebx, dword [esp + ebp*2]
push edx
pop ds
sbb ecx, esp
nop
lodsb al, byte [esi]
cwde
in al, dx
lodsd eax, dword [esi]
invalid
call fcn.00452146
test al, al
je 0x466806
pop eax
shl byte [esp + ebp*2], cl
sbb eax, 0x5a739f5c
dec ebp
les edx, [edi]
out 0x20, eax
mov dword [0x44768300], eax
mov bl, 0xa9
push ecx
xchg dword [esi - 6], edi
push edi
mov bl, 0xff
jne 0x466819
push dword [ebp + 0x10]
call fcn.0048ed77
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x10]
push 1
adc byte [edx + 1], ch
push 0
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call fcn.00452077
test al, al
je 0x46684c
sbb byte [ebx - 0x23], dh
jne 0x46687f
and dword [edx + ecx*2 - 0x3b110c4e], ebp
invalid
out dx, al
invalid
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
je 0x466894
out dx, eax
invalid
dec ebx
or ah, bl
mov eax, dword [edi - 0x3d]
mov dh, 0x4b
inc edx
call fcn.00452596
test al, al
je 0x4668b8
and dword [ebx + 0x44], esp
loopne 0x46683c
out dx, al
scasd eax, dword es:[edi]
ljmp 0x2f3a
pop ebx
or dl, byte [ebx + 0xb]
mov dword [edx - 0x173f686a], edi
xchg esp, eax
mov esp, 0xc084fffe
call fcn.00452551
test al, al
je 0x4668da
shr byte [eax - 0x391ccdd3], 1
xchg ecx, eax
dec eax
lahf
mov ah, 0x46
in al, 0x62
lodsb al, byte [esi]
imul ecx, esp, 0x1e3904be
jp 0x46688a
inc esp
adc dword [eax + 0x33f4458d], esi
fist dword [eax + 0x68]
aas
add dword [edi], ecx
add byte [ebx + 0x68], dl
rol byte [edi + 0x168005e], 1
add byte [eax], al
cmp bh, 0x15
or al, 0x60
pop esi
add byte [ebp + 0x31850fc0], al
add dword [eax], eax
add al, ch
dec esi
mov esp, 0xc084fffe
lea eax, [ebp - 0xc]
xor ebx, ebx
push eax
push 0xf013f
push ebx
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x466a2f
call fcn.00452551
test al, al
je 0x466925
jl 0x4668af
pop esp
push ebp
inc ebp
lodsd eax, dword [esi]
jge 0x466920
das
and esp, 0x7cef4d87
xchg edi, eax
xor ah, byte [eax]
invalid
add dword [edi - 9], ecx
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x466951
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x466a2f
call fcn.00452620
test al, al
je 0x466977
invalid
push ebx
lea eax, [ebp - 4]
push eax
push ebx
push 0xf013f
push ebx
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4669a8
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
jmp 0x466a2d
call fcn.00452077
test al, al
je 0x4669d1
push 0xa3ad8f73
int1
xor bh, byte [ebx + esi]
mov dword [0x333c32f1], eax
pop eax
sub eax, 0xce05a6f5
adc byte [edi], 0xab
jns 0x4669ea
jmp 0x466a37
call fcn.0045250c
test al, al
je 0x4669f6
dec esp
push edi
loop 0x466a32
shr ah, 1
mov bl, 0x59
fcmovnbe st(0), st(3)
pop edx
mov ebx, 0x5862ef6e
pop esi
ficom word [0xe483b394]
jbe 0x4669b5
add al, 0x49
invalid
push dword [ebp + 0x14]
call fcn.0048ed77
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4320
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x67432c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi]
push dword [eax + 4]
call fcn.0042dc20
mov eax, dword [esi]
mov dword [eax + 4], eax
mov eax, dword [esi]
mov dword [eax], eax
mov eax, dword [esi]
mov dword [eax + 8], eax
and dword [esi + 4], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret