Function at 0x4338a0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4a02e0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push ebp
push esi
push edi
mov eax, dword [0x4d6720]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, 1
call fcn.0041b830
or ebp, 0xffffffff
test eax, eax
je 0x433a63
call fcn.0041b670
mov edi, eax
test edi, edi
jne 0x433a63
lea eax, [esp + 0x1c]
push eax
call fcn.00424310
add esp, 4
lea ecx, [esp + 0x24]
mov dword [esp + 0x40], edi
call fcn.00420260
lea ecx, [esp + 0x24]
push ecx
mov byte [esp + 0x44], 1
call fcn.00424410
mov eax, dword [esp + 0x20]
add esp, 4
push 0
lea edx, [esp + 0x14]
push edx
push 0
push 0x20006
push 0
push 0
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea edi, [ebp - 2]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x433a37
mov eax, dword [0x4d8808]
mov ecx, dword [eax - 0xc]
mov edx, dword [esp + 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ecx + ecx + 2]
push ecx
push eax
mov eax, dword [esp + 0x18]
push 1
push 0
push edx
push eax
call esi
test eax, eax
jne 0x433a2c
mov eax, dword [0x4d8804]
mov ecx, dword [eax - 0xc]
mov edx, dword [esp + 0x28]
lea ecx, [ecx + ecx + 2]
push ecx
push eax
mov eax, dword [esp + 0x18]
push 1
push 0
push edx
push eax
call esi
test eax, eax
jne 0x433a2c
push 0x4d8788
lea ecx, [esp + 0x1c]
call fcn.00401710
mov eax, dword [esp + 0x18]
mov ecx, dword [eax - 0xc]
mov edx, dword [esp + 0x2c]
lea ecx, [ecx + ecx + 2]
push ecx
push eax
mov eax, dword [esp + 0x18]
push 1
push 0
push edx
push eax
mov byte [esp + 0x58], 2
call esi
test eax, eax
jne 0x433a23
push 0x4aee6c
lea ecx, [esp + 0x18]
call fcn.00403c10
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 0xc]
mov edx, dword [esp + 0x30]
lea ecx, [ecx + ecx + 2]
push ecx
push eax
mov eax, dword [esp + 0x18]
push 1
push 0
push edx
push eax
call esi
test eax, eax
jne 0x433a1a
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x24]
push ecx
push 4
xor edi, edi
push edi
push edx
push eax
mov dword [esp + 0x38], 1
call esi
lea ecx, [esp + 0x14]
call fcn.0041f860
lea ecx, [esp + 0x18]
call fcn.0041f860
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x24]
call fcn.00420310
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov dword [esp + 0x40], ebp
lea edx, [eax + 0xc]
mov ecx, ebp
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x433a63
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi + 3]
cmp eax, 4
ja case.default.0x433a6f
jmp dword [eax*4 + 0x433b2c]
lea ecx, [esp + 0x1c]
call fcn.004016e0
mov ecx, dword [0x4d8804]
mov edx, dword [0x4d8808]
push ecx
push edx
lea eax, [esp + 0x24]
push str.Added_WOSB_into_Windows_auto_logon_for__s_s
push eax
mov dword [esp + 0x50], 3
call fcn.00404580
mov esi, dword [esp + 0x2c]
push 0
push esi
push 0
call fcn.0042fc90
lea eax, [esi - 0x10]
add esp, 0x1c
mov dword [esp + 0x40], ebp
lea ecx, [eax + 0xc]
lock xadd dword [ecx], ebp
dec ebp
test ebp, ebp
jg case.default.0x433a6f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x34
ret
push 0x79
push str.Didnt_add_WOSB_into_Windows_auto_logon_because_the_process_is_running_in_a_non_interactive_desktop
push 2
jmp 0x433b0d
push 0x7a
push str.Didnt_add_WOSB_into_Windows_auto_logon._No_support_by_OS
jmp 0x433b0b
push 0x7b
push str.Didnt_add_WOSB_into_Windows_auto_logon._Error_obtaining_user_and_or_domain_name
jmp 0x433b0b
push 0x7c
push str.Didnt_add_WOSB_into_Windows_auto_logon._Could_not_write_into_system_registry
push 4
call fcn.0042fc90
add esp, 0xc
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x34
ret