Function at 0x4331d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df961
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x264], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x258], 0
call fcn.00480640
add esp, 0xc
call fcn.004524ef
test al, al
je 0x43327d
mov ch, 0x72
add ah, 0xfe
aaa
dec ebx
push ecx
push edx
mov ch, 0x62
nop
sal esi, 1
call fcn.004521f8
test al, al
je 0x4332a5
and al, 0x6f
jmp 0xcac761d8
call fcn.00452015
test al, al
je 0x4332c4
int1
xchg esi, eax
jnp 0x4332bd
dec esp
iretd
insb byte es:[edi], dx
add dword [ebx + 0xce51284], ebp
push 1
xor eax, eax
mov dword [ebp - 0x234], 7
push 0x5e9dec
lea ecx, [ebp - 0x248]
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
call fcn.00402ad0
push 0x24
push str.34E7B5C6_21C6_4A4B_AEFF_CD81A5A6EA57
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.00405da0
push 1
push 0x5e9e3c
lea ecx, [ebp - 0x248]
call fcn.00405da0
call fcn.00452603
test al, al
je 0x43333a
pop ecx
push cs
mov ch, 0xfc
stosd dword es:[edi], eax
mov ds, edx
mov edi, 0xaf4b1844
fidivr dword [edi - 0x50b4e7bc]
and dword [ecx + edx + 0x66f217f7], edx
call fcn.00452579
test al, al
je 0x43335e
pop eax
scasd eax, dword es:[edi]
cli
push ss
scasd eax, dword es:[edi]
jp 0x43332d
pop eax
lodsb al, byte [esi]
cld
pop eax
test al, 0x62
int3
call fcn.00452534
test al, al
je 0x433380
salc
ret
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x264]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push ecx
push 0
push 0xf003f
push 0
inc ebx
test dword [eax + 0x6afffffd], edi
add byte [ecx + 0x6a], dl
add byte [eax + 0x3f], ch
add byte [edi], cl
add byte [edx], ch
push 0
push 0
push eax
push dword [ebp - 0x268]
call ebx
test eax, eax
jne 0x43393f
call fcn.00451fd0
test al, al
je 0x4333e4
enter 0x7c04, 0x78
insd dword es:[edi], dx
jl 0x43339a
xor eax, 0x94cea53f
cmpsd dword [esi], dword es:[edi]
fmul qword [ebx - 0x426996c6]
xor ecx, dword [ebx + 0x5e60781d]
add byte [edx], ch
sbb eax, sym.imp.ADVAPI32.dll_RegCreateKeyExW
push 0
lea eax, [ebp - 0x250]
push eax
push 0
push 0xf003f
push 0
verw word [edx]
push 0
push 0
push 0x5e9fa8
push dword [ebp - 0x264]
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x43390a
call fcn.0045223d
out dx, al
add dword [eax], eax
test al, al
je 0x43342e
pop edx
or edi, esi
lcall 0xd772, 0xded9c4b8
jl 0x4333df
jno 0x433417
and eax, 0x1f18be8
add byte [eax + eax*8 - 0x3facd98c], al
or ebx, dword [ebx]
call fcn.004525be
test al, al
je 0x43345d
push ebx
ror byte [ebx], 0x1b
and ebx, dword [edx + 0x39]
lea esp, [edi + 0x537d5db3]
cmp dl, dh
sub byte [edx], 0x1a
loopne 0x4333f2
sbb ax, 0xf9e4
push cs
or al, 0xe7
cli
inc ebx
test dword [edi - 0x44], ecx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
call fcn.00451fd0
test al, al
je 0x433484
jne 0x433417
dec edi
enter 0xffffffffffff8cee, 0x1d
int1
push 0xd6776631
imul eax, dword [ebx], 0xffffffa2
imul ebp, dword [eax + 0x715724eb], 0xffffffb7
push es
div byte [edx + 0x6a755840]
add byte [ebp - 0x24b7b], cl
call dword [eax + 0x6a]
add byte [eax + 0x3f], ch
push 0
lea eax, [ebp - 0x24c]
push eax
push 0
push 0xf003f
push 0
aas
add byte [edi], cl
add byte [edx], ch
push 0
push 0
push 0x5e6b58
push dword [ebp - 0x250]
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x43370e
call fcn.004524aa
test al, al
je 0x4334d5
inc esi
ror ch, 1
sbb dword [edx], 0x2630de49
popal
ja 0x433490
invalid
push 0
lea eax, [ebp - 0x254]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.win32
push dword [ebp - 0x24c]
call ebx
test eax, eax
jne 0x4335a6
call fcn.00402320
mov ecx, eax
call fcn.00471d44
push eax
lea ecx, [ebp - 0x230]
call fcn.004041e0
push str.WShell32.dll
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.0040aae0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x433546
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433560
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x254]
call edi
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00403710
push 0
lea eax, [ebp - 0x258]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.win64
push dword [ebp - 0x24c]
call ebx
test eax, eax
jne 0x4336d6
call fcn.00452420
test al, al
je 0x4335fd
enter 0x2a44, 0x57
inc ecx
inc edi
sub dl, byte [edi + 0x66]
add esi, dword [ebx]
and bh, byte [edi + 0x52]
mov dh, 0x6d
outsd dx, dword [esi]
mov ebp, dword [ebx + 0x6e]
rcr dword [edi], cl
add dl, byte [eax]
mov bh, 0xc1
int3
call fcn.004521f8
test al, al
je 0x433626
rol dword [edi + 0x8a31ca8], cl
dec ebx
and eax, 0x5ab257a6
adc al, 0xc4
int1
push esp
push ecx
sbb eax, 0xcbfaf028
enter 0xfffffffffffff692, 0xffffffffffffff80
idiv dword [esp + edx*2 - 0x2b]
xor eax, dword [eax - 0x3130a18]
dec dword [ebx - 0x18ed1738]
add eax, dword [eax]
call fcn.00402320
mov ecx, eax
call fcn.00471d44
push eax
lea ecx, [ebp - 0x230]
call fcn.004041e0
push str.WShell64.dll
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.0040aae0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x433670
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433690
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x258]
call edi
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0
call fcn.00403710
cmp dword [ebp - 0x24c], 0
je 0x43370e
call fcn.00452579
test al, al
je 0x4336fe
mov ebx, 0x8efb716f
mov dl, 0x38
push esp
xor esi, ecx
xor byte [eax + 0x44], ah
xchg edx, eax
das
dec ecx
dec edx
popal
push edx
insd dword es:[edi], dx
mov ah, 0x66
push dword [ebp - 0x24c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
jmp 0x433714
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00451f46
test al, al
je 0x43372d
mov ebx, 0x2fdbcc53
stc
add eax, 0x7117d191
lcall 0x6a, 0x4996f775
push 0
lea eax, [ebp - 0x25c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.FLAGS
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4337a7
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], 0x30
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433770
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x25c]
call ebx
call fcn.00452603
test al, al
je 0x4337c3
jmp 0x9bfd798e
call fcn.00452579
test al, al
je 0x4337e7
push ebx
pop ecx
arpl word [edx], dx
add al, 0x2d
or eax, 0x66106a65
out dx, eax
mov edi, 0xbfb0b00f
invalid
call fcn.00452534
test al, al
je 0x433809
bound esi, qword [ecx + esi]
jp 0x433849
fsub dword gs:[eax + 0x63]
shl byte [eax + ebp*4 - 0x27], 0x92
movsb byte es:[edi], byte [esi]
in eax, dx
aad 0x96
and ch, byte [eax - 0x63]
imul ecx, dword [ebp - 0x1a], 0x858d006a
mov al, byte [0x50fffffd]
push 0
lea eax, [ebp - 0x260]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.HELPDIR
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4338da
call fcn.00402320
mov ecx, eax
call fcn.00471d44
push eax
lea ecx, [ebp - 0x230]
call fcn.004041e0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop word [eax + eax]
invalid
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x433870
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433890
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x260]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x260]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
lea ecx, [ebp - 0x230]
call fcn.00403710
jmp 0x4338e0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00451fd0
test al, al
je 0x4338fd
stc
cdq
mov es, word [eax + 0x1f]
mov ebx, 0xe0e1a3f
bsr ebx, dword [ecx + 0x274525f4]
pop edi
adc eax, 0xb0858b9e
std
invalid
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x43390a
push eax
call esi
call fcn.0045209f
test al, al
je 0x433932
js 0x433911
mov ah, byte [ebp - 0x3d]
movsd dword es:[edi], dword [esi]
int3
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x43393f
push eax
call esi
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x43395d
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402c20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d81d
mov esp, ebp
pop ebp
ret 4