Function at 0x4031a0
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x5a9536
mov eax, dword fs:[0]
push eax
mov eax, 0x1818
call fcn.00595100
mov eax, dword [0x5f13cc]
xor eax, esp
mov dword [esp + 0x1810], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5f13cc]
xor eax, esp
push eax
lea eax, [esp + 0x182c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x183c]
xor edi, edi
cmp dword [ebp + 0x18], edi
mov dword [esp + 0x18], ebp
jne 0x4031f9
lea eax, [edi + 1]
jmp 0x40348e
mov dword [esp + 0x1c], edi
mov dword [esp + 0x1834], edi
cmp dword [ebp + 4], edi
jne 0x40324b
call fcn.004745c0
push str.Acc20
call fcn.00473ea0
add esp, 4
push 0x5bcc18
mov esi, eax
call fcn.00473ea0
add esp, 4
push str.Acc2
call fcn.00473ea0
add esp, 4
cmp esi, edi
je 0x40323e
mov dword [ebp + 0x18], edi
xor eax, eax
cmp dword [ebp + 0x18], edi
sete al
jmp 0x40348e
mov eax, dword [0x5fcd20]
mov edx, dword [eax + 0xc]
mov ecx, 0x5fcd20
call edx
lea esi, [eax + 0x10]
mov dword [esp + 0x14], esi
mov byte [esp + 0x1834], 1
mov eax, dword [ebp]
cmp eax, edi
je 0x40328b
mov edx, dword [ebp + 0x14]
cmp eax, edx
je 0x40328b
mov ecx, eax
mov eax, dword [eax + 0xc]
cmp eax, edx
je 0x40328d
mov ecx, eax
mov eax, dword [ecx + 0xc]
cmp eax, edx
jne 0x403280
jmp 0x40328d
xor ecx, ecx
cmp ecx, edi
mov ebx, ecx
je 0x403364
push ebp
mov eax, ebx
mov edi, ebx
call fcn.004c4960
mov ebx, eax
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00403fc0
mov ecx, dword [esp + 0x14]
mov ebp, dword [ecx - 0xc]
mov eax, dword [ecx - 8]
mov edx, 1
sub edx, dword [ecx - 4]
lea esi, [ebp + 1]
sub eax, esi
or eax, edx
jge 0x4032de
mov ecx, esi
lea eax, [esp + 0x14]
call fcn.00403d50
mov ecx, dword [esp + 0x14]
test esi, esi
mov word [ecx + ebp*2], 0x3d
jl 0x4033ca
cmp esi, dword [ecx - 8]
jg 0x4033ca
mov dword [ecx - 0xc], esi
mov word [ecx + esi*2], 0
mov eax, dword [edi + 4]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00403fc0
mov esi, dword [esp + 0x14]
mov ebp, dword [esi - 0xc]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
lea edi, [ebp + 1]
sub eax, edi
or eax, ecx
jge 0x40333a
mov ecx, edi
lea eax, [esp + 0x14]
call fcn.00403d50
mov esi, dword [esp + 0x14]
test edi, edi
mov word [esi + ebp*2], 0xa
jl 0x4033ca
cmp edi, dword [esi - 8]
jg 0x4033ca
test ebx, ebx
mov ebp, dword [esp + 0x18]
mov dword [esi - 0xc], edi
mov word [esi + edi*2], 0
jne 0x403297
xor edi, edi
push 0x7ff
lea edx, [esp + 0x29]
push edi
push edx
mov byte [esp + 0x30], 0
call fcn.00580260
mov eax, dword [esi - 0xc]
add esp, 0xc
push edi
push edi
push 0x7ff
lea ecx, [esp + 0x30]
push ecx
push eax
push esi
push edi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
cmp ebx, edi
jg 0x4033d4
lea eax, [esi - 0x10]
mov byte [esp + 0x1834], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4033c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x40348e
push 0x80070057
call fcn.00404550
lea esi, [esp + 0x14]
call fcn.00403f60
push 0xfff
lea ecx, [esp + 0x829]
push edi
push ecx
mov byte [esp + 0x830], 0
call fcn.00580260
add esp, 0xc
mov dword [esp + 0x20], 0x1000
call fcn.004021f0
push eax
lea edx, [esp + 0x28]
push ebx
push edx
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x830]
call fcn.00401c40
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push 0x2001f
push edi
push str.SOFTWARETencentQQPinyin
push closesocket
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x4034b8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x828]
push edx
push 3
push edi
push str.Acc20
push eax
mov dword [esp + 0x34], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x403470
mov dword [ebp + 0x18], edi
xor eax, eax
cmp dword [ebp + 0x18], edi
lea ecx, [esp + 0x14]
sete al
mov edi, eax
call fcn.00404510
lea esi, [esp + 0x1c]
call fcn.00404130
mov eax, edi
mov ecx, dword [esp + 0x182c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1810]
xor ecx, esp
call fcn.005787fd
add esp, 0x1824
ret 4
lea ecx, [esp + 0x14]
call fcn.00404510
lea esi, [esp + 0x1c]
call fcn.00404130
xor eax, eax
jmp 0x40348e