Function at 0x446830
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2ae8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
push ebx
push esi
push edi
mov eax, dword [0x676314]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.0047337c
test al, al
je 0x44687b
std
push ecx
inc esi
xchg byte [ecx], bh
mov ebx, 0x8f073533
jmp 0x5bb3351e
call fcn.004736b8
test al, al
je 0x446895
salc
mov dword [0xd07163f2], eax
mov edx, 0x70f042c6
sub edx, dword ss:[esi - 0x172a4170]
test al, 0xce
add al, byte [eax]
call fcn.00473742
test al, al
je 0x4468b5
sub byte [edx - 0x62dba195], bl
adc byte [edx], 0x90
sbb ecx, esp
mov edx, 0xd32eaec2
leave
inc edx
cmp al, byte [ebx + 0x4d8df79c]
shr al, 0x27
loop 0x4468bd
lea ecx, [ebp - 0x40]
call fcn.00464ae4
add byte [ebp + 0x45c7c04d], cl
cld
add byte [eax], al
add byte [eax], al
lea ecx, [ebp - 0x40]
mov dword [ebp - 4], 0
call fcn.00464bb1
test eax, eax
je 0x4469ed
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x446bb8
call fcn.00473337
test al, al
je 0x44692b
mov esi, 0xc0c227c4
cmp al, 0xe3
xchg ebp, eax
adc edx, ebx
hlt
ret 0x3cc0
call fcn.00473673
test al, al
je 0x44694d
mov dh, 0x3f
pop ecx
pop esi
adc byte [ebx - 0x2e271e19], bh
add al, ch
lodsd eax, dword [esi]
inc byte [ecx + 0xde855d]
je 0x446911
imul eax, dword [eax + 0x3ee84640], 0xffffffcb
add al, byte [eax]
call fcn.00473490
test al, al
je 0x44696e
push edx
cwde
test dword [eax + 0x1422ee9d], edx
sub byte [ecx + 0x67b6c8b9], ah
imul dword [esi + esi*8 + 0x6cef2971]
mov edx, 0x6afd1f
push 0
lea eax, [ebp - 0x18]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x5e8b28
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4469a1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x446bb8
call fcn.0047344b
test al, al
je 0x4469ba
test byte [ebx + 0x51], 0x2a
lds ecx, [eax]
xchg edi, eax
les esi, [ebp - 0x30]
and ah, dh
mov word [0xc758b46], ds
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
push dword [ebp - 0x10]
call ebx
call fcn.00473925
test al, al
je 0x446a11
sub al, 0x82
mov ah, 0x21
neg ebp
jno 0x446a48
retf 0x6fc9
call fcn.004732f2
test al, al
je 0x446a32
nop
invalid
call fcn.004739af
test al, al
je 0x446a4f
popal
adc cl, dl
jl 0x446aa6
dec esi
dec edx
rcr dword [ebx - 0x5f], 2
or al, byte [eax + 0x35]
sub eax, 0x99a5480a
xor eax, 0xa5480a2d
cdq
fisttp word [ebp + 0x45c7ec45]
in al, dx
add byte [eax], al
add byte [eax], al
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push 0xf003f
push 0
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x446bb8
call fcn.00473856
test al, al
je 0x446aa8
iretd
out dx, al
call fcn.00473337
test al, al
je 0x446acd
invalid
call fcn.004733c1
test al, al
je 0x446aec
push esp
xchg edx, eax
inc edx
ficom dword [edi]
add dword [ebp + edx*4 - 0x7d60518c], esp
and dl, cl
xchg ebx, eax
invalid
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x5e8b28
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x446b21
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
jmp 0x446bb8
call fcn.0047337c
test al, al
je 0x446b41
sal ebx, cl
adc byte [edi + 0x44244926], dl
dec esp
mov byte [0xead1dc82], al
pop ds
mov al, 0x29
pushal
out 0x27, eax
test al, 0x8b
jne 0x446b50
mov esi, dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
inc ebp
add al, byte [eax]
add byte [eax], al
push eax
push esi
push 1
push 0
add dword [edx], ebp
push dword [ebp + 8]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x14]
call esi
call fcn.00473925
test al, al
je 0x446b96
inc ebp
shr dword [ebp + 0x6f6d9f7d], cl
inc esp
push esp
ja 0x446b7d
and eax, 0xe77fd7b1
imul edi, dword [ebx], 0x9c08720c
push ds
jbe 0x446bc0
call fcn.004736fd
test al, al
je 0x446bb8
test al, 0xe7
inc eax
xor dword [edi + 0x29], eax
mov esi, 0x6b237dfc
js 0x446b55
jle 0x446b4d
cmp al, 0x4c
add esp, dword [ecx]
out dx, al
test byte [eax], al
das
aad 0xa3
lea ecx, [ebp - 0x40]
call fcn.00464af7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8