Function at 0x431670
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df7a6
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x258], ecx
mov eax, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x24c], 0
call fcn.00480620
add esp, 0xc
mov dword [ebp - 0x234], 7
xor eax, eax
mov dword [ebp - 0x238], 0
lea ecx, [ebp - 0x248]
mov word [ebp - 0x248], ax
push 0x26
push str.B2A6906E_67AA_4613_B7ED_1CEB63834F37
call fcn.00402ac0
mov dword [ebp - 4], 0
call fcn.0045250c
test al, al
je 0x431727
sti
fstp qword [edx - 0x6a]
pop eax
cpuid
cmp eax, 0x4ddc743f
int 0x6b
shr dword [edi], 1
sub eax, 0x20ae9e8
add byte [eax + eax*8 + 0x123b1f74], al
call fcn.00452215
test al, al
je 0x43174f
cmp edx, dword [edx]
mov al, byte [0xb7d36c37]
cmp eax, 0x493de832
jae 0x431727
dec ebx
or edi, dword [eax]
add dword [edi], ebp
int1
inc edi
idiv al
dec edi
cmc
cmc
enter 0x13ea, 0x2b
add eax, 0x208dee8
add byte [eax + eax*8 - 0xfa4e98c], al
ficomp word [edi + 0x761040c9]
pushal
ret
call fcn.00452032
test al, al
je 0x43176e
pop ebx
invalid
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x250]
push 0
push ecx
push 0
push 0xf013f
push 0
push 0
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push eax
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43185d
push 0x19
push str.WanNengWB_Shell_Extension
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
call fcn.00402ac0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4317f0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431810
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x43185d
add byte [eax + 0x48], ch
imul ebx, dword [esi], 0xfdb0b5ff
invalid
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402c10
call fcn.00452620
test al, al
je 0x431879
cmp esp, dword [edx]
pop ss
clc
jae 0x43187c
dec esp
adc ah, cl
mov esi, 0x73961ca3
test eax, 0x22d3a2c2
call fcn.00452596
add al, byte [eax]
test al, al
je 0x43189d
adc byte [esi + 7], ah
loope 0x43182d
paddsw mm6, qword [ecx - 0x1d20b8e3]
mov eax, dword [0xe76c2903]
mov dl, 0xd8
or eax, 0x2474a919
loope 0x431897
sbb dword [ecx - 0x51edb8c], ebp
call fcn.00452551
test al, al
je 0x4318bf
and esp, edx
push ds
xchg edx, eax
pop ebp
xchg esi, eax
js 0x43187c
les edi, es:[ebx - 0x580b8c1d]
movsd dword es:[edi], dword [esi]
jo 0x43192f
cmp bl, ah
push ebp
sbb ecx, esi
outsb dx, byte [esi]
push esi
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x431a17
push 0
lea ecx, [ebp - 0x24c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.InprocServer32
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4319fc
call fcn.00402310
mov ecx, eax
call fcn.00471d04
push eax
lea ecx, [ebp - 0x230]
call fcn.00404060
mov eax, dword [ebp - 0x258]
lea ecx, [ebp - 0x230]
push 0xffffffffffffffff
push 0
add eax, 0x18
mov byte [ebp - 4], 1
push eax
call fcn.00405b10
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
std
invalid
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x431946
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x431960
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e6948
push dword [ebp - 0x24c]
call esi
movups xmm0, xmmword [str.Apartment]
mov eax, dword [0x5e9c6c]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x208], eax
lea edx, [ecx + 2]
movups xmmword [ebp - 0x218], xmm0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4319b3
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.ThreadingModel
push dword [ebp - 0x24c]
call esi
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x4319fc
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402c10
mov eax, dword [ebp - 0x24c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x431a0f
push eax
call esi
push dword [ebp - 0x250]
call esi
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x431a35
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402c10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d802
mov esp, ebp
pop ebp
ret 4