Function at 0x432530
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e2852
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x678390]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x268], ecx
mov eax, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x264], eax
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x258], 0
call fcn.00483520
add esp, 0xc
mov dword [ebp - 0x234], 7
xor eax, eax
mov dword [ebp - 0x238], 0
lea ecx, [ebp - 0x248]
mov word [ebp - 0x248], ax
push 1
push 0x5ecfec
call fcn.00402b90
push 0x24
push 0x5ecff0
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], 0
call fcn.00405d30
push 1
push 0x5ed03c
lea ecx, [ebp - 0x248]
call fcn.00405d30
call fcn.0045398d
test al, al
je 0x432636
iretd
jnp 0x43268a
in eax, 0x1e
xor dl, byte [ebp + 0x7d]
add esi, dword [ebx]
mov edi, 0x21633701
out dx, al
rcr dword [esi + 0x6fe8586d], 1
adc dword [edx], eax
add byte [eax + eax*8 - 0xa5de18c], al
sub byte [esi - 0x40], 0xe6
pop ss
call fcn.004537aa
test al, al
je 0x43265d
mov byte [0xc06e80f5], al
out 0x17, al
out 0x37, al
add byte [ecx - 0x44c5c1b2], dh
pop es
sar dword [esi], cl
xchg byte [edx - 0x29], ah
loopne 0x4325f2
dec esp
imul ebp, eax, 5
and dword [esi], edi
sbb ebp, eax
pop ss
adc al, byte [edx]
add byte [eax + eax*8 + 0x22931f74], al
insd dword es:[edi], dx
cmp dword [edx - 0x48], ecx
in al, dx
and dword [ecx], edi
jmp 0xa520f3ca
call fcn.00453879
test al, al
je 0x432685
xchg ebx, eax
and ch, byte [ebp + 0x39]
dec edx
mov eax, 0x653921ec
jmp 0xa520f3ca
cmp dword [ebp - 0x234], 8
dec dword [eax]
lea ecx, [ebp - 0x24c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push ecx
push 0
push 0xf013f
push 0
push 0
push 0
push eax
push dword [ebp - 0x264]
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x432814
push 2
xor eax, eax
mov dword [ebp - 0x21c], 7
push 0x5ed040
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
call fcn.00402b90
push 0x14
push str.OverlayIconWanNengWB
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.00405d30
push 6
push str._Class
lea ecx, [ebp - 0x230]
call fcn.00405d30
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x432740
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
add ah, byte [esi + 0xf]
pop ds
inc esp
add byte [eax], al
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432760
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e9978
push dword [ebp - 0x24c]
call ebx
call fcn.0045360c
test al, al
je 0x4327a4
jbe 0x432759
scasd eax, dword es:[edi]
loop 0x43279f
leave
cmp byte [edi], cl
jno 0x4327ed
xchg ebx, eax
or eax, eax
les edi, [ebp + ebp - 0x47]
adc eax, dword [eax]
add byte [eax], al
mov ecx, 0x13
lea edi, [ebp - 0x218]
mov esi, str.20853498_9FFE_40D2_B62D_D480ADAF337E
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
movsw word es:[edi], word [esi]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4327c1
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.AppID
push dword [ebp - 0x24c]
call ebx
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x43280e
test esp, esp
std
invalid
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402ce0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 0x24c]
test eax, eax
je 0x432e40
push 0
lea ecx, [ebp - 0x250]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.InprocServer32
push eax
call edi
test eax, eax
jne 0x4329b3
mov esi, dword [ebp - 0x268]
lea ecx, [ebp - 0x230]
push 0xffffffffffffffff
push eax
push esi
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], eax
mov word [ebp - 0x230], ax
call fcn.00402a70
push 0xffffffffffffffff
push 0
lea eax, [esi + 0x30]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x230]
call fcn.00405c20
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x4328a5
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4328c0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e9978
push dword [ebp - 0x250]
call ebx
call fcn.00453aa1
test al, al
je 0x432911
sbb eax, 0xa9625ce3
psubd mm7, mm4
jns 0x43290a
jecxz 0x432952
bound ebp, qword [ecx + 0x79fcfa0f]
or eax, 0x55135fd1
rcr dword [edi + 0x13], 1
push ebp
xor eax, 0xaf161d85
jne 0x4328f3
and eax, dword [ecx + 0x5616b7e0]
loopne 0x4328c3
push ss
push esi
outsd dx, dword [esi]
sub byte [eax - 0x18], dl
lahf
adc al, byte [edx]
add byte [eax + eax*8 - 0x7a90db8c], al
mov ch, 0x1e
outsb dx, byte [esi]
jmp 0x449b859f
call fcn.00453bb5
test al, al
je 0x43293e
outsd dx, dword [esi]
test dword [ebp + 0x7be96e1e], esi
pop esp
pop eax
inc esp
aam 0xdb
xchg ebp, eax
xor byte [edx - 0x687d1da0], dh
dec esi
invalid
movups xmm0, xmmword [str.Apartment]
mov eax, dword [0x5ece64]
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x208], eax
lea edx, [ecx + 2]
movups xmmword [ebp - 0x218], xmm0
clc
std
invalid
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432960
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.ThreadingModel
push dword [ebp - 0x250]
call ebx
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x4329b3
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402ce0
push 0
lea eax, [ebp - 0x254]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.ProgID
push dword [ebp - 0x24c]
call edi
test eax, eax
jne 0x432ac9
push str.OverlayIconWanNengWB
lea ecx, [ebp - 0x230]
call fcn.00404170
push 1
push 0x5eb880
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 3
call fcn.00405d30
push 2
push 0x5ed040
lea ecx, [ebp - 0x230]
call fcn.00405d30
push 0x14
push str.OverlayIconWanNengWB
lea ecx, [ebp - 0x230]
call fcn.00405d30
push 2
push 0x5ed0f4
lea ecx, [ebp - 0x230]
call fcn.00405d30
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x432a54
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432a70
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e9978
push dword [ebp - 0x254]
call ebx
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x432ac9
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402ce0
push 0
lea eax, [ebp - 0x260]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.Programmable
push dword [ebp - 0x24c]
call edi
push 0
lea eax, [ebp - 0x25c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.TypeLib
push dword [ebp - 0x24c]
call edi
test eax, eax
jne 0x432bdd
push 0x5ecfec
lea ecx, [ebp - 0x230]
call fcn.00404170
push 0x24
push str.7A3B0D6F_8BB3_4007_B032_BD7782EEAD56
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 4
call fcn.00405d30
push 1
push 0x5ed03c
lea ecx, [ebp - 0x230]
call fcn.00405d30
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x432b70
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432b90
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e9978
push dword [ebp - 0x25c]
call ebx
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x432bdd
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402ce0
call fcn.004538be
test al, al
je 0x432c01
mov al, byte [0xb8587760]
sbb si, ax
lds ebp, [eax]
aad 0x7c
std
invalid
call fcn.00453765
test al, al
je 0x432c28
imul ecx, eax, 0xffffff87
dec edx
aam 0x14
lahf
retf 0x3005
push 0
lea eax, [ebp - 0x258]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.VersionIndependentProgID
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x432d41
push str.OverlayIconWanNengWB
lea ecx, [ebp - 0x230]
call fcn.00404170
push 1
push 0x5eb880
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 5
call fcn.00405d30
push 2
push 0x5ed040
lea ecx, [ebp - 0x230]
call fcn.00405d30
push 0x14
push str.OverlayIconWanNengWB
lea ecx, [ebp - 0x230]
call fcn.00405d30
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop dword [eax + eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x432cc0
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x432ce0
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push 0x5e9978
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x258]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
mov eax, dword [ebp - 0x21c]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x432d47
invalid
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402ce0
jmp 0x432d47
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00453765
test al, al
je 0x432d6f
pop ds
retf
mov dl, 0x9a
mov dword [0xb8ef537f], ebx
push edi
sbb dword [esi + 0x6ba97323], ecx
rcl byte [edi + edx*8 - 0x7d], 0x86
jmp 0x432cf7
mov eax, dword [ebp - 0x25c]
test eax, eax
je 0x432d7c
push eax
call esi
call fcn.00453a17
test al, al
je 0x432d9c
lodsb al, byte [esi]
fldenv [ebp + 0x56281518]
lds esi, [0x33793576]
xor al, byte [esi]
sbb ah, bh
ljmp 0xe871
call fcn.004537aa
test al, al
je 0x432dbd
sal byte [eax + ebx + 0x55], 0x8a
in eax, 0xf1
push ebp
mov ah, ch
int1
stosd dword es:[edi], eax
push ecx
loopne 0x432d54
loopne 0x432d4f
ret 0x4940
call fcn.00453834
test al, al
je 0x432dde
or al, byte [edx]
add byte [eax + eax*8 + 0x696a1874], al
push 0x69
imul edi, eax, 0xacd4a3e4
clc
in al, 0xa3
aam 0xac
loopne 0x432da2
test dword [0x9ab911], ebp
outsb dx, byte [esi]
int1
push edi
push es
imul dword [edx]
cdq
cmpsb byte [esi], byte es:[edi]
pop edi
mov eax, dword [ebp - 0x260]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x432df1
push eax
call ebx
call fcn.004539d2
test al, al
je 0x432e0c
inc esi
jl 0x432dbf
mov edi, 0x4e91fe86
sahf
jle 0x432dc7
test byte [ebx - 0x61b1f1e5], 0x22
mov eax, dword [ebp - 0x250]
test eax, eax
je 0x432e19
push eax
call ebx
call fcn.00453c3f
test al, al
je 0x432e32
jne 0x432e70
outsd dx, dword [esi]
imul edx, dword [edi + ebp*2], 0xffffffed
cmp eax, 0x81514766
xchg ebx, eax
invalid
push dword [ebp - 0x24c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x432e5e
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402ce0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0047070c
mov esp, ebp
pop ebp
ret 4
int 0xe8
xchg esi, eax
fadd dword [ebx]
add byte [ebx + 0x4c25de5], cl
add ah, cl
int3