Function at 0x433a10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5df99b
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x67432c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00451fd0
test al, al
je 0x4339cb
enter 0xffffffffffff8b5f, 0x7a
inc ebp
test eax, ecx
pop ebx
rol dword [edx - 0x30e06147], 0x8c
cmpsd dword [esi], dword es:[edi]
and ah, byte [eax + 0x75]
xor esi, dword [ebx]
rol bh, 0x85
mov ah, 0xfd
invalid
xor eax, eax
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x234], 7
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
call fcn.00480640
add esp, 0xc
lea ecx, [ebp - 0x248]
push 0x43
push str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
call fcn.00402ad0
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x24c]
push ecx
push 0xf013f
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov dword [ebp - 0x250], ebx
call fcn.0045223d
test al, al
je 0x433a6b
pop ebx
inc ebx
mov ebp, 0x99179d4c
pop ss
cdq
test dword [0xc5895300], ebx
invalid
call fcn.004525be
test al, al
je 0x433a9a
inc ebp
sub eax, 0xcc29ae82
mov al, byte [0x237ecf78]
dec eax
mov dword [0x4abe1fa4], eax
inc edi
js 0x433a57
or esi, dword [edi + 0x11]
mov byte [0xa72197a2], dl
fnsave dword [eax - 0x7c]
mov ebx, dword [ebp - 0x250]
call fcn.00451fd0
test al, al
je 0x433ac1
mov bh, 0x37
push ebp
aad 0x5c
pop ss
push edi
add dword gs:[ecx + 0x3f5228d5], eax
sbb dword [edx - 0x72bf2acd], esi
inc esp
xor al, 0x6e
sti
xchg ebp, eax
pop edx
jg 0x433a60
pop ebx
ret
test ebx, ebx
jne 0x433b89
push 0x19
xor eax, eax
mov dword [ebp - 0x21c], 7
push str.WanNengWB_Shell_Extension
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
call fcn.00402ad0
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
nop
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx], ax
lea edx, [edx + 2]
test ax, ax
jne 0x433b10
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x433b30
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
push 0
push str.B2A6906E_67AA_4613_B7ED_1CEB63834F37
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x21c]
cmp eax, 8
jb 0x433b89
inc eax
lea ecx, [ebp - 0x230]
push eax
push dword [ebp - 0x230]
call fcn.00402c20
call fcn.00451fd0
add dword [eax], eax
test al, al
je 0x433ba6
lcall 0x10c1, 0xa7c511e6
pop edx
jl 0x433b8c
neg ebx
adc edx, dword [edx]
pop ebx
dec ebx
dec edi
test dword [eax - 0x337a74b2], eax
std
invalid
mov eax, dword [ebp - 0x234]
cmp eax, 8
jb 0x433bc4
inc eax
lea ecx, [ebp - 0x248]
push eax
push dword [ebp - 0x248]
call fcn.00402c20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046d81d
mov esp, ebp
pop ebp
ret