Function at 0x42ef60
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x4be4bc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
xor eax, eax
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x468], eax
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], eax
lea eax, [ebp - 0x468]
push eax
push 0x18
push edi
mov dword [ebp - 0x444], ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x42f268
cmp word [ebp - 0x456], 0x20
jne 0x42f268
mov eax, dword [ebp - 0x460]
mov esi, dword [ebp - 0x464]
cdq
shl esi, 5
xor eax, edx
shr esi, 3
sub eax, edx
and esi, 0x1ffffffc
mov dword [ebp - 0x460], eax
imul esi, eax
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
add esp, 4
mov dword [ebp - 0x448], eax
test eax, eax
je 0x42f268
xor eax, eax
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x408], eax
movzx eax, word [ebp - 0x456]
mov word [ebp - 0x422], ax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x428], eax
movzx eax, word [ebp - 0x458]
mov word [ebp - 0x424], ax
mov eax, dword [ebp - 0x464]
push 0
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x430], 0x2c
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x450], 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x470], eax
push ecx
push dword [ebp - 0x448]
push dword [ebp - 0x460]
push 0
push edi
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je 0x42f236
cmp dword [ebp - 0x41c], esi
jne 0x42f236
push 0x400
lea eax, [ebp - 0x404]
mov dword [ebp - 0x440], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x440]
push 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ebx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42f236
push str.Size
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x42f13f
cmp eax, 2
jne 0x42f22a
push dword [ebp - 0x444]
mov eax, dword [ebp - 0x448]
mov ebx, eax
push esi
push eax
call fcn.0042f390
mov dword [ebp - 0x46c], eax
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x44c], eax
test esi, esi
je 0x42f1d6
lea esp, [esp]
push eax
mov edi, 0x100000
lea eax, [ebp - 0x404]
cmp esi, edi
push str.Segment_u
push eax
cmovb edi, esi
call fcn.0042de30
add esp, 0xc
mov dword [ebp - 0x444], esi
lea eax, [ebp - 0x404]
push edi
push ebx
push 3
push 0
push eax
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x42f1cd
mov eax, dword [ebp - 0x44c]
sub esi, edi
inc eax
mov dword [ebp - 0x444], esi
add ebx, edi
mov dword [ebp - 0x44c], eax
test esi, esi
jne 0x42f170
cmp dword [ebp - 0x444], 0
jne 0x42f22a
mov eax, dword [ebp - 0x46c]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x460]
push 0xc
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x43c]
push eax
push 3
push 0
push str.Size
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
mov edx, 1
test eax, eax
cmove ecx, edx
mov dword [ebp - 0x450], ecx
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x470]
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x448]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x450]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0048cbb4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048cbb4
mov esp, ebp
pop ebp
ret