Function at 0x415200
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov eax, dword [0x62f040]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [esp + 0x20]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0
push 0
push 0x62fe40
push 0xfffffffffffffff7
push 0x20006
push eax
call sym.SystemInformer.exe_PhCreateKey
mov esi, eax
test esi, esi
jns 0x41531c
cmp esi, 0xc0000022
je 0x41527e
cmp esi, 0xc0000005
je 0x41527e
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x41526c
movzx eax, si
jmp 0x415288
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x41528c
mov eax, esi
jmp 0x415288
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x415297
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x4152a5
push eax
lfence
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
test esi, esi
je 0x4152ef
lfence
lfence
push dword [esi + 4]
push 0x5ce56c
push str.Unable_to_execute_the_program.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4154f0
lfence
jmp 0x4154eb
push str.Unable_to_execute_the_program.
push 0x5ce56c
push 0x10
push edi
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0058078f
mov esp, ebp
pop ebp
ret 8
mov ecx, ebx
call fcn.004f87a0
mov esi, eax
mov dword [esp + 0x10], 0x10000e
lea eax, [esp + 0x10]
mov dword [esp + 0x14], str.LastKey
mov ecx, dword [esi]
add ecx, 2
push ecx
push dword [esi + 4]
push 1
push 0
push eax
push dword [esp + 0x3c]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push dword [esp + 0x28]
call dword [sym.imp.ntdll.dll_NtClose]
or ebx, 0xffffffff
lea ecx, [esi - 8]
mov eax, ebx
lock xadd dword [ecx + 4], eax
dec eax
jne 0x415372
call fcn.004fc420
lea eax, [esp + 0x18]
push eax
call sym.SystemInformer.exe_PhGetSystemRoot
mov esi, dword [esp + 0x18]
push 0
push 0
mov dword [esp + 0x1c], 0
lea eax, [esi + 0x18]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
call sym.SystemInformer.exe_PhCreateString3
push esi
push dword [esp + 0x20]
mov dword [esp + 0x14], eax
push dword [eax + 4]
call fcn.00582850
mov eax, dword [esp + 0x18]
add esp, 0xc
mov ecx, dword [eax + 4]
mov eax, dword [str._regedit.exe]
add ecx, esi
mov dword [ecx], eax
mov eax, dword [0x5d1b60]
mov dword [ecx + 4], eax
mov eax, dword [0x5d1b64]
mov dword [ecx + 8], eax
mov eax, dword [0x5d1b68]
mov dword [ecx + 0xc], eax
mov eax, dword [0x5d1b6c]
mov dword [ecx + 0x10], eax
mov eax, dword [0x5d1b70]
mov dword [ecx + 0x14], eax
lea eax, [esp + 0x18]
push eax
call sym.SystemInformer.exe_PhGetOwnTokenAttributes
mov ecx, dword [esp + 0xc]
push 0
push 0
test dword [eax + 4], 1
mov eax, dword [ecx + 4]
je 0x41540b
push 0
jmp 0x41540d
push 1
push 5
push 0
push 0
push eax
push edi
call sym.SystemInformer.exe_PhShellExecuteEx
mov esi, eax
test esi, esi
jns 0x4154dc
cmp esi, 0xc0000022
je 0x41545e
cmp esi, 0xc0000005
je 0x41545e
and eax, 0xfff0000
cmp eax, 0x70000
jne 0x41544c
movzx eax, si
jmp 0x415468
mov eax, esi
and eax, 0xfff0000
cmp eax, 0xb0000
jne 0x41546c
mov eax, esi
jmp 0x415468
push esi
lfence
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosErrorNoTeb]
test eax, eax
jne 0x415477
push esi
lfence
call sym.SystemInformer.exe_PhGetNtMessage
jmp 0x415485
push eax
lfence
call sym.SystemInformer.exe_PhGetWin32Message
mov esi, eax
lfence
test esi, esi
je 0x4154c7
lfence
push dword [esi + 4]
push 0x5ce56c
push str.Unable_to_execute_the_program.
push 0xfffe
push 0x20
push edi
call sym.SystemInformer.exe_PhShowMessage2
add esp, 0x18
lea ecx, [esi - 8]
mov eax, ebx
lock xadd dword [ecx + 4], eax
dec eax
jne 0x4154dc
lfence
call fcn.004fc420
jmp 0x4154dc
push str.Unable_to_execute_the_program.
push 0x5ce56c
push 0x10
push edi
call sym.SystemInformer.exe_PhShowMessage
add esp, 0x10
mov ecx, dword [esp + 0xc]
add ecx, 0xfffffff8
lock xadd dword [ecx + 4], ebx
dec ebx
jne 0x4154f0
call fcn.004fc420
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0058078f
mov esp, ebp
pop ebp
ret 8