Function at 0x435ed0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x596888
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x61ce74]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], 0
push dword [eax]
lea eax, [ebp - 0x1c]
push dword [0x61b3e0]
push eax
call fcn.004430a0
add esp, 0xc
mov byte [ebp - 4], 1
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x436271
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x14], esi
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 2
test eax, eax
je 0x435f52
push eax
call ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], 0
test eax, eax
je 0x43602e
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x18]
push ecx
push 0
lea ecx, [ebp - 0x20]
push ecx
push 0
push 0x5b3948
push eax
call edi
mov eax, dword [ebp - 0x20]
cmp eax, 1
je 0x435fa4
cmp eax, 2
jne 0x436024
lea ecx, [ebp - 0x14]
call fcn.00426010
mov edx, dword [ebp - 0x18]
shr edx, 1
add edx, 1
js 0x436285
mov esi, dword [ebp - 0x14]
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x435fda
push edx
lea ecx, [ebp - 0x14]
call fcn.00426250
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push 0
push 0x5b3948
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x436024
mov eax, dword [ebp - 0x18]
xor ecx, ecx
shr eax, 1
mov word [esi + eax*2], cx
push dword [esi - 8]
push esi
call fcn.0054b2c2
add esp, 8
test eax, eax
js 0x436285
cmp eax, dword [esi - 8]
jg 0x436285
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x43602e
push eax
call ebx
mov dword [ebp - 0x10], 0
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x43627b
mov eax, dword [ecx]
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x18], edi
cmp dword [esi - 0xc], 0
mov byte [ebp - 4], 3
jne 0x4360ff
mov eax, dword [ebp + 0x10]
push dword [eax]
mov eax, dword [ebp + 0xc]
push dword [eax]
lea eax, [ebp - 0x18]
push str.res__s_s.kui
push eax
call fcn.004289d0
mov eax, dword [ebp - 0x10]
add esp, 0x10
mov edi, dword [ebp - 0x1c]
test eax, eax
je 0x436085
push eax
call ebx
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
mov eax, dword [ebp + 8]
push 0
push 0xf003f
push 0
push 0
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x18]
test eax, eax
je 0x4360f3
mov edx, edi
lea ecx, [edx + 2]
mov dword [ebp + 0xc], ecx
lea esp, [esp]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4360c0
sub edx, dword [ebp + 0xc]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push edi
push 1
push 0
push 0x5b3948
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4360f3
push eax
call ebx
mov dword [ebp - 0x10], 0
jmp 0x4361fb
call fcn.00421b80
mov ecx, eax
test ecx, ecx
je 0x43628f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 4
push dword [eax]
lea eax, [ebp - 0x20]
push str.res__sribbon.kui
push eax
call fcn.004289d0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.00433b20
add esp, 0x14
test al, al
je 0x4361dc
mov eax, dword [ebp + 0xc]
push dword [eax]
lea eax, [ebp - 0x18]
push str.res__songmani.kui
push eax
call fcn.004289d0
mov eax, dword [ebp - 0x10]
add esp, 0xc
mov edi, dword [ebp - 0x1c]
test eax, eax
je 0x43616b
push eax
call ebx
push 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
mov eax, dword [ebp + 8]
push 0
push 0xf003f
push 0
push 0
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 0x18]
test eax, eax
je 0x4361d5
mov edx, edi
lea ecx, [edx + 2]
mov dword [ebp + 0xc], ecx
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x4361a2
sub edx, dword [ebp + 0xc]
sar edx, 1
lea ecx, [edx*2 + 2]
push ecx
push edi
push 1
push 0
push 0x5b3948
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4361d5
push eax
call ebx
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x20]
or eax, 0xffffffff
mov byte [ebp - 4], 3
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4361fb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea edx, [edi - 0x10]
mov byte [ebp - 4], 2
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x436219
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x436234
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1c]
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x436250
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x43625a
push ecx
call ebx
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00425f50
push 0x80004005
call fcn.00425f50
push 0x80070057
call fcn.00425f50
push 0x80004005
call fcn.00425f50
int3