Function at 0x401dd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a488
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x4213d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
test byte [0x4237a0], 1
lea esi, [ebx + 0xf]
jne 0x401e40
or dword [0x4237a0], 1
mov dword [ebp - 4], ebx
push 0x20
push str.E1A60273F0F84e9a9EB231E844EBABD9
mov ecx, 0x423784
mov dword [0x423798], esi
mov dword [0x423794], ebx
mov byte [0x423784], bl
call fcn.00405ed0
push 0x41a7f0
call fcn.00409f66
add esp, 4
test byte [0x4237a0], 2
jne 0x401e87
or dword [0x4237a0], 2
mov dword [ebp - 4], 1
push 0x20
push str.36D6DD7C52F14c81A1C4186971A6BB5B
mov ecx, 0x423768
mov dword [0x42377c], esi
mov dword [0x423778], ebx
mov byte [0x423768], bl
call fcn.00405ed0
push 0x41a7c0
call fcn.00409f66
add esp, 4
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov ecx, 0x423784
lea edi, [ebp - 0x34]
mov dword [ebp - 4], 2
call fcn.00401b50
test al, al
je 0x401ed6
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov ecx, 0x423768
lea edi, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.00401b50
test al, al
jne 0x401efa
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x401ed6
push eax
call fcn.00409f88
add esp, 4
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x401ee6
push eax
call fcn.00409f88
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 4
mov dword [ebp - 0x14], ebx
mov edi, 7
test byte [0x4237a0], al
jne 0x401f4e
or dword [0x4237a0], eax
mov byte [ebp - 4], al
xor eax, eax
mov word [0x42374c], ax
push 0x32
mov eax, str.SOFTWAREAntimalwareSolutionBrandScanningService
mov esi, 0x42374c
mov dword [0x423760], edi
mov dword [0x42375c], ebx
call fcn.00405150
push 0x41a780
call fcn.00409f66
add esp, 4
mov byte [ebp - 4], 3
test byte [0x4237a0], 8
jne 0x401f95
or dword [0x4237a0], 8
mov byte [ebp - 4], 5
xor ecx, ecx
push 0x2c
mov eax, str.SOFTWAREAntimalwareSolutionBrandAssistant
mov esi, 0x423730
mov dword [0x423744], edi
mov dword [0x423740], ebx
mov word [0x423730], cx
call fcn.00405150
push 0x41a740
call fcn.00409f66
add esp, 4
cmp dword [0x423760], 8
mov eax, dword [0x42374c]
jae 0x401fa8
mov eax, 0x42374c
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0x10]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x402001
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x401fd9
push eax
call fcn.00409f88
add esp, 4
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x401ee6
push eax
call fcn.00409f88
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub edx, esi
sar edx, 1
add edx, edx
push edx
push esi
push 3
push ebx
push str.mode
push eax
call edi
test eax, eax
je 0x402066
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x402041
push eax
call fcn.00409f88
add esp, 4
cmp esi, ebx
je 0x401ee6
push esi
call fcn.00409f88
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call esi
cmp dword [0x423744], 8
mov eax, dword [0x423730]
jae 0x402085
mov eax, 0x423730
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x10]
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4020cc
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x10]
sub ecx, eax
sar ecx, 1
add ecx, ecx
push ecx
push eax
push 3
push ebx
push str.mode
push edx
call edi
test eax, eax
je 0x4020f0
mov eax, dword [ebp - 0x10]
push eax
call esi
lea esi, [ebp - 0x24]
call fcn.00404d60
lea esi, [ebp - 0x34]
call fcn.00404d60
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
push ecx
call esi
lea esi, [ebp - 0x24]
call fcn.00404d60
lea esi, [ebp - 0x34]
call fcn.00404d60
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret