Function at 0x433610
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x4ce4bc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x444], eax
xor eax, eax
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], eax
mov dword [ebp - 0x45c], eax
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x450], eax
lea eax, [ebp - 0x464]
push eax
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectA]
test eax, eax
je 0x4338f8
cmp word [ebp - 0x452], 0x20
jne 0x4338f8
mov eax, dword [ebp - 0x45c]
mov esi, dword [ebp - 0x460]
cdq
xor eax, edx
shl esi, 5
sub eax, edx
shr esi, 3
imul esi, eax
mov dword [ebp - 0x45c], eax
push esi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
mov dword [ebp - 0x448], ebx
test ebx, ebx
je 0x4338f8
xor eax, eax
mov dword [ebp - 0x40c], 0
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x410], eax
mov dword [ebp - 0x408], eax
movzx eax, word [ebp - 0x452]
mov word [ebp - 0x422], ax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x428], eax
movzx eax, word [ebp - 0x454]
mov word [ebp - 0x424], ax
mov eax, dword [ebp - 0x460]
push 0
mov dword [ebp - 0x420], 0
mov dword [ebp - 0x430], 0x2c
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x42c], eax
mov dword [ebp - 0x418], 0
mov dword [ebp - 0x414], 0
mov dword [ebp - 0x44c], 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0
lea ecx, [ebp - 0x430]
mov dword [ebp - 0x46c], eax
push ecx
push ebx
push dword [ebp - 0x45c]
push 0
push edi
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je 0x4338cb
cmp dword [ebp - 0x41c], esi
jne 0x4338cb
push 0x400
lea eax, [ebp - 0x404]
mov dword [ebp - 0x440], 0
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov edi, dword [ebp - 0x444]
lea eax, [ebp - 0x440]
add esp, 0xc
push 0
push eax
push 0
push 0x20006
push 0
push 0
push 0
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4338cb
push str.Size
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4337ec
cmp eax, 2
jne 0x4338bf
push edi
push esi
push ebx
call fcn.004339c0
mov dword [ebp - 0x468], eax
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x444], eax
test esi, esi
je 0x433865
mov ecx, 0x100000
mov edi, edi
push eax
lea eax, [ebp - 0x404]
cmp esi, 0x100000
push str.Segment_u
mov edi, esi
push eax
cmova edi, ecx
call fcn.004322b0
add esp, 0xc
lea eax, [ebp - 0x404]
push edi
push ebx
push 3
push 0
push eax
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4338b9
mov eax, dword [ebp - 0x444]
add ebx, edi
inc eax
mov ecx, 0x100000
mov dword [ebp - 0x444], eax
sub esi, edi
jne 0x433810
mov eax, dword [ebp - 0x468]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x438], eax
mov eax, dword [ebp - 0x45c]
push 0xc
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x43c]
push eax
push 3
push 0
push str.Size
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor ecx, ecx
mov edx, 1
test eax, eax
cmove ecx, edx
mov dword [ebp - 0x44c], ecx
mov ebx, dword [ebp - 0x448]
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x46c]
call dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [ebp - 0x44c]
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049920c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049920c
mov esp, ebp
pop ebp
ret