Function at 0x426c20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x627a40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
push ebx
push esi
push edi
push 0x20
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
push str.cae04bc49778d3ec4522cef1584bb459
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00407270
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x426ca8
cmp eax, 0x10
jb 0x426c93
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
out 0x3d, al
pop ds
invalid
cmp eax, 0x10
jb 0x426cba
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
push 0x20
push str.305bb45efadd4cfe91663108028d9f81
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00407270
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x426d16
cmp eax, 0x10
jb 0x426cf9
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
outsd dx, dword [esi]
jge 0x426d1f
push ebp
invalid
cmp eax, 0x10
jb 0x426d28
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
push 0x20
push str.e963de71fc4f8287027741390a510f70
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x1c], 0
call fcn.00407270
cmp dword [ebp - 0xc], 0x100
mov eax, dword [ebp - 8]
jbe 0x426d82
cmp eax, 0x10
jb 0x426d67
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
test al, 0x1b
xchg byte [edx - 0x6c534e78], dl
push edi
out 0xa8, al
loop 0x426de1
lahf
invalid
cmp eax, 0x10
jb 0x426d94
inc eax
lea ecx, [ebp - 0x1c]
push eax
push dword [ebp - 0x1c]
call fcn.00407760
lea eax, [ebp - 0x28]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x426f1d
add al, ch
in al, 0xf1
add byte [eax], al
call fcn.00435fa0
test al, al
je 0x426ddc
inc eax
dec ebx
mov cl, 0xfd
inc esp
sbb edi, eax
and ebx, esp
enter 0x443, 0x12
das
mov byte [0xe53b27cf], al
mov dh, 0x47
xor dword [edx + 0x13], 0x5e
push es
push 0
lea eax, [ebp - 0x24]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push 0x619710
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x426e1b
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
call fcn.004360f0
test al, al
je 0x426e3f
les esi, [ebp - 0x6d]
popal
sub eax, 0xd593a8e3
fdiv qword [ebx + edi*4 - 0x63]
jge 0x426db6
cmp dword [edi + 0x3e], ebp
inc edi
mov bl, 0x8a
mov ch, byte [ebp - 0x25]
invalid
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.AppInfo
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x426e85
push dword [ebp - 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x20]
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00570ea9
mov esp, ebp
mov al, byte [0xe58b0014]
pop ebp
ret
call fcn.00436320
test al, al
je 0x426eae
call 0xfa38fa58
retf 0x86b3
call fcn.00435f30
test al, al
je 0x426ed3
neg esi
push ds
cwde
outsb dx, byte [esi]
in al, dx
inc ecx
popfd
inc edx
jnp 0x426ed0
dec ecx
xchg ecx, eax
fld qword [edx + 0x23]
add dword [eax + 0xcb58c4b], ecx
or dword [ebx], 0xffffffe0
ja 0x426e7e
loopne 0x426f49
stosd dword es:[edi], eax
mov edx, dword [ebp - 0x2c]
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x426ee0
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x20]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x24]
call esi
push dword [ebp - 0x28]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00570ea9
mov esp, ebp
pop ebp
ret
adc al, 0