Function at 0x422032
Capabilities:
Delete registry value
Persist via autoplayhandlers registry key
Persist via contextmenuhandlers registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x42b004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x420], esi
call fcn.0041e321
test eax, eax
jne 0x422fea
push ebx
push edi
call fcn.0041e3b9
xor edi, edi
push 2
inc edi
pop ebx
test eax, eax
je 0x4220f3
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x4049a0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4220f3
push 0x405f70
mov edx, 0x103
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x4220e7
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x4220bb
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
push esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x404a40
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x422172
push 0x405fc0
mov edx, 0x103
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x422166
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x42213a
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
push esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x404ad8
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4221f1
push 0x405fc0
mov edx, 0x103
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x4221e5
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x4221b9
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
push esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x404b70
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x422270
push 0x405fc0
mov edx, 0x103
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x422264
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x422238
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
push esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x404c08
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4222ef
push 0x405fc0
mov edx, 0x103
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x4222e3
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x4222b7
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
push esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x404c88
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42236e
push 0x405fc0
mov edx, 0x103
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x422362
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x422336
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
push esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x404d08
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4223ed
push 0x405fc0
mov edx, 0x103
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x4223e1
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x4223b5
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
push esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x404d88
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42246c
push 0x405fc0
mov edx, 0x103
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x422460
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x422434
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
push esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x404de8
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4224eb
push 0x405fc0
mov edx, 0x103
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x4224df
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x4224b3
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
push esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x404e48
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42256a
push 0x405fc0
mov edx, 0x103
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x42255e
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x422532
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
push esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x404ea8
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4225e9
push 0x406010
mov edx, 0x103
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x4225dd
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x4225b1
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
push esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x404fb8
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x422668
push 0x406054
mov edx, 0x103
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x42265c
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x422630
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
push esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x4050c4
call fcn.00421cb1
mov ecx, 0x405100
call fcn.00421cb1
mov ecx, 0x405140
call fcn.00421cb1
mov ecx, 0x405190
call fcn.00421cb1
mov ecx, 0x4051e0
call fcn.00421cb1
mov ecx, 0x404748
call fcn.00421cb1
mov ecx, 0x404760
call fcn.00421cb1
mov ecx, 0x404778
call fcn.00421cb1
xor ecx, ecx
call fcn.004215c1
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x405230
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x422709
push ebx
push 0x401064
push edi
push esi
push 0x405300
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x405430
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x422753
push ebx
push 0x401064
push edi
push esi
push 0x405518
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x405560
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42279d
push ebx
push 0x401064
push edi
push esi
push 0x405638
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x405670
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4227e7
push ebx
push 0x401064
push edi
push esi
push 0x405748
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x405778
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x422831
push ebx
push 0x401064
push edi
push esi
push 0x40584c
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x405878
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x42287b
push ebx
push 0x401064
push edi
push esi
push 0x40584c
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x405950
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x422932
push 0x24
push 0x40608c
push edi
push esi
push 0x4060b0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x24
push 0x4031ac
push edi
push esi
push 0x4060c0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x18
push 0x4060d4
push edi
push esi
push 0x4060ec
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0xa
push 0x404048
push edi
push esi
push 0x406108
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x66
push 0x406120
push ebx
push esi
push 0x4041c8
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x406188
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4229e9
push 0x24
push 0x40624c
push edi
push esi
push 0x4060b0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x24
push 0x4031ac
push edi
push esi
push 0x4060c0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1c
push 0x406270
push edi
push esi
push 0x4060ec
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0xa
push 0x404048
push edi
push esi
push 0x406108
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x66
push 0x406120
push ebx
push esi
push 0x4041c8
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x405ae0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x422aa0
push 0x24
push 0x40628c
push edi
push esi
push 0x4060b0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x24
push 0x4031ac
push edi
push esi
push 0x4060c0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x10
push 0x4062b0
push edi
push esi
push 0x4060ec
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0xa
push 0x404048
push edi
push esi
push 0x406108
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x66
push 0x406120
push ebx
push esi
push 0x4041c8
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x405c90
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x422b57
push 0x24
push 0x4062c0
push edi
push esi
push 0x4060b0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x24
push 0x4031ac
push edi
push esi
push 0x4060c0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x10
push 0x4062e4
push edi
push esi
push 0x4060ec
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0xa
push 0x404048
push edi
push esi
push 0x406108
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x66
push 0x406120
push ebx
push esi
push 0x4041c8
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x405bb0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x422c0e
push 0x24
push 0x4062f4
push edi
push esi
push 0x4060b0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x24
push 0x4031ac
push edi
push esi
push 0x4060c0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x10
push 0x4062e4
push edi
push esi
push 0x4060ec
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0xa
push 0x404048
push edi
push esi
push 0x406108
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x66
push 0x406120
push ebx
push esi
push 0x4041c8
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x405a18
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x422cc5
push 0x24
push 0x406318
push edi
push esi
push 0x4060b0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x24
push 0x4031ac
push edi
push esi
push 0x4060c0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x16
push 0x40633c
push edi
push esi
push 0x4060ec
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0xa
push 0x406354
push edi
push esi
push 0x406108
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x66
push 0x406120
push ebx
push esi
push 0x4041c8
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push 0x405d68
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x422d8d
push 0x26
push 0x406360
push edi
push esi
push 0x4060b0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x24
push 0x4031ac
push edi
push esi
push 0x4060c0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x4e
push 0x406388
push edi
push esi
push 0x4063d8
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x66
push 0x406120
push ebx
push esi
push 0x4041c8
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x16
push 0x4063f8
push edi
push esi
push 0x406410
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x406420
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x418]
push eax
push 0x2001f
push esi
push 0x4047b8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x422ece
lea eax, [ebp - 0x420]
push eax
push 0x2001f
push esi
push 0x401320
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x422ec2
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x424], 0x104
jmp 0x422e8f
push esi
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x424], 0x104
push eax
push esi
push 0x2001f
push esi
push esi
push esi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x422e8f
push 0x401064
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x422e70
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x422e40
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
push 0x40482c
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x422dec
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x420]
push eax
push 0x20006
push esi
push 0x404848
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x422fe8
push 0x401064
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.00418392
test eax, eax
js 0x422fdc
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], esi
push eax
push ebx
push esi
push 0x404900
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x422f79
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x422f3d
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
push 0x40482c
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x41c]
push eax
push ebx
push esi
push 0x404950
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x422fdc
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, si
jne 0x422fa0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
push esi
push 0x40482c
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00429770
mov esp, ebp
pop ebp
ret