Function at 0x403988
Capabilities:
Set registry value

Disassembly:
push 0x230
mov eax, 0x433c4d
call fcn.0042e78d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x238], eax
mov eax, dword [0x44970c]
xor esi, esi
mov ecx, 0x44970c
mov dword [ebp - 0x224], esi
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x230], edi
xor eax, eax
mov dword [ebp - 4], esi
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.0041ca10
add esp, 0xc
push 0x103
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, esi
je 0x403eee
cmp eax, 0x104
jae 0x403eee
lea ebx, [ebp - 0x228]
call fcn.00410f45
mov byte [ebp - 4], 1
push dword [eax]
lea eax, [ebp - 0x21c]
push eax
call fcn.00404084
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff0
call fcn.00401053
mov eax, dword [ebp - 0x21c]
mov eax, dword [eax - 0xc]
inc eax
push eax
lea esi, [ebp - 0x21c]
call fcn.00401bb2
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push eax
call ebx
mov eax, dword [ebp - 0x21c]
push dword [eax - 8]
push eax
call fcn.0041b37d
pop ecx
pop ecx
mov edx, esi
call fcn.00401bd8
xor edi, edi
push edi
lea eax, [ebp - 0x234]
push str.WRAaRxcUQURAD0cREkcPFkQUFA8aF0YaDxERGxoaF0AVEBRAGl8
push eax
call fcn.00413ad1
add esp, 0xc
mov byte [ebp - 4], 4
push dword [eax]
mov eax, esi
call fcn.004043e5
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x234]
add eax, 0xfffffff0
call fcn.00401053
mov eax, dword [ebp - 0x21c]
mov eax, dword [eax - 0xc]
inc eax
push eax
call fcn.00401bb2
push eax
call ebx
mov eax, dword [ebp - 0x21c]
push dword [eax - 8]
push eax
call fcn.0041b37d
pop ecx
pop ecx
mov edx, esi
call fcn.00401bd8
push dword [ebp - 0x21c]
lea eax, [ebp - 0x23c]
push eax
call fcn.00403f00
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x23c]
cmp dword [eax - 0xc], edi
jne 0x403b20
xor bl, bl
mov eax, dword [ebp - 0x23c]
add eax, 0xfffffff0
call fcn.00401053
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
call fcn.00401053
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
call fcn.00401053
mov al, bl
jmp 0x403ef8
push edi
lea eax, [ebp - 0x228]
push str.AAdRAAINV0xLTFFWQ05O
push eax
call fcn.00413ad1
add esp, 0xc
mov byte [ebp - 4], 6
mov eax, dword [eax]
push dword [ebp - 0x23c]
push eax
lea eax, [ebp - 0x230]
call fcn.00401cd7
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x228]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.00401053
push edi
lea eax, [ebp - 0x228]
push 0x438dd8
push eax
call fcn.00413ad1
mov eax, dword [eax]
add esp, 0xc
push edi
lea ecx, [ebp - 0x224]
push ecx
push edi
push 0x2001f
push edi
push edi
push edi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
mov eax, dword [ebp - 0x228]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call fcn.00401053
test bl, bl
je 0x403ec7
push edi
lea eax, [ebp - 0x228]
push str.YU5NV0YCa0xRVkNOTkdQ
push eax
call fcn.00413ad1
add esp, 0xc
push edi
lea eax, [ebp - 0x234]
push str.EAwbDBIMFg
push eax
mov byte [ebp - 4], 7
call fcn.00413ad1
add esp, 0xc
push edi
lea eax, [ebp - 0x220]
push 0x438f14
push eax
mov byte [ebp - 4], 8
call fcn.00413ad1
mov ecx, dword [ebp - 0x238]
mov ecx, dword [ecx + 8]
mov edx, dword [ecx - 0xc]
mov eax, dword [eax]
add esp, 0xc
lea edx, [edx + edx + 2]
push edx
push ecx
push 1
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
push dword [ebp - 0x224]
call edi
mov ebx, eax
mov eax, dword [ebp - 0x220]
neg ebx
sbb bl, bl
inc bl
add eax, 0xfffffff0
and bl, 1
call fcn.00401053
xor esi, esi
push esi
lea eax, [ebp - 0x220]
push str.ZktRUk5DW3RHUFFLTUw
push eax
call fcn.00413ad1
mov edx, dword [ebp - 0x234]
mov ecx, dword [edx - 0xc]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ecx + ecx + 2]
push ecx
push edx
push 1
push esi
push eax
push dword [ebp - 0x224]
call edi
neg eax
sbb al, al
inc al
and bl, al
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
call fcn.00401053
push esi
lea eax, [ebp - 0x220]
push str.cldATktRSkdQ
push eax
call fcn.00413ad1
mov edx, dword [ebp - 0x228]
mov ecx, dword [edx - 0xc]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ecx + ecx + 2]
push ecx
push edx
push 1
push esi
push eax
push dword [ebp - 0x224]
call edi
neg eax
sbb al, al
inc al
and bl, al
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
call fcn.00401053
push esi
lea eax, [ebp - 0x220]
push str.a0xRVkNOTm5NQUNWS01M
push eax
call fcn.00413ad1
mov edx, dword [ebp - 0x21c]
mov ecx, dword [edx - 0xc]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ecx + ecx + 2]
push ecx
push edx
push 1
push esi
push eax
push dword [ebp - 0x224]
call edi
neg eax
sbb al, al
inc al
and bl, al
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
call fcn.00401053
push esi
lea eax, [ebp - 0x220]
push str.d0xLTFFWQ05OcVZQS0xF
push eax
call fcn.00413ad1
mov edx, dword [ebp - 0x230]
mov ecx, dword [edx - 0xc]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ecx + ecx + 2]
push ecx
push edx
push 1
push esi
push eax
push dword [ebp - 0x224]
call edi
neg eax
sbb al, al
inc al
and bl, al
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
call fcn.00401053
push esi
lea eax, [ebp - 0x220]
push 0x438fd8
push eax
call fcn.00413ad1
mov ecx, dword [ebp - 0x238]
mov eax, dword [eax]
add esp, 0xc
push 4
add ecx, 4
push ecx
push 4
push esi
push eax
push dword [ebp - 0x224]
call edi
neg eax
sbb al, al
inc al
and bl, al
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
call fcn.00401053
push esi
lea eax, [ebp - 0x22c]
push 0x439004
push eax
call fcn.00413ad1
add esp, 0xc
mov esi, dword [ebp - 0x238]
mov byte [ebp - 4], 9
mov eax, dword [eax]
add esi, 0x1c
mov ecx, dword [esi]
mov ecx, dword [ecx - 0xc]
mov dword [ebp - 0x220], eax
lea eax, [ecx + ecx + 2]
push eax
call fcn.00404273
push eax
push 1
push 0
push dword [ebp - 0x220]
push dword [ebp - 0x224]
call edi
neg eax
sbb al, al
inc al
and bl, al
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
call fcn.00401053
push 0
lea eax, [ebp - 0x22c]
push 0x439038
push eax
call fcn.00413ad1
mov esi, dword [ebp - 0x238]
mov ecx, dword [esi + 0x2c]
mov edx, dword [ecx - 0xc]
mov eax, dword [eax]
add esp, 0xc
lea edx, [edx + edx + 2]
push edx
push ecx
push 1
push 0
push eax
push dword [ebp - 0x224]
call edi
neg eax
sbb al, al
inc al
and bl, al
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
call fcn.00401053
push 0
lea eax, [ebp - 0x22c]
push 0x439074
push eax
call fcn.00413ad1
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx - 0xc]
mov eax, dword [eax]
add esp, 0xc
lea edx, [edx + edx + 2]
push edx
push ecx
push 1
push 0
push eax
push dword [ebp - 0x224]
call edi
neg eax
sbb al, al
inc al
and bl, al
mov eax, dword [ebp - 0x22c]
add eax, 0xfffffff0
call fcn.00401053
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x234]
add eax, 0xfffffff0
call fcn.00401053
mov eax, dword [ebp - 0x228]
add eax, 0xfffffff0
call fcn.00401053
jmp 0x403aef
mov eax, dword [ebp - 0x23c]
add eax, 0xfffffff0
call fcn.00401053
mov eax, dword [ebp - 0x21c]
add eax, 0xfffffff0
call fcn.00401053
mov eax, dword [ebp - 0x230]
add eax, 0xfffffff0
jmp 0x403ef1
lea eax, [edi - 0x10]
call fcn.00401053
xor al, al
call fcn.0042e810
ret 4