Function at 0x409ab5
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x657340]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x208]
push edi
xor ebx, ebx
mov edi, 0x20006
push ebx
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallVKSaver
push reloc.WS2_32.dll_bind
call esi
test eax, eax
je 0x409b23
push ebx
lea eax, [ebp - 0x208]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallVKSaver
push reloc.WS2_32.dll_accept
call esi
test eax, eax
je 0x409b23
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004554d0
leave
ret
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x204]
push 0x64f888
push eax
call edi
mov ebx, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
lea eax, [ebp - 0x204]
push eax
call ebx
add esp, 0xc
lea eax, [eax*2 + 2]
lea ecx, [eax + eax]
cmp ecx, 0x200
jae 0x409d45
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
push eax
lea eax, [ebp - 0x204]
mov word [ebp + ecx - 0x204], dx
push eax
push 1
push edx
push str.DisplayName
push dword [ebp - 0x208]
call esi
test eax, eax
je 0x409b9c
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x409b12
push 0x678f80
lea eax, [ebp - 0x204]
push 0x64f32c
push eax
call edi
lea eax, [ebp - 0x204]
push eax
call ebx
add esp, 0x10
lea eax, [eax*2 + 2]
lea ecx, [eax + eax]
cmp ecx, 0x200
jae 0x409d45
push eax
lea eax, [ebp - 0x204]
xor edx, edx
push eax
push 1
push edx
push str.DisplayIcon
push dword [ebp - 0x208]
mov word [ebp + ecx - 0x204], dx
call esi
test eax, eax
jne 0x409b8b
push 0x678f80
lea eax, [ebp - 0x204]
push str.__s___uninstall
push eax
call edi
lea eax, [ebp - 0x204]
push eax
call ebx
add esp, 0x10
lea eax, [eax*2 + 2]
lea ecx, [eax + eax]
cmp ecx, 0x200
jae 0x409d45
push eax
lea eax, [ebp - 0x204]
xor edx, edx
push eax
push 1
push edx
push str.UninstallString
push dword [ebp - 0x208]
mov word [ebp + ecx - 0x204], dx
call esi
test eax, eax
jne 0x409b8b
cmp dword [0x679634], 7
mov eax, 0x679620
push 0x678f80
cmova eax, dword [0x679620]
push eax
lea eax, [ebp - 0x204]
push eax
call edi
lea eax, [ebp - 0x204]
push eax
call ebx
add esp, 0x10
lea eax, [eax*2 + 2]
lea ecx, [eax + eax]
cmp ecx, 0x200
jae 0x409d45
push eax
lea eax, [ebp - 0x204]
xor edx, edx
push eax
push 1
push edx
push str.Publisher
push dword [ebp - 0x208]
mov word [ebp + ecx - 0x204], dx
call esi
test eax, eax
jne 0x409b8b
push dword [0x65884c]
lea eax, [ebp - 0x204]
push dword [0x658848]
push dword [0x658844]
push dword [0x658840]
push str._d._d._d._d
push eax
call edi
lea eax, [ebp - 0x204]
push eax
call ebx
add esp, 0x1c
lea eax, [eax*2 + 2]
lea ecx, [eax + eax]
cmp ecx, 0x200
jae 0x409d45
push eax
lea eax, [ebp - 0x204]
xor edx, edx
push eax
push 1
push edx
push str.DisplayVersion
push dword [ebp - 0x208]
mov word [ebp + ecx - 0x204], dx
call esi
push dword [ebp - 0x208]
test eax, eax
jne 0x409b91
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x409b14
call fcn.004558b3
int3