Function at 0x401df7
Capabilities:
Set registry value

Disassembly:
push ebx
push edi
mov edx, 0xc
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x401dfe
mov edx, dword [esp + 0x40]
lea ecx, [esp]
call fcn.00403000
mov edx, dword [esp + 0x44]
lea ecx, [esp + 4]
call fcn.00403000
mov edx, dword [esp + 0x48]
lea ecx, [esp + 8]
call fcn.00403000
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x24], 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 4]
push dword [esp + 0x44]
call sub.ADVAPI32.dll_RegCreateKeyW
mov ebx, eax
and ebx, ebx
jne 0x40204d
mov dword [esp + 0x10], 1
movsx ebx, byte [esp + 0x4c]
push ebx
mov ebx, 4
cmp ebx, dword [esp]
jne 0x401ecd
push dword [esp + 0xc]
call fcn.004034c0
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], 4
push dword [esp + 0x24]
push dword [esp + 0x10]
movsx eax, byte [esp + 0x58]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegSetValueExW
mov ebx, eax
and ebx, ebx
jne 0x401ec8
mov dword [esp + 0x14], 2
jmp 0x402043
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x401f25
push dword [esp + 0xc]
call fcn.004034c0
push edx
push eax
pop dword [esp + 0x20]
pop dword [esp + 0x20]
mov dword [esp + 0x24], 8
push dword [esp + 0x24]
push dword [esp + 0x10]
movsx eax, byte [esp + 0x58]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegSetValueExW
mov ebx, eax
and ebx, ebx
jne 0x401f20
mov dword [esp + 0x14], 2
jmp 0x402043
mov ebx, 1
cmp ebx, dword [esp]
jne 0x401f70
push dword [esp + 0xc]
call fcn.004033d0
mov dword [esp + 0x24], eax
push dword [esp + 0x24]
mov eax, dword [esp + 0x10]
push eax
movsx eax, byte [esp + 0x58]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegSetValueExW
mov ebx, eax
and ebx, ebx
jne 0x401f6b
mov dword [esp + 0x14], 2
jmp 0x402043
mov ebx, 7
cmp ebx, dword [esp]
jne 0x402043
mov eax, dword [esp + 0xc]
push eax
call fcn.00404260
mov ebx, eax
add ebx, 2
add ebx, ebx
mov dword [esp + 0x24], ebx
push dword [esp + 0x24]
call fcn.00404290
mov dword [esp + 0x2c], eax
push dword [esp + 0xc]
push dword [esp + 0x30]
call fcn.004042b0
mov dword [esp + 0x28], 1
jmp 0x401fb7
mov eax, 0x40602a
push eax
push dword [esp + 0x10]
call fcn.00403600
cmp eax, dword [esp + 0x28]
jl 0x402006
mov ebx, dword [esp + 0x30]
inc ebx
push ebx
mov eax, 0x40602a
push eax
push dword [esp + 0x14]
call fcn.00403690
mov dword [esp + 0x30], eax
push 0
mov ebx, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
add edi, edi
add ebx, edi
add ebx, 0xfffffffe
mov eax, ebx
call fcn.00403080
inc dword [esp + 0x28]
jno 0x401fb7
push dword [esp + 0x2c]
call fcn.004042f0
push eax
push dword [esp + 0x30]
movsx eax, byte [esp + 0x58]
push eax
push 0
push dword [esp + 0x18]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegSetValueExW
mov ebx, eax
and ebx, ebx
jne 0x40203a
mov dword [esp + 0x14], 2
push dword [esp + 0x2c]
call fcn.00404310
pop eax
push dword [esp + 0xc]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [esp + 0x10]
jmp 0x402055
push dword [esp + 8]
call fcn.00404ba0
push dword [esp + 4]
call fcn.00404ba0
push dword [esp]
call fcn.00404ba0
add esp, 0x30
pop edi
pop ebx
ret 0x14