Function at 0x410700
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x46e780]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [0x46fb44]
mov ebx, eax
push 0xa
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x14], ebx
call fcn.00428c5c
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x18], esp
mov esi, esp
push eax
mov dword [ebp - 0x18], eax
call fcn.00402490
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.0040bb40
add esp, 8
cmp eax, 4
je 0x4107bf
lea ecx, [ebp - 0x18]
push str._WriteReg__Invalid_arguments__nArg_4_:
push ecx
lea ecx, [ebp + 8]
call fcn.004022b0
mov edi, dword [eax]
xor esi, esi
add esp, 8
cmp edi, esi
jne 0x410777
mov dword [ebp - 8], esi
jmp 0x4107a5
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x41078d
mov dword [ebp - 8], esi
jmp 0x4107a5
lea esi, [eax + eax]
mov eax, esi
call fcn.004411d0
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.00408520
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x48]
call fcn.0043a782
push 0x468880
lea eax, [ebp - 0x48]
push eax
call fcn.0043e4e2
xor esi, esi
push esi
lea ecx, [ebp - 0x3c]
mov dword [ebp - 8], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00428c38
cmp eax, esi
jne 0x4107da
jmp fcn.00423c33
add eax, 8
push str.HKEY_CURRENT_USER
push eax
call fcn.004038c0
add esp, 8
test al, al
je 0x4107f8
mov dword [ebp - 8], SysReAllocString
jmp 0x410826
push esi
lea ecx, [ebp - 0x3c]
call fcn.00428c38
cmp eax, esi
jne 0x41080a
jmp fcn.00423c33
add eax, 8
push str.HKEY_CLASSES_ROOT
push eax
call fcn.004038c0
add esp, 8
test al, al
je 0x410826
mov dword [ebp - 8], SysReAllocString
push 1
lea ecx, [ebp - 0x3c]
call fcn.00428c38
cmp eax, esi
jne 0x410839
jmp fcn.00423c33
mov eax, dword [eax + 8]
sub eax, 0x10
push eax
call fcn.00402490
mov edi, eax
add esp, 4
add edi, 0x10
push 2
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x1c], edi
call fcn.00428c38
cmp eax, esi
jne 0x410863
jmp fcn.00423c33
mov eax, dword [eax + 8]
sub eax, 0x10
push eax
call fcn.00402490
add esp, 4
mov ebx, eax
push 3
lea ecx, [ebp - 0x3c]
add ebx, 0x10
call fcn.00428c38
cmp eax, esi
jne 0x41088a
jmp fcn.00423c33
mov eax, dword [eax + 8]
sub eax, 0x10
push eax
call fcn.00402490
add esp, 4
add eax, 0x10
mov dword [ebp - 0x20], eax
jne 0x4108a6
mov dword [ebp - 0xc], esi
jmp 0x4108da
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x4108bc
mov dword [ebp - 0xc], esi
jmp 0x4108da
lea esi, [eax + eax]
mov eax, esi
call fcn.004411d0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
mov eax, esp
push ecx
push esi
push edx
push eax
call fcn.00408520
mov dword [ebp - 0xc], eax
test edi, edi
jne 0x4108e2
xor eax, eax
jmp 0x41090f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x4108f7
xor eax, eax
jmp 0x41090f
lea esi, [eax + eax]
mov eax, esi
call fcn.004411d0
mov ecx, dword [ebp - 0x14]
mov eax, esp
push ecx
push esi
push edi
push eax
call fcn.00408520
lea edx, [ebp - 0x10]
push edx
push 0xf003f
push 0
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4109dc
test edi, edi
jne 0x410935
xor eax, eax
jmp 0x410962
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x41094a
xor eax, eax
jmp 0x410962
lea esi, [eax + eax]
mov eax, esi
call fcn.004411d0
mov ecx, dword [ebp - 0x14]
mov eax, esp
push ecx
push esi
push edi
push eax
call fcn.00408520
lea edx, [ebp - 0x10]
push edx
push eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x410a45
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x410980
sub eax, edx
test ebx, ebx
mov edi, eax
jne 0x410995
xor eax, eax
jmp 0x4109c2
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x4109aa
xor eax, eax
jmp 0x4109c2
lea esi, [eax + eax]
mov eax, esi
call fcn.004411d0
mov ecx, dword [ebp - 0x14]
mov eax, esp
push ecx
push esi
push ebx
push eax
call fcn.00408520
mov edx, dword [ebp - 0xc]
push edi
push edx
push 1
push 0
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x10]
push ecx
jmp 0x410a3c
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4109e2
sub eax, edx
test ebx, ebx
mov edi, eax
jne 0x4109f7
xor eax, eax
jmp 0x410a24
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x410a0c
xor eax, eax
jmp 0x410a24
lea esi, [eax + eax]
mov eax, esi
call fcn.004411d0
mov edx, dword [ebp - 0x14]
mov eax, esp
push edx
push esi
push ebx
push eax
call fcn.00408520
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push edi
push ecx
push 1
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410a64
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410a80
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410a9c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x3c]
call fcn.00428d94
mov eax, dword [ebp - 0x18]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410ac0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439e3e
mov esp, ebp
pop ebp
ret