Function at 0x4100f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x46d750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call dword [0x46eaf4]
mov ebx, eax
push 0xa
lea ecx, [ebp - 0x3c]
mov dword [ebp - 8], ebx
call fcn.00429689
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [ebp + 8]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x18], esp
mov esi, esp
push eax
mov dword [ebp - 0x18], eax
call fcn.004020e0
add eax, 0x10
add esp, 4
mov dword [esi], eax
call fcn.0040b770
add esp, 8
cmp eax, 4
je 0x4101af
lea ecx, [ebp - 0x18]
push str._WriteReg__Invalid_arguments__nArg_4_:
push ecx
lea ecx, [ebp + 8]
call fcn.00401eb0
mov edi, dword [eax]
xor esi, esi
add esp, 8
cmp edi, esi
jne 0x410167
mov dword [ebp - 8], esi
jmp 0x410195
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x41017d
mov dword [ebp - 8], esi
jmp 0x410195
lea esi, [eax + eax]
mov eax, esi
call fcn.00440090
mov eax, esp
push ebx
push esi
push edi
push eax
call fcn.00408150
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x48]
call fcn.0043920e
push 0x467390
lea eax, [ebp - 0x48]
push eax
call fcn.0043b69a
xor esi, esi
push esi
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x14], reloc.OLEAUT32.dll_SysReAllocString
call fcn.00429665
cmp eax, esi
jne 0x4101ca
jmp fcn.004232a7
add eax, 8
push str.HKEY_CURRENT_USER
push eax
call fcn.004036d0
add esp, 8
test al, al
je 0x4101e8
mov dword [ebp - 0x14], SysReAllocString
jmp 0x410216
push esi
lea ecx, [ebp - 0x3c]
call fcn.00429665
cmp eax, esi
jne 0x4101fa
jmp fcn.004232a7
add eax, 8
push str.HKEY_CLASSES_ROOT
push eax
call fcn.004036d0
add esp, 8
test al, al
je 0x410216
mov dword [ebp - 0x14], SysReAllocString
push 1
lea ecx, [ebp - 0x3c]
call fcn.00429665
cmp eax, esi
jne 0x410229
jmp fcn.004232a7
mov eax, dword [eax + 8]
sub eax, 0x10
push eax
call fcn.004020e0
mov edi, eax
add esp, 4
add edi, 0x10
push 2
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x1c], edi
call fcn.00429665
cmp eax, esi
jne 0x410253
jmp fcn.004232a7
mov eax, dword [eax + 8]
sub eax, 0x10
push eax
call fcn.004020e0
add esp, 4
mov ebx, eax
push 3
lea ecx, [ebp - 0x3c]
add ebx, 0x10
call fcn.00429665
cmp eax, esi
jne 0x41027a
jmp fcn.004232a7
mov eax, dword [eax + 8]
sub eax, 0x10
push eax
call fcn.004020e0
add esp, 4
add eax, 0x10
mov dword [ebp - 0x20], eax
jne 0x410296
mov dword [ebp - 0xc], esi
jmp 0x4102ca
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x4102ac
mov dword [ebp - 0xc], esi
jmp 0x4102ca
lea esi, [eax + eax]
mov eax, esi
call fcn.00440090
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
mov eax, esp
push ecx
push esi
push edx
push eax
call fcn.00408150
mov dword [ebp - 0xc], eax
test edi, edi
jne 0x4102d2
xor eax, eax
jmp 0x4102ff
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x4102e7
xor eax, eax
jmp 0x4102ff
lea esi, [eax + eax]
mov eax, esi
call fcn.00440090
mov ecx, dword [ebp - 8]
mov eax, esp
push ecx
push esi
push edi
push eax
call fcn.00408150
lea edx, [ebp - 0x10]
push edx
push 0xf003f
push 0
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4103cc
test edi, edi
jne 0x410325
xor eax, eax
jmp 0x410352
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x41033a
xor eax, eax
jmp 0x410352
lea esi, [eax + eax]
mov eax, esi
call fcn.00440090
mov ecx, dword [ebp - 8]
mov eax, esp
push ecx
push esi
push edi
push eax
call fcn.00408150
lea edx, [ebp - 0x10]
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x410435
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x410370
sub eax, edx
test ebx, ebx
mov edi, eax
jne 0x410385
xor eax, eax
jmp 0x4103b2
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x41039a
xor eax, eax
jmp 0x4103b2
lea esi, [eax + eax]
mov eax, esi
call fcn.00440090
mov ecx, dword [ebp - 8]
mov eax, esp
push ecx
push esi
push ebx
push eax
call fcn.00408150
mov edx, dword [ebp - 0xc]
push edi
push edx
push 1
push 0
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x10]
push ecx
jmp 0x41042c
mov eax, dword [ebp - 0xc]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4103d2
sub eax, edx
test ebx, ebx
mov edi, eax
jne 0x4103e7
xor eax, eax
jmp 0x410414
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
cmp eax, 0x3fffffff
jle 0x4103fc
xor eax, eax
jmp 0x410414
lea esi, [eax + eax]
mov eax, esi
call fcn.00440090
mov edx, dword [ebp - 8]
mov eax, esp
push edx
push esi
push ebx
push eax
call fcn.00408150
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push edi
push ecx
push 1
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410454
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x410470
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41048c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x3c]
call fcn.004297c1
mov eax, dword [ebp - 0x18]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4104b0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea esp, [ebp - 0x54]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438dc7
mov esp, ebp
pop ebp
ret