Function at 0x404260
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4135d0
push eax
mov dword fs:[0], esp
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov edi, dword [esp + 0x20]
mov esi, str.HKEY_CLASSES_ROOT
mov eax, edi
mov dl, byte [eax]
or ebp, 0xffffffff
mov cl, dl
cmp dl, byte [esi]
jne 0x4042b1
cmp cl, bl
je 0x4042ad
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4042b1
add eax, 2
add esi, 2
cmp cl, bl
jne 0x40428a
xor eax, eax
jmp 0x4042b5
sbb eax, eax
sbb eax, ebp
cmp eax, ebx
jne 0x4042c3
mov esi, 0x80000000
jmp 0x40442a
mov esi, str.HKEY_CURRENT_USER
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4042ee
cmp cl, bl
je 0x4042ea
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4042ee
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4042ca
xor eax, eax
jmp 0x4042f2
sbb eax, eax
sbb eax, ebp
cmp eax, ebx
jne 0x404300
mov esi, 0x80000001
jmp 0x40442a
mov esi, str.HKEY_LOCAL_MACHINE
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40432b
cmp cl, bl
je 0x404327
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40432b
add eax, 2
add esi, 2
cmp cl, bl
jne 0x404307
xor eax, eax
jmp 0x40432f
sbb eax, eax
sbb eax, ebp
cmp eax, ebx
jne 0x40433d
mov esi, 0x80000002
jmp 0x40442a
mov esi, str.HKEY_USERS
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x404368
cmp cl, bl
je 0x404364
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x404368
add eax, 2
add esi, 2
cmp cl, bl
jne 0x404344
xor eax, eax
jmp 0x40436c
sbb eax, eax
sbb eax, ebp
cmp eax, ebx
jne 0x40437a
mov esi, 0x80000003
jmp 0x40442a
mov esi, str.HKEY_CURRENT_CONFIG
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4043a5
cmp cl, bl
je 0x4043a1
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4043a5
add eax, 2
add esi, 2
cmp cl, bl
jne 0x404381
xor eax, eax
jmp 0x4043a9
sbb eax, eax
sbb eax, ebp
cmp eax, ebx
jne 0x4043b4
mov esi, 0x80000005
jmp 0x40442a
mov esi, str.HKEY_PERFORMANCE_DATA
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4043df
cmp cl, bl
je 0x4043db
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4043df
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4043bb
xor eax, eax
jmp 0x4043e3
sbb eax, eax
sbb eax, ebp
cmp eax, ebx
jne 0x4043ee
mov esi, 0x80000004
jmp 0x40442a
mov esi, str.HKEY_DYN_DATA
mov eax, edi
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x404419
cmp cl, bl
je 0x404415
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x404419
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4043f5
xor eax, eax
jmp 0x40441d
sbb eax, eax
sbb eax, ebp
neg eax
sbb eax, eax
and al, 0xfc
add eax, 0x80000006
mov esi, eax
mov ecx, dword [esp + 0x24]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 0x20]
push eax
push 0xf003f
push ebx
push ecx
push esi
call edi
cmp eax, ebx
jne 0x40444e
push str._SetRegistry__Success_opening_key._p1_
jmp 0x40449b
mov eax, dword [esp + 0x24]
lea edx, [esp + 0x20]
push ebx
push edx
push ebx
push 4
push ebx
push ebx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x404537
push str._SetRegistry__RegCreateKeyEx_Success.
call fcn.00402650
mov edx, dword [esp + 0x28]
add esp, 4
lea ecx, [esp + 0x20]
push ecx
push 0xf003f
push ebx
push edx
push esi
call edi
cmp eax, ebx
jne 0x404530
push str._SetRegistry__Success_opening_key._p2_
call fcn.00402650
mov edx, dword [esp + 0x30]
mov ecx, ebp
mov edi, edx
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x28]
not ecx
push ecx
mov ecx, dword [esp + 0x24]
push edx
push 1
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
jne 0x404529
push str._SetRegistry__Success_writing_to_Registry.
call fcn.00402650
mov edx, dword [esp + 0x24]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
jne 0x404522
push str._SetRegistry__Success_closing_key.
call fcn.00402650
add esp, 4
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], bl
call fcn.00412bbc
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], ebp
call fcn.00412bbc
mov al, 1
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push str._SetRegistry__Error_closing_key.
jmp 0x40453c
push str._SetRegistry__Error_writing_to_Registry.
jmp 0x40453c
push str._SetRegistry__Error_opening_key.
jmp 0x40453c
push str._SetRegistry__RegCreateKeyEx_Error.
call fcn.00402650
add esp, 4
lea ecx, [esp + 0x24]
mov byte [esp + 0x18], bl
call fcn.00412bbc
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], ebp
call fcn.00412bbc
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebp
xor al, al
mov dword fs:[0], ecx
pop ebx
add esp, 0xc
ret