Function at 0x421bce
Capabilities:
Set registry value

Disassembly:
mov eax, 0x432254
call fcn.004299f4
sub esp, 0x610
mov al, byte [0x7f5500]
push ebx
push esi
push edi
push 9
push eax
push 0x80362c
call fcn.00412eee
push dword [ebp + 8]
mov dword [0x803638], eax
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0042957b
push dword [0x803638]
call fcn.0042881a
xor ebx, ebx
add esp, 0x1c
mov dword [0x803638], ebx
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x18]
mov dword [ebp - 4], ebx
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x11c]
push ebx
push eax
push connect
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x421c68
xor eax, eax
cmp dword [ebp - 0x10], ebx
je 0x421c5e
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
cmp eax, ebx
mov dword [ebp - 0x10], ecx
je 0x421c7f
cmp dword [ebp - 0x10], ebx
je 0x422249
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x422249
push dword [ebp + 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call edi
inc eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
push dword [ebp + 0x10]
push 1
push ebx
push ebx
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0x10], ebx
je 0x421caf
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
mov al, byte [0x7f5500]
push 0x18
push eax
push 0x803554
call fcn.00412eee
push dword [ebp + 8]
mov dword [0x803570], eax
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0042957b
push dword [0x803570]
call fcn.0042881a
add esp, 0x1c
lea eax, [ebp - 0x18]
mov dword [0x803570], ebx
mov dword [ebp - 0x14], ebx
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x11c]
push ebx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x421c68
xor eax, eax
cmp dword [ebp - 0x10], ebx
je 0x421d28
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x14]
cmp eax, ebx
mov dword [ebp - 0x10], ecx
jne 0x421c68
push dword [ebp + 0x1c]
call edi
inc eax
push eax
push dword [ebp + 0x1c]
push 1
push ebx
push ebx
push dword [ebp - 0x10]
call esi
mov al, byte [0x7f5500]
push 0xf
push eax
push 0x80373c
call fcn.00412eee
mov dword [0x80374c], eax
mov al, byte [0x7f5500]
push 0xa
push eax
push 0x803750
call fcn.00412eee
mov ecx, dword [0x80374c]
add esp, 0x18
mov dword [0x80375c], eax
mov dword [ebp - 0x14], ecx
push eax
mov dword [ebp + 0x1c], eax
call edi
inc eax
push eax
push dword [ebp + 0x1c]
push 1
push ebx
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call esi
push dword [0x80374c]
call fcn.0042881a
push dword [0x80375c]
mov dword [0x80374c], ebx
call fcn.0042881a
cmp dword [ebp - 0x10], ebx
pop ecx
pop ecx
mov dword [0x80375c], ebx
je 0x421dce
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
mov al, byte [0x7f5500]
push 0x10
push eax
push 0x803724
call fcn.00412eee
push dword [ebp + 8]
mov dword [0x803738], eax
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0042957b
push dword [0x803738]
call fcn.0042881a
add esp, 0x1c
lea eax, [ebp - 0x18]
mov dword [0x803738], ebx
mov dword [ebp + 0x1c], ebx
push eax
lea eax, [ebp + 0x1c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x11c]
push ebx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x42223d
lea ecx, [ebp - 0x10]
call fcn.004222cc
mov ecx, dword [ebp + 0x1c]
cmp eax, ebx
mov dword [ebp - 0x10], ecx
jne 0x42223d
push dword [ebp + 0x18]
call edi
inc eax
push eax
push dword [ebp + 0x18]
push 1
push ebx
push ebx
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0x10], ebx
je 0x421e71
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
mov al, byte [0x7f5500]
push 0x16
push eax
push 0x803708
call fcn.00412eee
push dword [ebp + 8]
mov dword [0x803720], eax
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0042957b
push dword [0x803720]
call fcn.0042881a
add esp, 0x1c
lea eax, [ebp - 0x18]
mov dword [0x803720], ebx
mov dword [ebp + 0x1c], ebx
push eax
lea eax, [ebp + 0x1c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x11c]
push ebx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x421c68
lea ecx, [ebp - 0x10]
call fcn.004222cc
mov ecx, dword [ebp + 0x1c]
cmp eax, ebx
mov dword [ebp - 0x10], ecx
jne 0x421c68
cmp ecx, ebx
je 0x421efe
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
mov al, byte [0x7f5500]
push 0x11
push eax
push 0x8036f0
call fcn.00412eee
push dword [ebp + 8]
mov dword [0x803704], eax
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0042957b
push dword [0x803704]
call fcn.0042881a
add esp, 0x1c
lea eax, [ebp - 0x18]
mov dword [0x803704], ebx
mov dword [ebp + 0x1c], ebx
push eax
lea eax, [ebp + 0x1c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x11c]
push ebx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x42223d
lea ecx, [ebp - 0x10]
call fcn.004222cc
mov ecx, dword [ebp + 0x1c]
cmp eax, ebx
mov dword [ebp - 0x10], ecx
jne 0x42223d
push dword [ebp + 0xc]
call edi
inc eax
push eax
push dword [ebp + 0xc]
push 1
push ebx
push ebx
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0x10], ebx
je 0x421fa1
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
mov al, byte [0x7f5500]
push 0x22
push eax
push 0x8036c8
call fcn.00412eee
push dword [ebp + 8]
mov dword [0x8036ec], eax
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.0042957b
push dword [0x8036ec]
call fcn.0042881a
add esp, 0x1c
lea eax, [ebp + 0xc]
mov dword [0x8036ec], ebx
mov dword [ebp + 0x1c], ebx
push eax
lea eax, [ebp + 0x1c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x11c]
push ebx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x42223d
lea ecx, [ebp - 0x10]
call fcn.004222cc
mov ecx, dword [ebp + 0x1c]
cmp eax, ebx
mov dword [ebp - 0x10], ecx
jne 0x42223d
push dword [ebp + 0x14]
call edi
inc eax
push eax
push dword [ebp + 0x14]
push 1
push ebx
push ebx
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0x10], ebx
je 0x422044
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
lea eax, [ebp + 0xc]
mov dword [ebp + 0x1c], ebx
push eax
lea eax, [ebp + 0x1c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp + 0x18]
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x42223d
lea ecx, [ebp - 0x10]
call fcn.004222cc
mov ecx, dword [ebp + 0x1c]
cmp eax, ebx
mov dword [ebp - 0x10], ecx
jne 0x42223d
push dword [ebp + 0x10]
call edi
inc eax
push eax
push dword [ebp + 0x10]
push 1
push ebx
push ebx
push dword [ebp - 0x10]
call esi
mov al, byte [0x7f5500]
push 6
push eax
push 0x8036bc
call fcn.00412eee
add esp, 0xc
mov dword [0x8036c4], eax
mov dword [ebp + 0x1c], eax
push dword [ebp + 8]
call edi
inc eax
push eax
push dword [ebp + 8]
push 1
push ebx
push dword [ebp + 0x1c]
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0x10], ebx
je 0x4220da
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
lea eax, [ebp + 0x14]
mov dword [ebp + 0x1c], ebx
push eax
lea eax, [ebp + 0x1c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [ebp + 0x14]
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x42223d
lea ecx, [ebp - 0x10]
call fcn.004222cc
mov ecx, dword [ebp + 0x1c]
cmp eax, ebx
mov dword [ebp - 0x10], ecx
jne 0x42223d
push dword [ebp + 0x10]
call edi
inc eax
push eax
push dword [ebp + 0x10]
push 1
push ebx
push ebx
push dword [ebp - 0x10]
call esi
mov eax, dword [0x8036c4]
push dword [ebp + 8]
mov dword [ebp + 0x10], eax
call edi
inc eax
push eax
push dword [ebp + 8]
push 1
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call esi
push dword [0x8036c4]
call fcn.0042881a
mov al, byte [0x7f5500]
push 7
push eax
push 0x8036b0
mov dword [0x8036c4], ebx
call fcn.00412eee
add esp, 0x10
mov dword [0x8036b8], eax
mov dword [ebp + 0x10], eax
push dword [ebp + 0x18]
call edi
inc eax
push eax
push dword [ebp + 0x18]
push 1
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call esi
push dword [0x8036b8]
call fcn.0042881a
cmp dword [ebp - 0x10], ebx
pop ecx
mov dword [0x8036b8], ebx
je 0x4221b0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], ebx
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x21b]
mov byte [ebp - 0x21c], bl
push 0x4d
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov al, byte [0x7f5500]
push eax
push 0x8035d8
call fcn.00412eee
push dword [ebp + 8]
mov dword [0x803628], eax
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.0042957b
push dword [0x803628]
call fcn.0042881a
add esp, 0x1c
lea eax, [ebp + 0x10]
mov dword [0x803628], ebx
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp + 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x61c]
push ebx
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x42223d
lea ecx, [ebp - 0x10]
call fcn.004222cc
mov ecx, dword [ebp + 8]
cmp eax, ebx
mov dword [ebp - 0x10], ecx
je 0x42224d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.004222cc
xor al, al
jmp 0x4222a8
mov al, byte [0x7f5500]
push 9
push eax
push 0x8027c8
call fcn.00412eee
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0xc
mov edi, eax
lea eax, [ebp - 0x21c]
push edi
push eax
call esi
push edi
call fcn.0042881a
pop ecx
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x21c]
push eax
call esi
lea eax, [ebp - 0x21c]
push eax
call fcn.00415117
cmp dword [ebp - 0x10], ebx
pop ecx
je 0x4222a6
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret