Function at 0x478900
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
push edi
push str._________Inside_writeValue_Method___________n
mov esi, 4
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.00423960
mov edi, dword [ebp + 0x10]
add esp, 4
cmp edi, ebx
je 0x478ba4
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x478ba4
mov eax, dword [ebp + 0xc]
push eax
push str.writeValue:_Subkey_:__s__n
call fcn.00423960
push edi
push str.writeValue:_Value_Name:__s__n
call fcn.00423960
push ebx
push str.writeValue:_Value_Data:__s__n
call fcn.00423960
lea ecx, [ebp - 8]
push ecx
push edi
call fcn.004628e0
lea edx, [ebp - 4]
push edx
push ebx
call fcn.004628e0
mov eax, dword [ebp - 8]
push 0x4dfca8
push eax
call fcn.0048ef4d
add esp, 0x30
test eax, eax
jne 0x47899d
push str.writeValue_:_going_to_add_the__default__value_._n
call fcn.00423db0
add esp, 4
mov dword [ebp - 8], 0x4fb3fc
mov ecx, dword [ebp - 4]
push 0x4dfca8
push ecx
call fcn.0048ef4d
add esp, 8
test eax, eax
jne 0x4789c9
push str.writeValue_:_going_to_add_the_value_data_as_0_value_._n
call fcn.00423db0
mov eax, 0x4fb3fc
add esp, 4
mov dword [ebp - 4], eax
jmp 0x4789cc
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
cmp ecx, esi
jne 0x4789f6
push eax
call fcn.00492205
lea edx, [ebp - 0x10]
push 4
push str.writeValue:__REG_DWORD____sizeOfInputData:__d_n
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edx
call fcn.00423960
add esp, 0xc
jmp 0x478a81
cmp ecx, 0xb
jne 0x478a22
push ebx
call fcn.004787f0
mov esi, 8
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push esi
push str.writeValue:__REG_QWORD____sizeOfInputData:__d_n
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
call fcn.00423960
add esp, 0xc
jmp 0x478a81
cmp ecx, 1
je 0x478a5b
cmp ecx, 2
je 0x478a5b
cmp ecx, 3
je 0x478a5b
cmp ecx, 7
jne 0x478a81
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x478a40
sub eax, edx
sar eax, 1
lea esi, [eax + eax + 0xd]
push esi
push str.writeValue:__Data_type_is_REG_MULTI_SZ:__d_n
jmp 0x478a79
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x478a60
sub eax, edx
sar eax, 1
lea esi, [eax + eax + 2]
push esi
push str.writeValue:__Data_type_is_REG_SZ_or_REG_EXPAND_SZ_or_REG_BINARY:__d_n
call fcn.00423960
add esp, 8
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push ecx
call fcn.00478840
mov edi, eax
add esp, 8
test edi, edi
je 0x478aae
push edi
push str.writeValue:__WriteValue_failure_during_key_creation___d__n
call fcn.00423ad0
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xc]
push edx
push 0xf003f
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, eax
test edi, edi
jne 0x478b87
push eax
push str.writeValue:__Key_found_..._:__d_n
call fcn.00423960
push str.writeValue:__After_addRegistryKey_method_in_writeValue_method___n
call fcn.00423960
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 0x18]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
add esp, 0xc
push esi
push ecx
push edi
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x478b2e
push eax
call fcn.004635b0
mov ecx, dword [ebp - 0xc]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str._________End_Of_writeValue_Method___________n
call fcn.00423960
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push str.writeValue:__Function_WriteValue_failure_:_d_n
call fcn.00423ad0
push ebx
push str.writeValue:____Subkey:__s__n
call fcn.00423ad0
mov edx, dword [ebp - 8]
push edx
push str.writeValue:____Valuename:__S__n
call fcn.00423ad0
mov eax, dword [ebp - 4]
push eax
push str.writeValue:____Valuedata:__S__n
call fcn.00423ad0
push edi
push str.writeValue:____Datatype:__d__n
call fcn.00423ad0
push esi
call fcn.004635b0
mov ecx, dword [ebp - 0xc]
add esp, 0x2c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push str.writeValue:__Key_open_failure___d__n
call fcn.00423ad0
push edi
call fcn.004635b0
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.writeValue_:_Valuename_or_Valuedata_is_Empty__n
call fcn.00423db0
add esp, 4
pop edi
pop esi
mov eax, 0xd
pop ebx
mov esp, ebp
pop ebp
ret