Function at 0x402ac0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x208
mov eax, dword [0x408270]
xor eax, esp
mov dword [esp + 0x204], eax
mov eax, dword [esp + 0x20c]
push ebx
mov ebx, dword [esp + 0x214]
push esi
push edi
push eax
lea eax, [esp + 0x14]
push pe_nt_image_headers32
push eax
call dword [sym.imp.MSVCR80.dll_wcscpy_s]
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call dword [sym.imp.MSVCR80.dll_wcschr]
lea edx, [esp + 0x24]
push 0x5c
push edx
mov esi, eax
call dword [sym.imp.MSVCR80.dll_wcsrchr]
mov edi, eax
mov word [esi], 0
add esp, 0x1c
mov word [edi], 0
add esi, 2
add edi, 2
mov ecx, str.HKCR
lea eax, [esp + 0x10]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402b56
test dx, dx
je 0x402b52
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402b56
add eax, 4
add ecx, 4
test dx, dx
jne 0x402b30
xor eax, eax
jmp 0x402b5b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402b69
mov eax, 0x80000000
jmp 0x402caf
mov ecx, str.HKCU
lea eax, [esp + 0x10]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402b98
test dx, dx
je 0x402b94
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402b98
add eax, 4
add ecx, 4
test dx, dx
jne 0x402b72
xor eax, eax
jmp 0x402b9d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402bab
mov eax, 0x80000001
jmp 0x402caf
mov ecx, str.HKLM
lea eax, [esp + 0x10]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402bda
test dx, dx
je 0x402bd6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402bda
add eax, 4
add ecx, 4
test dx, dx
jne 0x402bb4
xor eax, eax
jmp 0x402bdf
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402bed
mov eax, 0x80000002
jmp 0x402caf
mov ecx, 0x4061a4
lea eax, [esp + 0x10]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402c1c
test dx, dx
je 0x402c18
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402c1c
add eax, 4
add ecx, 4
test dx, dx
jne 0x402bf6
xor eax, eax
jmp 0x402c21
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402c2f
mov eax, 0x80000003
jmp 0x402caf
mov ecx, str.HKCC
lea eax, [esp + 0x10]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402c5e
test dx, dx
je 0x402c5a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402c5e
add eax, 4
add ecx, 4
test dx, dx
jne 0x402c38
xor eax, eax
jmp 0x402c63
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402c6e
mov eax, 0x80000005
jmp 0x402caf
mov ecx, str.HKDD
lea eax, [esp + 0x10]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x402c9d
test dx, dx
je 0x402c99
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x402c9d
add eax, 4
add ecx, 4
test dx, dx
jne 0x402c77
xor eax, eax
jmp 0x402ca2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402d39
mov eax, 0x80000006
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 2
push 0
push 0
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x402d39
mov eax, dword [esp + 0x224]
test eax, eax
mov esi, dword [esp + 0x220]
jne 0x402d19
mov eax, esi
sub eax, 1
je 0x402d01
sub eax, 3
je 0x402cfa
sub eax, 7
je 0x402cf3
xor eax, eax
jmp 0x402d19
mov eax, 8
jmp 0x402d19
mov eax, 4
jmp 0x402d19
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x402d06
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov edx, dword [esp + 0xc]
push eax
push ebx
push esi
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x402d53
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x204]
xor ecx, esp
call fcn.00404656
add esp, 0x208
ret
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x210]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.00404656
add esp, 0x208
ret