Function at 0x409d90
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x7c
mov esi, dword [esp + 0x94]
test esi, esi
je 0x40a1bf
call fcn.0042c430
movzx ecx, byte [esi + 1]
movzx edx, byte [esi]
lea ebx, [esp + 0x60]
mov edi, dword [esp + 0x90]
mov dword [esp + 0x24], eax
mov dword [esp + 0x58], ebx
mov ebp, dword [edi]
mov dword [esp], 0x13
lea edi, [esp + 0x58]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], edx
call fcn.004ed900
mov ecx, 0x6d65
mov dword [eax], 0x69646f4d
mov dword [eax + 4], 0x65527966
mov word [eax + 0x10], cx
mov dword [eax + 8], 0x74736967
mov dword [eax + 0xc], 0x74497265
mov byte [eax + 0x12], 0
mov dword [esp + 0x58], eax
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], str.Modify_the_value_of_register_item__s_to_0x_02x_02x
mov dword [esp + 0x1c], ecx
mov dword [esp + 0xc], 0x322
mov dword [esp + 0x18], edx
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
mov dword [esp + 0x60], 0x12
mov dword [esp + 0x5c], 0x12
call fcn.0042ce70
mov eax, dword [esp + 0x58]
cmp eax, ebx
je 0x409e67
mov dword [esp], eax
call fcn.004ed8c0
lea eax, [esp + 0x3c]
mov dword [esp + 0xc], 0x2001f
mov dword [esp + 8], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x90]
mov eax, dword [eax]
mov dword [esp], 0x80000002
mov dword [esp + 4], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
mov ebp, eax
je 0x409f43
call fcn.0042c430
mov dword [esp], 0x13
mov esi, eax
mov dword [esp + 0x58], ebx
call fcn.004ed900
mov edx, 0x6d65
mov dword [eax], 0x69646f4d
mov dword [eax + 4], 0x65527966
mov dword [eax + 8], 0x74736967
mov dword [eax + 0xc], 0x74497265
mov word [eax + 0x10], dx
mov byte [eax + 0x12], 0
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], str.Open_regedit_failed_with_error_code___d
mov dword [esp + 0xc], 0x326
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], esi
mov dword [esp + 0x58], eax
mov dword [esp + 0x60], 0x12
mov dword [esp + 0x5c], 0x12
call fcn.0042ce70
mov eax, dword [esp + 0x58]
cmp eax, ebx
je 0x409f39
mov dword [esp], eax
call fcn.004ed8c0
add esp, 0x7c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esp + 0x44]
lea edx, [esp + 0x48]
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x40]
mov dword [esp + 0x10], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x54], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0x10
mov dword [esp + 8], 0
mov dword [esp + 4], str.osvc
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub esp, 0x18
test eax, eax
mov ebp, eax
mov edx, dword [esp + 0x24]
jne 0x40a0d1
mov ebp, dword [esp + 0x44]
xor eax, eax
jmp 0x409fcd
cmp ebp, eax
je 0x40a1a0
movzx ecx, byte [edx + eax]
add eax, 1
test cl, cl
je 0x409fc5
movzx eax, byte [esp + eax + 0x48]
shl ecx, 8
or ecx, eax
cmp ecx, 0x1ee
je 0x40a151
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x14], 2
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0
mov dword [esp + 4], str.osvc
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
sub esp, 0x18
test eax, eax
mov ebp, eax
je 0x40a0b7
call fcn.0042c430
mov dword [esp], 0x13
mov esi, eax
mov dword [esp + 0x58], ebx
call fcn.004ed900
mov edx, 0x6d65
mov dword [eax], 0x69646f4d
mov dword [eax + 4], 0x65527966
mov dword [eax + 8], 0x74736967
mov dword [eax + 0xc], 0x74497265
mov word [eax + 0x10], dx
mov byte [eax + 0x12], 0
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], str.Set_regedit_fail_with_error_code___d
mov dword [esp + 0xc], 0x349
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], esi
mov dword [esp + 0x58], eax
mov dword [esp + 0x60], 0x12
mov dword [esp + 0x5c], 0x12
call fcn.0042ce70
mov eax, dword [esp + 0x58]
cmp eax, ebx
je 0x40a0b7
mov dword [esp], eax
call fcn.004ed8c0
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
mov eax, ebp
add esp, 0x7c
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0042c430
mov dword [esp], 0x13
mov esi, eax
mov dword [esp + 0x58], ebx
call fcn.004ed900
mov ecx, 0x6d65
mov dword [eax], 0x69646f4d
mov dword [eax + 4], 0x65527966
mov dword [eax + 8], 0x74736967
mov dword [eax + 0xc], 0x74497265
mov word [eax + 0x10], cx
mov byte [eax + 0x12], 0
mov dword [esp + 0x14], ebp
mov dword [esp + 0x10], str.Query_regedit_failed_with_error_code___d
mov dword [esp + 0xc], 0x330
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], esi
mov dword [esp + 0x58], eax
mov dword [esp + 0x60], 0x12
mov dword [esp + 0x5c], 0x12
call fcn.0042ce70
jmp 0x40a0a7
call fcn.0042c430
mov dword [esp], str.ModifyRegisterItem
mov ecx, edi
mov esi, eax
call fcn.00409100
sub esp, 4
mov dword [esp + 0x10], str.The_key_value_had_been_set
mov dword [esp + 0xc], 0x341
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.0042ce70
mov eax, dword [esp + 0x58]
cmp eax, ebx
je 0x40a1a0
mov dword [esp], eax
call fcn.004ed8c0
lea esi, [esi]
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
sub esp, 4
add esp, 0x7c
mov ebp, 0xffffffff
pop ebx
mov eax, ebp
pop esi
pop edi
pop ebp
ret
lea ebx, [esp + 0x58]
call fcn.0042c430
mov dword [esp], str.ModifyRegisterItem
mov ecx, ebx
mov esi, eax
call fcn.00409100
sub esp, 4
mov dword [esp + 0x10], str.ModifyRegisterItem_parameter_is_invalid
mov dword [esp + 0xc], 0x31e
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], esi
call fcn.0042ce70
mov eax, dword [esp + 0x58]
lea edx, [esp + 0x60]
cmp eax, edx
je 0x40a1b0
mov dword [esp], eax
call fcn.004ed8c0
jmp 0x40a1b0