Function at 0x542a80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x542d6d
cmp word [ebx], 0
je 0x542d6d
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x542d6d
cmp word [eax], 0
je 0x542d6d
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x542d6d
cmp word [eax], 0
je 0x542d6d
push 0x80
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x542aea
call fcn.0055fcf7
push 0x4a
push 0x5c4378
push esi
mov edi, 0x80
call fcn.0055fcbe
mov eax, dword [ebx - 4]
add esp, 0xc
cdq
sub eax, edx
mov dword [esp + 0x10], 0x4a
sar eax, 1
add eax, eax
mov dword [esp + 0x1c], eax
je 0x542ba3
lea ecx, [eax + 0x4a]
mov dword [esp + 0x10], ecx
cmp ecx, edi
jbe 0x542b95
mov eax, ecx
mov edi, ecx
and eax, 0x7f
sub edi, eax
add edi, 0x80
jne 0x542b3d
mov dword [esp + 0x14], edi
jmp 0x542b55
push edi
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x542b5a
call fcn.0055fcf7
cmp edi, 0x80
jae 0x542b67
call fcn.0055fcf7
push 0x80
push esi
push dword [esp + 0x1c]
call fcn.0055fcbe
add esp, 0xc
test esi, esi
je 0x542b8d
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
push eax
lea eax, [esi + 0x4a]
push ebx
push eax
call fcn.0055fcbe
add esp, 0xc
mov eax, dword [esp + 0x10]
lea ebx, [eax + 2]
mov dword [esp + 0x1c], ebx
cmp ebx, edi
jbe 0x542c26
mov eax, ebx
and eax, 0x7f
sub ebx, eax
add ebx, 0x80
jne 0x542bc7
mov dword [esp + 0x14], ebx
jmp 0x542bdf
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x542be4
call fcn.0055fcf7
cmp edi, ebx
jbe 0x542bed
call fcn.0055fcf7
test edi, edi
je 0x542c02
push edi
mov edi, dword [esp + 0x18]
push esi
push edi
call fcn.0055fcbe
add esp, 0xc
jmp 0x542c06
mov edi, dword [esp + 0x14]
test esi, esi
je 0x542c1a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x10]
mov esi, edi
mov edi, ebx
mov ebx, dword [esp + 0x1c]
push 2
add eax, esi
push 0x5c4374
push eax
call fcn.0055fcbe
mov eax, dword [ebp + 0xc]
add esp, 0xc
mov eax, dword [eax - 4]
cdq
sub eax, edx
sar eax, 1
lea eax, [eax*2 + 2]
mov dword [esp + 0x1c], eax
test eax, eax
je 0x542ce0
add ebx, eax
cmp ebx, edi
jbe 0x542cca
mov eax, ebx
and eax, 0x7f
sub ebx, eax
add ebx, 0x80
jne 0x542c71
mov dword [esp + 0x14], ebx
jmp 0x542c89
push ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x542c8e
call fcn.0055fcf7
cmp edi, ebx
jbe 0x542c97
call fcn.0055fcf7
test edi, edi
je 0x542cac
push edi
mov edi, dword [esp + 0x18]
push esi
push edi
call fcn.0055fcbe
add esp, 0xc
jmp 0x542cb0
mov edi, dword [esp + 0x14]
test esi, esi
je 0x542cc4
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 0x1c]
mov esi, edi
push eax
mov eax, dword [esp + 0x14]
push dword [ebp + 0xc]
add eax, 2
add eax, esi
push eax
call fcn.0055fcbe
add esp, 0xc
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push esi
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x542d04
mov edi, 0x80004005
jmp 0x542d4e
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x542d17
mov eax, dword [ecx - 4]
cdq
sub eax, edx
sar eax, 1
jne 0x542d1e
jmp 0x542d19
xor eax, eax
mov ecx, 0x5c4be4
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push dword [ebp + 0x10]
push 0
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
push dword [esp + 0x18]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg edi
sbb edi, edi
and edi, 0x80004005
test esi, esi
je 0x542d62
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
pop edi
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x10