Function at 0x4cd0b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x8034]
mov eax, 0x8034
call fcn.0050c0a0
push 0xffffffffffffffff
push 0x54978d
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x595c60]
xor eax, ebp
mov dword [ebp + 0x8030], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [ebp + 0x8040]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x8044]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x7c]
mov dword [ebp - 0x24], 0
lea edx, [ebp - 0x1c]
call fcn.004f6500
mov edi, eax
add esp, 4
test edi, edi
je 0x4cd14d
cmp dword [ebp + 0x8058], 8
jb 0x4cd146
mov ecx, dword [ebp + 0x8044]
test ecx, ecx
je 0x4cd146
push ecx
call fcn.005074d4
add esp, 4
mov eax, edi
jmp 0x4ce24d
cmp dword [ebp + 0x8058], 8
mov ecx, dword [ebp + 0x8044]
jae 0x4cd162
lea ecx, [ebp + 0x8044]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 0x803c]
push 0
or eax, 0xf003f
push eax
push 0
push 0
push 0
push ecx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x4cd329
mov ecx, dword [0x59e598]
test cl, 1
jne 0x4cd1c3
or ecx, 1
mov dword [0x59e598], ecx
mov byte [ebp - 4], 1
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [0x596f88]
test byte [eax + 0x1c], 2
je 0x4cd1d8
cmp byte [eax + 0x19], 6
jb 0x4cd1d8
mov al, 1
jmp 0x4cd1da
xor al, al
cmp byte [0x59e5a8], 0
jne 0x4cd1f4
cmp byte [0x59e5a9], 0
jne 0x4cd1f4
test al, al
je 0x4cd306
sub esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xbc]
call fcn.0047b550
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 3
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xbc]
call fcn.0047eed0
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0xd1
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Failed_to_create_or_open_Sub_key:
mov ecx, eax
call fcn.0047f130
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a0d80
mov edx, str.._Error_Code
mov ecx, eax
call fcn.0047f130
push ebx
mov ecx, eax
call fcn.004c56c0
mov byte [ebp - 4], 3
cmp dword [ebp + 0x2c], 0x10
jb 0x4cd29a
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x4cd29a
push eax
call fcn.005074d4
add esp, 4
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 5
cmp dword [esi + 0x14], 0x10
jb 0x4cd2b7
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
cmp dword [ebp + 0x2c], 0x10
jb 0x4cd2dc
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x4cd2dc
push eax
call fcn.005074d4
add esp, 4
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 2
call fcn.0047b620
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], 0x56a6f8
push eax
call fcn.0052889f
add esp, 4
jmp 0x4cd306
cmp dword [ebp + 0x8058], 8
jb 0x4cd322
mov eax, dword [ebp + 0x8044]
test eax, eax
je 0x4cd322
push eax
call fcn.005074d4
add esp, 4
mov eax, ebx
jmp 0x4ce24d
lea edi, [esi + 0x34]
mov ecx, edi
mov dword [ebp - 0x1c], edi
call fcn.00495060
test al, al
je 0x4cd344
lea edx, [esi + 0x4c]
mov ecx, edi
call fcn.004950d0
cmp byte [esi + 0xac], 1
jne 0x4cd59f
lea ecx, [esi + 0x1c]
mov edx, 0x574790
call fcn.004a0050
test al, al
je 0x4cd49c
cmp dword [edi + 0x14], 8
jb 0x4cd370
mov eax, dword [edi]
jmp 0x4cd372
mov eax, edi
push 0
push 0
push 0
push 0
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4cd59f
push 6
call fcn.004a0950
mov ecx, eax
call fcn.004a0b00
test al, al
je 0x4cd47d
sub esp, 8
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xbc]
call fcn.0047b550
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 8
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xbc]
call fcn.0047eed0
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0xe6
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Retaining_the_value_for_registry_value:
mov ecx, eax
call fcn.0047f130
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a0d80
mov edx, 0x574a90
mov ecx, eax
call fcn.0047f130
mov edx, edi
mov ecx, eax
call fcn.004a0d80
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 8
call fcn.0047ac60
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0xa
cmp dword [esi + 0x14], 0x10
jb 0x4cd45b
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
lea ecx, [ebp + 0x18]
call fcn.0047ac60
lea ecx, [ebp - 0xbc]
call fcn.004790d0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x8044]
call fcn.0047b120
jmp 0x4ce24b
cmp dword [edi + 0x14], 8
jb 0x4cd4a6
mov edx, dword [edi]
jmp 0x4cd4a8
mov edx, edi
mov ecx, dword [ebp - 0x18]
lea ebx, [esi + 0x4c]
push ebx
call fcn.004f66b0
add esp, 4
test al, al
je 0x4cd59f
push 6
call fcn.004a0950
mov ecx, eax
call fcn.004a0b00
test al, al
je 0x4cd47d
sub esp, 8
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xbc]
call fcn.0047b550
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0xd
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xbc]
call fcn.0047eed0
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0xf0
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Retaining_the_value_for_registry_value:
mov ecx, eax
call fcn.0047f130
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a0d80
mov edx, 0x574a90
mov ecx, eax
call fcn.0047f130
mov edx, edi
mov ecx, eax
call fcn.004a0d80
mov edx, 0x574ac0
mov ecx, eax
call fcn.0047f130
mov edx, ebx
mov ecx, eax
call fcn.004a0d80
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0xd
call fcn.0047ac60
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0xf
jmp 0x4cd453
mov edx, str.DWORD
lea ecx, [esi + 0x1c]
call fcn.00485900
test al, al
je 0x4cd883
push str.dwContentMajorVersion
mov ecx, edi
call fcn.00485950
test eax, eax
je 0x4cd5d4
push str.dwContentMinorVersion
mov ecx, edi
call fcn.00485950
test eax, eax
jne 0x4cd610
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 4
jb 0x4cd5ec
mov eax, dword [edi]
jmp 0x4cd5ee
mov eax, edi
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4cd610
cmp dword [ebp - 0x14], 4
je 0x4cd62d
add esi, 0x4c
cmp dword [esi + 0x14], 8
jb 0x4cd61b
mov esi, dword [esi]
lea eax, [ebp - 0x1c]
push eax
push 0x573bdc
push esi
call fcn.005099e5
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x4cd637
mov eax, dword [edi]
jmp 0x4cd639
mov eax, edi
push 4
lea ecx, [ebp - 0x1c]
push ecx
push 4
push 0
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
push 6
mov dword [ebp - 0x14], ebx
call fcn.004a0950
mov ecx, eax
call fcn.004a0b00
test ebx, ebx
je 0x4cd782
test al, al
je 0x4cd767
sub esp, 8
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xbc]
call fcn.0047b550
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x12
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xbc]
call fcn.0047eed0
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x112
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Failed_to_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f130
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a0d80
mov edx, 0x574a90
mov ecx, eax
call fcn.0047f130
mov edx, edi
mov ecx, eax
call fcn.004a0d80
mov edx, str.._Error_Code
mov ecx, eax
call fcn.0047f130
push ebx
mov ecx, eax
call fcn.004c56c0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x12
call fcn.0047ac60
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x14
cmp dword [esi + 0x14], 0x10
jb 0x4cd73a
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
lea ecx, [ebp + 0x18]
call fcn.0047ac60
lea ecx, [ebp - 0xbc]
call fcn.004790d0
jmp 0x4cd767
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x8044]
call fcn.0047b120
mov eax, ebx
jmp 0x4ce24d
test al, al
je 0x4cd878
sub esp, 8
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xbc]
call fcn.0047b550
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x17
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xbc]
call fcn.0047eed0
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x116
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Succeeded_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f130
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a0d80
mov edx, 0x574a90
mov ecx, eax
call fcn.0047f130
mov edx, edi
mov ecx, eax
call fcn.004a0d80
mov edx, str.._Value
mov ecx, eax
call fcn.0047f130
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.0047b350
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x17
call fcn.0047ac60
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x19
cmp dword [esi + 0x14], 0x10
jb 0x4cd856
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
lea ecx, [ebp + 0x18]
call fcn.0047ac60
lea ecx, [ebp - 0xbc]
call fcn.004790d0
jmp 0x4ce226
mov edx, 0x574790
lea ecx, [esi + 0x1c]
call fcn.00485900
test al, al
je 0x4cdb1d
lea ebx, [esi + 0x4c]
push ebx
call fcn.004f4940
cmp dword [ebx + 0x14], 8
mov eax, dword [esi + 0x5c]
jb 0x4cd8ae
mov edx, dword [ebx]
jmp 0x4cd8b0
mov edx, ebx
cmp dword [edi + 0x14], 8
jb 0x4cd8ba
mov ecx, dword [edi]
jmp 0x4cd8bc
mov ecx, edi
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x14], eax
push 6
test eax, eax
je 0x4cda09
call fcn.004a0950
mov ecx, eax
call fcn.004a0b00
test al, al
je 0x4cd9eb
sub esp, 8
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xbc]
call fcn.0047b550
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x1c
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xbc]
call fcn.0047eed0
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x125
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Failed_to_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f130
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a0d80
mov edx, 0x574a90
mov ecx, eax
call fcn.0047f130
mov edx, edi
mov ecx, eax
call fcn.004a0d80
mov edx, str.._Error_Code
mov ecx, eax
call fcn.0047f130
mov edi, dword [ebp - 0x14]
mov ecx, eax
push edi
call fcn.004c56c0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x1c
call fcn.0047ac60
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x1e
cmp dword [esi + 0x14], 0x10
jb 0x4cd9c1
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
lea ecx, [ebp + 0x18]
call fcn.0047ac60
lea ecx, [ebp - 0xbc]
call fcn.004790d0
jmp 0x4cd9ee
mov edi, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x8044]
call fcn.0047b120
mov eax, edi
jmp 0x4ce24d
call fcn.004a0950
mov ecx, eax
call fcn.004a0b00
test al, al
je 0x4cdb12
sub esp, 8
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xbc]
call fcn.0047b550
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x21
call fcn.004a0cb0
mov byte [ebp - 4], 0x22
cmp dword [ebx + 0x14], 8
jb 0x4cda47
mov ebx, dword [ebx]
mov edx, eax
lea ecx, [ebp - 0xbc]
call fcn.0047eed0
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x129
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Succeeded_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f130
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a0d80
mov edx, 0x574a90
mov ecx, eax
call fcn.0047f130
mov edx, edi
mov ecx, eax
call fcn.004a0d80
mov edx, str.._Value
mov ecx, eax
call fcn.0047f130
mov edx, ebx
mov ecx, eax
call fcn.004a0e50
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x21
call fcn.0047ac60
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x23
cmp dword [esi + 0x14], 0x10
jb 0x4cdaf0
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
lea ecx, [ebp + 0x18]
call fcn.0047ac60
lea ecx, [ebp - 0xbc]
call fcn.004790d0
jmp 0x4ce226
mov edx, str.EXPAND_SZ
lea ecx, [esi + 0x1c]
call fcn.00485900
test al, al
je 0x4cdd94
lea ebx, [esi + 0x4c]
push ebx
call fcn.004f4940
cmp dword [ebx + 0x14], 8
mov eax, dword [esi + 0x5c]
jb 0x4cdb48
mov edx, dword [ebx]
jmp 0x4cdb4a
mov edx, ebx
cmp dword [edi + 0x14], 8
jb 0x4cdb54
mov ecx, dword [edi]
jmp 0x4cdb56
mov ecx, edi
lea eax, [eax*2 + 2]
push eax
push edx
push 2
push 0
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x14], eax
push 6
test eax, eax
je 0x4cdc88
call fcn.004a0950
mov ecx, eax
call fcn.004a0b00
test al, al
je 0x4cd9eb
sub esp, 8
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xbc]
call fcn.0047b550
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x26
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xbc]
call fcn.0047eed0
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x138
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Failed_to_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f130
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a0d80
mov edx, 0x574a90
mov ecx, eax
call fcn.0047f130
mov edx, edi
mov ecx, eax
call fcn.004a0d80
mov edx, str.._Error_Code__d
mov ecx, eax
call fcn.0047f130
mov edi, dword [ebp - 0x14]
mov ecx, eax
push edi
call fcn.004c56c0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x26
call fcn.0047ac60
lea eax, [ebp]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x28
cmp dword [esi + 0x14], 0x10
jb 0x4cdc5b
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
lea ecx, [ebp]
call fcn.0047ac60
lea ecx, [ebp - 0xbc]
call fcn.004790d0
jmp 0x4cd9ee
call fcn.004a0950
mov ecx, eax
call fcn.004a0b00
test al, al
je 0x4cdd89
sub esp, 8
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xbc]
call fcn.0047b550
lea ecx, [ebp]
mov byte [ebp - 4], 0x2b
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0xbc]
call fcn.0047eed0
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x13c
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Succeeded_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f130
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a0d80
mov edx, 0x574a90
mov ecx, eax
call fcn.0047f130
mov edx, edi
mov ecx, eax
call fcn.004a0d80
mov edx, str.._Value
mov ecx, eax
call fcn.0047f130
mov edx, ebx
mov ecx, eax
call fcn.004a0d80
lea ecx, [ebp]
mov byte [ebp - 4], 0x2b
call fcn.0047ac60
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x2d
cmp dword [esi + 0x14], 0x10
jb 0x4cdd67
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
lea ecx, [ebp + 0x18]
call fcn.0047ac60
lea ecx, [ebp - 0xbc]
call fcn.004790d0
jmp 0x4ce226
mov edx, str.MULTI_SZ
lea ecx, [esi + 0x1c]
call fcn.00485900
test al, al
je 0x4ce181
xor eax, eax
push 0x7ffc
push eax
mov word [ebp + 0x30], ax
lea eax, [ebp + 0x32]
push eax
call fcn.0050be90
add esp, 0xc
xor ebx, ebx
cmp dword [esi + 0x5c], 0x3fff
jbe 0x4cdeec
push 6
call fcn.004a0950
mov ecx, eax
call fcn.004a0b00
test al, al
je 0x4cdeca
sub esp, 8
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0xbc]
call fcn.0047b550
lea ecx, [ebp]
mov byte [ebp - 4], 0x30
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0xbc]
call fcn.0047eed0
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x145
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Failed_to_set_the_MULTI_SZ_value_for_registry_key:
mov ecx, eax
call fcn.0047f130
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a0d80
mov edx, 0x574a90
mov ecx, eax
call fcn.0047f130
mov edx, edi
mov ecx, eax
call fcn.004a0d80
mov edx, str.._Length_is_longer_than_MAX_VALUE_LENGTH_16383_.
mov ecx, eax
call fcn.0047f130
lea ecx, [ebp]
mov byte [ebp - 4], 0x30
call fcn.0047ac60
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x32
cmp dword [esi + 0x14], 0x10
jb 0x4cdea8
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
lea ecx, [ebp + 0x18]
call fcn.0047ac60
lea ecx, [ebp - 0xbc]
call fcn.004790d0
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x8044]
call fcn.0047b120
mov eax, dword [ebp - 0x14]
jmp 0x4ce24d
mov ecx, dword [ebp - 0x20]
xor esi, esi
add ecx, 0x4c
mov dword [ebp - 0x1c], ecx
jmp 0x4cdf00
push esi
push 0x57477c
call fcn.0048e530
cmp esi, eax
jne 0x4cdf1f
cmp ebx, 0x3fff
jae 0x4cdf49
mov ecx, dword [ebp - 0x1c]
xor eax, eax
inc esi
jmp 0x4cdf32
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x14], 8
jb 0x4cdf2c
mov eax, dword [ecx]
jmp 0x4cdf2e
mov eax, ecx
mov ax, word [eax + esi*2]
mov word [ebp + ebx*2 + 0x30], ax
inc esi
inc ebx
cmp esi, dword [ecx + 0x10]
jbe 0x4cdf00
inc ebx
cmp dword [edi + 0x14], 8
jb 0x4cdf4e
mov ecx, dword [edi]
jmp 0x4cdf50
call fcn.00509dc5
mov ecx, edi
lea eax, [ebx + ebx]
push eax
lea eax, [ebp + 0x30]
push eax
push 7
push 0
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
push 6
mov dword [ebp - 0x14], ebx
call fcn.004a0950
mov ecx, eax
call fcn.004a0b00
test ebx, ebx
je 0x4ce080
test al, al
je 0x4cd767
sub esp, 8
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0xbc]
call fcn.0047b550
lea ecx, [ebp]
mov byte [ebp - 4], 0x35
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xbc]
call fcn.0047eed0
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x15f
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Failed_to_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f130
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a0d80
mov edx, 0x574a90
mov ecx, eax
call fcn.0047f130
mov edx, edi
mov ecx, eax
call fcn.004a0d80
mov edx, str.._Error_Code
mov ecx, eax
call fcn.0047f130
push ebx
mov ecx, eax
call fcn.004c56c0
lea ecx, [ebp]
mov byte [ebp - 4], 0x35
call fcn.0047ac60
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x37
cmp dword [esi + 0x14], 0x10
jb 0x4ce053
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
lea ecx, [ebp + 0x18]
call fcn.0047ac60
lea ecx, [ebp - 0xbc]
call fcn.004790d0
jmp 0x4cd767
test al, al
je 0x4ce176
sub esp, 8
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0xbc]
call fcn.0047b550
lea ecx, [ebp]
mov byte [ebp - 4], 0x3a
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0xbc]
call fcn.0047eed0
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x163
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Succeeded_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f130
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a0d80
mov edx, 0x574a90
mov ecx, eax
call fcn.0047f130
mov edx, edi
mov ecx, eax
call fcn.004a0d80
mov edx, str.._Value
mov ecx, eax
call fcn.0047f130
mov edx, dword [ebp - 0x1c]
mov ecx, eax
call fcn.004a0d80
lea ecx, [ebp]
mov byte [ebp - 4], 0x3a
call fcn.0047ac60
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0x3c
cmp dword [esi + 0x14], 0x10
jb 0x4ce154
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
lea ecx, [ebp + 0x18]
call fcn.0047ac60
lea ecx, [ebp - 0xbc]
call fcn.004790d0
jmp 0x4ce226
mov edx, str.BINARY
lea ecx, [esi + 0x1c]
call fcn.00485900
test al, al
je 0x4ce226
push 0x3ffe
lea eax, [ebp + 0x402d]
mov byte [ebp + 0x402c], 0
push 0
push eax
call fcn.0050be90
mov eax, dword [esi + 0x5c]
add esp, 0xc
xor ebx, ebx
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4ce208
xor edi, edi
cmp ebx, 0x3fff
jae 0x4ce205
push 2
push edi
lea eax, [ebp]
push eax
lea ecx, [esi + 0x4c]
call fcn.0047b150
cmp dword [eax + 0x14], 8
jb 0x4ce1e0
mov eax, dword [eax]
push 0x10
push 0
push eax
call fcn.00509c75
add esp, 0xc
mov byte [ebp + ebx + 0x402c], al
lea ecx, [ebp]
call fcn.0047b120
add edi, 2
inc ebx
cmp edi, dword [ebp - 0x20]
jb 0x4ce1c1
mov edi, dword [ebp - 0x1c]
cmp dword [edi + 0x14], 8
jb 0x4ce210
mov edi, dword [edi]
push ebx
lea eax, [ebp + 0x402c]
push eax
push 3
push 0
push edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x8058], 8
jb 0x4ce24b
mov eax, dword [ebp + 0x8044]
test eax, eax
je 0x4ce24b
push eax
call fcn.005074d4
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8030]
xor ecx, ebp
call fcn.00506c7d
lea esp, [ebp + 0x8034]
pop ebp
ret 0x20