Function at 0x41bd24
Capabilities:
Set registry value

Disassembly:
push ebx
push edi
mov edx, 0x16
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x41bd2b
call fcn.004310a0
mov edx, dword [esp + 0x64]
lea ecx, [esp]
call fcn.0041e000
mov edx, dword [esp + 0x68]
lea ecx, [esp + 4]
call fcn.0041e000
mov edx, dword [esp + 0x6c]
lea ecx, [esp + 8]
call fcn.0041e000
mov edx, dword [esp + 0x74]
lea ecx, [esp + 0xc]
call fcn.0041e000
mov dword [esp + 0x28], 1
mov edx, 0x434032
lea ecx, [esp + 0x2c]
call fcn.0041e008
mov dword [esp + 0x30], 0
call fcn.00430e40
push eax
push eax
push dword [esp + 8]
call fcn.0041e3c0
call fcn.00430ff0
mov edx, str.hklm
mov ecx, dword [esp]
push ecx
call fcn.00430e80
pop ecx
add ecx, eax
call fcn.00431020
je 0x41bdc8
mov dword [esp + 0x24], 0x80000002
jmp 0x41bea8
mov edx, str.hkcr
mov ecx, dword [esp]
push ecx
call fcn.00430e80
pop ecx
add ecx, eax
call fcn.00431020
je 0x41bded
mov dword [esp + 0x24], 0x80000000
jmp 0x41bea8
mov edx, str.hkcu
mov ecx, dword [esp]
push ecx
call fcn.00430e80
pop ecx
add ecx, eax
call fcn.00431020
je 0x41be12
mov dword [esp + 0x24], 0x80000001
jmp 0x41bea8
mov edx, 0x437e94
mov ecx, dword [esp]
push ecx
call fcn.00430e80
pop ecx
add ecx, eax
call fcn.00431020
je 0x41be34
mov dword [esp + 0x24], 0x80000003
jmp 0x41bea8
mov edx, str.hkcc
mov ecx, dword [esp]
push ecx
call fcn.00430e80
pop ecx
add ecx, eax
call fcn.00431020
je 0x41be56
mov dword [esp + 0x24], 0x80000005
jmp 0x41bea8
mov edx, str.hklm64
mov ecx, dword [esp]
push ecx
call fcn.00430e80
pop ecx
add ecx, eax
call fcn.00431020
je 0x41be80
mov dword [esp + 0x24], 0x80000002
mov dword [esp + 0x34], 0x100
jmp 0x41bea8
mov edx, str.hkcu64
mov ecx, dword [esp]
push ecx
call fcn.00430e80
pop ecx
add ecx, eax
call fcn.00431020
je 0x41bea8
mov dword [esp + 0x24], 0x80000001
mov dword [esp + 0x34], 0x100
call fcn.00430f40
call fcn.00430e40
push eax
push eax
push 1
push dword [esp + 0x10]
call fcn.0041e7e0
call fcn.00430ff0
mov edx, 0x434770
call fcn.00431060
mov ecx, eax
call fcn.00431020
je 0x41bf01
call fcn.00430e40
push eax
push eax
push dword [esp + 0xc]
call fcn.0041f200
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0x10]
call fcn.0041e550
lea eax, [esp + 8]
push eax
call fcn.00430eb0
push dword [esp + 0x2c]
mov edx, 0x434032
pop ecx
call fcn.00431020
je 0x41bf3a
lea eax, [esp + 0x14]
push eax
mov ebx, dword [esp + 0x34]
or ebx, 0xf003f
push ebx
push 0
push dword [esp + 0x10]
push dword [esp + 0x30]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 0x10], eax
jmp 0x41bf80
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x24]
push dword [esp + 0x34]
call sub.ADVAPI32.DLL_RegConnectRegistryW
mov dword [esp + 0x18], eax
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 0
push dword [esp + 0x10]
push dword [esp + 0x2c]
call sub.ADVAPI32.DLL_RegOpenKeyExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41bf80
mov dword [esp + 0x28], 0
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41bf8c
xor eax, eax
jmp 0x41bf91
mov eax, 1
and eax, eax
je 0x41bfe1
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x3c]
push eax
mov ebx, dword [esp + 0x3c]
or ebx, 0xf003f
push ebx
push 0
push 0
push 0
push dword [esp + 0x20]
push dword [esp + 0x40]
call sub.ADVAPI32.DLL_RegCreateKeyExW
mov dword [esp + 0x10], eax
mov ebx, dword [esp + 0x10]
and ebx, ebx
jne 0x41bfdf
mov dword [esp + 0x28], 0
jmp 0x41bfe9
mov dword [esp + 0x28], 0
mov ebx, dword [esp + 0x70]
cmp ebx, 0xffffffff
je 0x41c3bc
mov dword [esp + 0x28], 1
push dword [esp + 0x70]
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x41c043
push 0
push 0
push 0
push 0
push dword [esp + 0x1c]
push dword [esp + 0x2c]
call sub.ADVAPI32.DLL_RegSetValueExW
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x14]
and ebx, ebx
jne 0x41c03e
mov dword [esp + 0x2c], 0
jmp 0x41c3bb
mov ebx, 1
cmp ebx, dword [esp]
jne 0x41c091
push dword [esp + 0x10]
call fcn.0041f7a0
mov ebx, eax
add ebx, 2
push ebx
mov eax, dword [esp + 0x14]
push eax
push 1
push 0
push dword [esp + 0x1c]
push dword [esp + 0x2c]
call sub.ADVAPI32.DLL_RegSetValueExW
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x14]
and ebx, ebx
jne 0x41c08c
mov dword [esp + 0x2c], 0
jmp 0x41c3bb
mov ebx, 4
cmp ebx, dword [esp]
jne 0x41c166
call fcn.00430e40
push eax
push eax
call fcn.00430e40
push eax
push eax
push 2
push dword [esp + 0x24]
call fcn.0041e7e0
call fcn.00430e92
add dword [esp], edx
call fcn.0041e3c0
call fcn.00430ff0
mov edx, 0x434586
call fcn.00431060
mov ecx, eax
call fcn.00431020
je 0x41c11f
call fcn.00430e40
push eax
push eax
mov edx, 0x434336
call fcn.00430f90
call fcn.00430e40
push eax
push eax
push 3
push dword [esp + 0x24]
call fcn.0041e8e0
pop eax
call fcn.00430e92
add dword [esp], edx
call fcn.0041eaf0
call fcn.00430f40
mov dword [esp + 0x28], eax
jmp 0x41c12c
push dword [esp + 0x10]
call fcn.0041eaf0
mov dword [esp + 0x28], eax
push 4
lea eax, [esp + 0x2c]
push eax
push 4
push 0
push dword [esp + 0x1c]
push dword [esp + 0x2c]
call sub.ADVAPI32.DLL_RegSetValueExW
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x14]
and ebx, ebx
jne 0x41c161
mov dword [esp + 0x2c], 0
jmp 0x41c3bb
mov ebx, 2
cmp ebx, dword [esp]
jne 0x41c1af
push dword [esp + 0x10]
call fcn.0041f7a0
push eax
mov eax, dword [esp + 0x14]
push eax
push 2
push 0
push dword [esp + 0x1c]
push dword [esp + 0x2c]
call sub.ADVAPI32.DLL_RegSetValueExW
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x14]
and ebx, ebx
jne 0x41c1aa
mov dword [esp + 0x2c], 0
jmp 0x41c3bb
mov ebx, 7
cmp ebx, dword [esp]
jne 0x41c29b
mov eax, dword [esp + 0x10]
push eax
call fcn.004301b0
mov ebx, eax
add ebx, 2
add ebx, ebx
push ebx
call fcn.0042ff70
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x3c], 0
je 0x41c296
push dword [esp + 0x10]
push dword [esp + 0x40]
call fcn.00430270
push 0x434176
push dword [esp + 0x14]
call fcn.0041e930
mov dword [esp + 0x40], eax
cmp dword [esp + 0x40], 0
je 0x41c254
mov dword [esp + 0x44], 1
mov eax, dword [esp + 0x40]
cmp eax, dword [esp + 0x44]
jl 0x41c254
mov ebx, dword [esp + 0x48]
inc ebx
push ebx
push 0x434176
push dword [esp + 0x18]
call fcn.0041e430
mov dword [esp + 0x48], eax
push 0
mov ebx, dword [esp + 0x40]
mov edi, dword [esp + 0x4c]
add edi, edi
add ebx, edi
add ebx, 0xfffffffe
mov eax, ebx
call fcn.00430100
inc dword [esp + 0x44]
jno 0x41c211
push dword [esp + 0x3c]
call fcn.004301e0
push eax
push dword [esp + 0x40]
push 7
push 0
push dword [esp + 0x1c]
push dword [esp + 0x2c]
call sub.ADVAPI32.DLL_RegSetValueExW
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x14]
and ebx, ebx
jne 0x41c28d
mov dword [esp + 0x2c], 0
push dword [esp + 0x3c]
call fcn.00430120
jmp 0x41c3bb
mov ebx, 3
cmp ebx, dword [esp]
jne 0x41c3bb
push dword [esp + 0x10]
call fcn.0041f200
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
push ebx
call fcn.0042ff70
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x3c], 0
je 0x41c3bb
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
push dword [esp + 0x10]
call fcn.0041f200
cmp eax, dword [esp + 0x50]
jl 0x41c36b
call fcn.00430e40
push eax
push eax
push 2
push dword [esp + 0x5c]
push dword [esp + 0x20]
call fcn.0041e850
lea eax, [esp + 0x58]
push eax
call fcn.00430eb0
call fcn.00430e40
push eax
push eax
mov edx, 0x434336
call fcn.00430f90
mov edx, dword [esp + 0x5c]
call fcn.00430f90
call fcn.00430e92
add dword [esp], edx
call fcn.0041eaf0
call fcn.00430f40
mov byte [esp + 0x58], al
movsx eax, byte [esp + 0x58]
push eax
mov ebx, dword [esp + 0x40]
add ebx, dword [esp + 0x50]
mov eax, ebx
call fcn.00430100
inc dword [esp + 0x4c]
add dword [esp + 0x50], 2
jno 0x41c2e5
push dword [esp + 0x10]
call fcn.0041f200
mov ebx, eax
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, eax
push ebx
push dword [esp + 0x40]
push 3
push 0
push dword [esp + 0x1c]
push dword [esp + 0x2c]
call sub.ADVAPI32.DLL_RegSetValueExW
mov dword [esp + 0x14], eax
mov ebx, dword [esp + 0x14]
and ebx, ebx
jne 0x41c3b2
mov dword [esp + 0x2c], 0
push dword [esp + 0x3c]
call fcn.00430120
pop eax
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [esp + 0x28]
jmp 0x41c3cd
push dword [esp + 0x2c]
call fcn.00431170
push dword [esp + 8]
call fcn.00431170
push dword [esp]
call fcn.00431170
push dword [esp + 0xc]
call fcn.00431170
push dword [esp + 4]
call fcn.00431170
push dword [esp + 0x50]
call fcn.00431170
add esp, 0x58
pop edi
pop ebx
ret 0x14