Function at 0x405b1a
Capabilities:
Set registry value

Disassembly:
push ebp
push ebx
push edi
mov edx, 0x11
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x405b22
call fcn.0048f160
mov edx, dword [esp + 0x58]
lea ecx, [esp]
call fcn.00445000
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 4]
call fcn.00445000
mov edx, dword [esp + 0x60]
lea ecx, [esp + 8]
call fcn.00445000
mov dword [esp + 0x10], 0x20006
cmp dword [esp + 0x68], 0
je 0x405b77
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0048c8a0
call fcn.0048f1c0
mov edx, 0x54bb9e
call fcn.00445330
mov ecx, eax
call fcn.00445340
je 0x405bdd
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 8]
call fcn.0048c910
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0048c940
lea eax, [esp + 4]
push eax
call fcn.0048f090
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.0048c940
call fcn.0048f1c0
mov edx, 0x54bb9e
call fcn.00445330
mov ecx, eax
call fcn.00445340
je 0x405c43
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 8]
call fcn.0048c910
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.0048c8a0
lea eax, [esp + 4]
push eax
call fcn.0048f090
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x405cc0
mov ebx, dword [esp + 0x64]
cmp ebx, 3
je 0x405c69
push 0x56387c
push 0x24
push dword [esp + 0x74]
call fcn.0048deb0
jmp 0x405cc0
mov ebp, dword [esp + 0x6c]
mov dword [ebp], 0
mov ebp, dword [esp + 0x6c]
mov dword [ebp + 8], 0
mov ebp, dword [esp + 0x6c]
mov edx, 0x54903e
lea ecx, [ebp + 0xc]
call fcn.00445008
mov ebp, dword [esp + 0x6c]
mov dword [ebp + 0x10], 0
mov ebp, dword [esp + 0x6c]
lea eax, [ebp + 0x14]
mov dword [eax + 4], 0
mov dword [eax], 0
mov ebp, dword [esp + 0x6c]
mov edx, 0x54903e
lea ecx, [ebp + 0x20]
call fcn.00445008
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x1c]
push 0
xor eax, eax
push eax
push 0
push dword [esp + 0x1c]
push dword [esp + 0x74]
call sub.ADVAPI32.dll_RegCreateKeyExW
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x405d40
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x405d29
push dword [esp + 0xc]
mov ebp, dword [esp + 0x70]
pop dword [ebp + 8]
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 0x10]
call fcn.00406cce
mov ebp, dword [esp + 0x70]
lea eax, [ebp + 0xc]
push eax
call fcn.0048f090
cmp dword [esp + 0x14], 0
je 0x405d39
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
jmp 0x406128
push dword [esp + 0x64]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x405e4b
mov ebx, dword [esp + 0x70]
and ebx, ebx
jne 0x405d91
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x405d7e
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xfffffffd
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_Required_Ret.RegValue_parameter_not_found_
lea ecx, [ebp + 0xc]
call fcn.00445008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x406128
mov ebp, dword [esp + 0x70]
mov eax, dword [ebp + 4]
cdq
push edx
push eax
pop dword [esp + 0x24]
pop dword [esp + 0x24]
mov ebp, dword [esp + 0x70]
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x405ded
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x405dda
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xfffffffe
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_No_Pointer_to_BINARY_defined_
lea ecx, [ebp + 0xc]
call fcn.00445008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x406128
push dword [esp + 0x24]
push dword [esp + 0x24]
pop ebx
pop edi
cmp ebx, 0
jne 0x405e01
cmp edi, 0
je 0x405e05
xor eax, eax
jmp 0x405e0a
mov eax, 1
or eax, eax
je 0x405e22
push dword [esp + 0x1c]
call fcn.0048dec0
cdq
push edx
push eax
pop dword [esp + 0x24]
pop dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push eax
push dword [esp + 0x20]
push 3
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x4060da
mov ebx, 4
cmp ebx, dword [esp]
jne 0x405e8c
push dword [esp + 0xc]
call fcn.0048c9c0
mov dword [esp + 0x3c], eax
push 4
lea eax, [esp + 0x40]
push eax
push 4
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x4060da
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x405ed3
push dword [esp + 0xc]
call fcn.0048c9c0
push edx
push eax
pop dword [esp + 0x44]
pop dword [esp + 0x44]
push 8
lea eax, [esp + 0x44]
push eax
push 0xb
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x4060da
mov ebx, 2
cmp ebx, dword [esp]
je 0x405ee7
mov ebx, 1
cmp ebx, dword [esp]
jne 0x405f1a
push dword [esp + 0xc]
call fcn.0048cb00
mov ebx, eax
add ebx, 2
push ebx
mov eax, dword [esp + 0x10]
push eax
push dword [esp + 0x70]
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x4060da
mov ebx, 7
cmp ebx, dword [esp]
jne 0x4060da
mov eax, 0x549650
push eax
push dword [esp + 0x10]
call fcn.0048cb30
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0
jmp 0x405f45
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x30]
jl 0x405fb3
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
mov eax, 0x549650
push eax
mov ebx, dword [esp + 0x3c]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.0048cbc0
lea eax, [esp + 0x38]
push eax
call fcn.0048f090
push dword [esp + 0x24]
push dword [esp + 0x24]
push 0x19
push dword [esp + 0x40]
call fcn.0048ccf0
cdq
add dword [esp], eax
adc dword [esp + 4], edx
add dword [esp], 2
adc dword [esp + 4], 0
pop dword [esp + 0x24]
pop dword [esp + 0x24]
inc dword [esp + 0x30]
jno 0x405f45
push dword [esp + 0x24]
push dword [esp + 0x24]
pop ebx
pop edi
cmp ebx, 0
jne 0x405fcb
cmp edi, 0
jne 0x405fcb
xor eax, eax
jmp 0x405fd0
mov eax, 1
or eax, eax
je 0x4060da
mov eax, dword [esp + 0x20]
push eax
call fcn.0048df20
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x4060a6
mov dword [esp + 0x30], 0
jmp 0x405ffb
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x30]
jl 0x406071
push edx
call fcn.0048eff0
pop edx
push eax
push edx
call fcn.0048eff0
pop edx
push eax
mov eax, 0x549650
push eax
mov ebx, dword [esp + 0x3c]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.0048cbc0
lea eax, [esp + 0x38]
push eax
call fcn.0048f090
push 0x19
push 0xffffffff
push dword [esp + 0x3c]
mov ebx, dword [esp + 0x28]
add ebx, dword [esp + 0x44]
push ebx
call fcn.0048df40
mov ebx, dword [esp + 0x38]
push 0x19
push dword [esp + 0x38]
call fcn.0048ccf0
add ebx, eax
add ebx, 2
mov dword [esp + 0x38], ebx
inc dword [esp + 0x30]
jno 0x405ffb
sub esp, 4
mov eax, dword [esp + 0x24]
push eax
push dword [esp + 0x24]
push dword [esp + 0x74]
push 0
push dword [esp + 0x1c]
push dword [esp + 0x30]
call dword [0x636b94]
add esp, 4
mov dword [esp + 0x10], eax
push dword [esp + 0x1c]
call fcn.0048e090
jmp 0x4060da
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x4060ca
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.00445008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x406128
pop eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 0xc], 0
je 0x406120
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x40611c
push dword [esp + 0xc]
mov ebp, dword [esp + 0x70]
pop dword [ebp + 8]
push edx
call fcn.0048eff0
pop edx
push eax
push dword [esp + 0x10]
call fcn.00406cce
mov ebp, dword [esp + 0x70]
lea eax, [ebp + 0xc]
push eax
call fcn.0048f090
xor eax, eax
jmp 0x406128
mov eax, dword [esp + 0x28]
jmp 0x406128
push dword [esp + 0x30]
call fcn.0048f1f0
push dword [esp]
call fcn.0048f1f0
push dword [esp + 8]
call fcn.0048f1f0
push dword [esp + 4]
call fcn.0048f1f0
add esp, 0x44
pop edi
pop ebx
pop ebp
ret 0x1c