Function at 0x40f77d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x340
mov eax, dword [0x415884]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor ebx, ebx
lea eax, [ebp - 0x31c]
push 0x208
push ebx
push eax
mov edi, edx
mov dword [ebp - 0x32c], ebx
mov esi, ecx
call sub.msvcrt.dll_memset
push 0x403aec
push 0x401108
push 0x403b04
lea eax, [ebp - 0x31c]
push 0x104
push eax
call fcn.0040c045
add esp, 0x20
test eax, eax
je 0x40f7e2
movzx eax, ax
jmp 0x40fa2f
lea eax, [ebp - 0x338]
mov dl, 1
push eax
lea ecx, [ebp - 0x31c]
call fcn.0040d5a7
test eax, eax
jne 0x40fa2f
mov ecx, dword [ebp - 0x338]
mov eax, 0x104
cmp ecx, eax
jbe 0x40f815
push 0x7a
pop eax
jmp 0x40fa2f
push esi
push 0x40909c
push 0x200
lea edx, [ebp - 0x328]
sub eax, ecx
push edx
lea edx, [ebp - 0x32c]
mov dword [ebp - 0x328], eax
push edx
push eax
lea eax, [ebp + ecx*2 - 0x31e]
push eax
call fcn.0040c08a
add esp, 0x1c
test eax, eax
jne 0x40f7da
cmp dword [ebp + 8], ebx
jbe 0x40fa2d
lea esi, [edi + 0x10]
push 0x7b
pop eax
mov word [ebp - 0x114], ax
lea ecx, [ebp - 0x112]
lea eax, [esi - 0x10]
push eax
push 0x7f
pop edx
call fcn.0040c61c
lea ecx, [ebp - 0x114]
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x40f87e
sub ecx, edx
sar ecx, 1
push 0x7d
pop eax
mov word [ebp + ecx*2 - 0x114], ax
lea ecx, [ecx*2 + 2]
cmp ecx, 0x104
jae 0x40fa50
mov edx, dword [ebp - 0x328]
xor eax, eax
mov word [ebp + ecx - 0x114], ax
lea eax, [ebp - 0x114]
mov ecx, dword [ebp - 0x32c]
push eax
call fcn.0040bf80
test eax, eax
jne 0x40f7da
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x320]
push eax
push edi
push 3
push edi
push edi
push edi
lea eax, [ebp - 0x31c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40fa2f
mov eax, dword [ebp + 0xc]
push 4
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x324]
push eax
push 4
push edi
push 0x401260
push dword [ebp - 0x320]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jne 0x40fa40
push 4
lea eax, [ebp - 0x324]
mov dword [ebp - 0x324], 1
push eax
push 4
push edi
push 0x401244
push dword [ebp - 0x320]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jne 0x40fa40
cmp byte [esi], al
je 0x40f96d
mov eax, dword [esi + 8]
jmp 0x40f970
mov eax, dword [ebp + 0x20]
push 4
mov dword [ebp - 0x324], eax
lea eax, [ebp - 0x324]
push eax
push 4
push 0
push 0x401280
push dword [ebp - 0x320]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jne 0x40fa40
cmp byte [esi], al
je 0x40f9a9
mov eax, dword [esi + 4]
xor ecx, ecx
jmp 0x40f9af
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
push 8
mov dword [ebp - 0x334], eax
lea eax, [ebp - 0x334]
push eax
push 0xb
push 0
push 0x401298
push dword [ebp - 0x320]
mov dword [ebp - 0x330], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
jne 0x40fa40
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp + 0x1c]
push 8
mov dword [ebp - 0x330], eax
lea eax, [ebp - 0x334]
push eax
push 0xb
push edi
push 0x4012b8
push dword [ebp - 0x320]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x320]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x40fa4c
inc ebx
add esi, 0x1c
cmp ebx, dword [ebp + 8]
jb 0x40f857
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00413fa0
leave
ret 0x1c
push dword [ebp - 0x320]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x40fa2f
call fcn.004140f0
int3