Function at 0x40400a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push 2
pop esi
push dword [ebp + 8]
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 1
push eax
xor ebx, ebx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], 0x10
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20]
mov dword [ebp - 0x38], 0x18
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x38]
push ebx
push eax
push 0x10000000
lea eax, [ebp - 4]
mov dword [ebp - 0x34], ebx
push eax
mov dword [ebp - 0x2c], 0x40
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
js 0x404214
push dword [0x408768]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
jne 0x404087
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x18]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test eax, eax
js 0x40420b
push dword [0x408788]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, dword [ebp + 0x14]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
jne 0x4040ce
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x18]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test eax, eax
js 0x40420b
push dword [0x4087e0]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, dword [ebp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
jne 0x404115
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push esi
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test eax, eax
js 0x40420b
push dword [0x4087a4]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov ecx, dword [0x4087c4]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
jne 0x40415e
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push dword [0x4087c4]
lea eax, [ebp - 0x18]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test eax, eax
js 0x40420b
push dword [0x40881c]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push 4
pop esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test eax, eax
js 0x40420b
push dword [0x408830]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test eax, eax
js 0x40420b
push dword [0x408840]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
test eax, eax
js 0x40420b
mov bl, 1
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop esi
mov al, bl
pop ebx
leave
ret 0x10