Function at 0x4cd8b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x8034]
mov eax, 0x8034
call fcn.0050c720
push 0xffffffffffffffff
push 0x549f8d
mov eax, dword fs:[0]
push eax
sub esp, 0xb0
mov eax, dword [0x596c60]
xor eax, ebp
mov dword [ebp + 0x8030], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x20], esi
mov eax, dword [ebp + 0x8040]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x8044]
mov dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x7c]
mov dword [ebp - 0x24], 0
lea edx, [ebp - 0x1c]
call fcn.004f6dd0
mov edi, eax
add esp, 4
test edi, edi
je 0x4cd94d
cmp dword [ebp + 0x8058], 8
jb 0x4cd946
mov ecx, dword [ebp + 0x8044]
test ecx, ecx
je 0x4cd946
push ecx
call fcn.00507b54
add esp, 4
mov eax, edi
jmp 0x4cea4d
cmp dword [ebp + 0x8058], 8
mov ecx, dword [ebp + 0x8044]
jae 0x4cd962
lea ecx, [ebp + 0x8044]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 0x803c]
push 0
or eax, 0xf003f
push eax
push 0
push 0
push 0
push ecx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x4cdb29
mov ecx, dword [0x59f554]
test cl, 1
jne 0x4cd9c3
or ecx, 1
mov dword [0x59f554], ecx
mov byte [ebp - 4], 1
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [0x597f88]
test byte [eax + 0x1c], 2
je 0x4cd9d8
cmp byte [eax + 0x19], 6
jb 0x4cd9d8
mov al, 1
jmp 0x4cd9da
xor al, al
cmp byte [0x59f560], 0
jne 0x4cd9f4
cmp byte [0x59f561], 0
jne 0x4cd9f4
test al, al
je 0x4cdb06
sub esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xbc]
call fcn.0047b4d0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 3
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xbc]
call fcn.0047ee50
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0xd1
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Failed_to_create_or_open_Sub_key:
mov ecx, eax
call fcn.0047f0b0
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a1750
mov edx, str.._Error_Code
mov ecx, eax
call fcn.0047f0b0
push ebx
mov ecx, eax
call fcn.004c5ec0
mov byte [ebp - 4], 3
cmp dword [ebp + 0x2c], 0x10
jb 0x4cda9a
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x4cda9a
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 5
cmp dword [esi + 0x14], 0x10
jb 0x4cdab7
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
cmp dword [ebp + 0x2c], 0x10
jb 0x4cdadc
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x4cdadc
push eax
call fcn.00507b54
add esp, 4
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 2
call fcn.0047b5a0
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
jmp 0x4cdb06
cmp dword [ebp + 0x8058], 8
jb 0x4cdb22
mov eax, dword [ebp + 0x8044]
test eax, eax
je 0x4cdb22
push eax
call fcn.00507b54
add esp, 4
mov eax, ebx
jmp 0x4cea4d
lea edi, [esi + 0x34]
mov ecx, edi
mov dword [ebp - 0x1c], edi
call fcn.00495a20
test al, al
je 0x4cdb44
lea edx, [esi + 0x4c]
mov ecx, edi
call fcn.00495a90
cmp byte [esi + 0xac], 1
jne 0x4cdd9f
lea ecx, [esi + 0x1c]
mov edx, 0x5757c0
call fcn.004a0a20
test al, al
je 0x4cdc9c
cmp dword [edi + 0x14], 8
jb 0x4cdb70
mov eax, dword [edi]
jmp 0x4cdb72
mov eax, edi
push 0
push 0
push 0
push 0
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x4cdd9f
push 6
call fcn.004a1320
mov ecx, eax
call fcn.004a14d0
test al, al
je 0x4cdc7d
sub esp, 8
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xbc]
call fcn.0047b4d0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 8
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xbc]
call fcn.0047ee50
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0xe6
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Retaining_the_value_for_registry_value:
mov ecx, eax
call fcn.0047f0b0
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a1750
mov edx, 0x575ac0
mov ecx, eax
call fcn.0047f0b0
mov edx, edi
mov ecx, eax
call fcn.004a1750
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 8
call fcn.0047abe0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0xa
cmp dword [esi + 0x14], 0x10
jb 0x4cdc5b
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
lea ecx, [ebp + 0x18]
call fcn.0047abe0
lea ecx, [ebp - 0xbc]
call fcn.00479050
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x8044]
call fcn.0047b0a0
jmp 0x4cea4b
cmp dword [edi + 0x14], 8
jb 0x4cdca6
mov edx, dword [edi]
jmp 0x4cdca8
mov edx, edi
mov ecx, dword [ebp - 0x18]
lea ebx, [esi + 0x4c]
push ebx
call fcn.004f6f80
add esp, 4
test al, al
je 0x4cdd9f
push 6
call fcn.004a1320
mov ecx, eax
call fcn.004a14d0
test al, al
je 0x4cdc7d
sub esp, 8
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xbc]
call fcn.0047b4d0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0xd
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0xbc]
call fcn.0047ee50
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0xf0
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Retaining_the_value_for_registry_value:
mov ecx, eax
call fcn.0047f0b0
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a1750
mov edx, 0x575ac0
mov ecx, eax
call fcn.0047f0b0
mov edx, edi
mov ecx, eax
call fcn.004a1750
mov edx, 0x575af0
mov ecx, eax
call fcn.0047f0b0
mov edx, ebx
mov ecx, eax
call fcn.004a1750
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0xd
call fcn.0047abe0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0xf
jmp 0x4cdc53
mov edx, str.DWORD
lea ecx, [esi + 0x1c]
call fcn.00485880
test al, al
je 0x4ce083
push str.dwContentMajorVersion
mov ecx, edi
call fcn.004858d0
test eax, eax
je 0x4cddd4
push str.dwContentMinorVersion
mov ecx, edi
call fcn.004858d0
test eax, eax
jne 0x4cde10
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 4
jb 0x4cddec
mov eax, dword [edi]
jmp 0x4cddee
mov eax, edi
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
push 0
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4cde10
cmp dword [ebp - 0x14], 4
je 0x4cde2d
add esi, 0x4c
cmp dword [esi + 0x14], 8
jb 0x4cde1b
mov esi, dword [esi]
lea eax, [ebp - 0x1c]
push eax
push 0x574c0c
push esi
call fcn.0050a065
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x4cde37
mov eax, dword [edi]
jmp 0x4cde39
mov eax, edi
push 4
lea ecx, [ebp - 0x1c]
push ecx
push 4
push 0
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
push 6
mov dword [ebp - 0x14], ebx
call fcn.004a1320
mov ecx, eax
call fcn.004a14d0
test ebx, ebx
je 0x4cdf82
test al, al
je 0x4cdf67
sub esp, 8
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0xbc]
call fcn.0047b4d0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x12
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0xbc]
call fcn.0047ee50
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x112
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Failed_to_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f0b0
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a1750
mov edx, 0x575ac0
mov ecx, eax
call fcn.0047f0b0
mov edx, edi
mov ecx, eax
call fcn.004a1750
mov edx, str.._Error_Code
mov ecx, eax
call fcn.0047f0b0
push ebx
mov ecx, eax
call fcn.004c5ec0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x12
call fcn.0047abe0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x14
cmp dword [esi + 0x14], 0x10
jb 0x4cdf3a
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
lea ecx, [ebp + 0x18]
call fcn.0047abe0
lea ecx, [ebp - 0xbc]
call fcn.00479050
jmp 0x4cdf67
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x8044]
call fcn.0047b0a0
mov eax, ebx
jmp 0x4cea4d
test al, al
je 0x4ce078
sub esp, 8
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0xbc]
call fcn.0047b4d0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x17
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0xbc]
call fcn.0047ee50
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x116
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Succeeded_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f0b0
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a1750
mov edx, 0x575ac0
mov ecx, eax
call fcn.0047f0b0
mov edx, edi
mov ecx, eax
call fcn.004a1750
mov edx, str.._Value
mov ecx, eax
call fcn.0047f0b0
push dword [ebp - 0x1c]
mov ecx, eax
call fcn.0047b2d0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x17
call fcn.0047abe0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x19
cmp dword [esi + 0x14], 0x10
jb 0x4ce056
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
lea ecx, [ebp + 0x18]
call fcn.0047abe0
lea ecx, [ebp - 0xbc]
call fcn.00479050
jmp 0x4cea26
mov edx, 0x5757c0
lea ecx, [esi + 0x1c]
call fcn.00485880
test al, al
je 0x4ce31d
lea ebx, [esi + 0x4c]
push ebx
call fcn.00495300
cmp dword [ebx + 0x14], 8
mov eax, dword [esi + 0x5c]
jb 0x4ce0ae
mov edx, dword [ebx]
jmp 0x4ce0b0
mov edx, ebx
cmp dword [edi + 0x14], 8
jb 0x4ce0ba
mov ecx, dword [edi]
jmp 0x4ce0bc
mov ecx, edi
lea eax, [eax*2 + 2]
push eax
push edx
push 1
push 0
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x14], eax
push 6
test eax, eax
je 0x4ce209
call fcn.004a1320
mov ecx, eax
call fcn.004a14d0
test al, al
je 0x4ce1eb
sub esp, 8
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0xbc]
call fcn.0047b4d0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x1c
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0xbc]
call fcn.0047ee50
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x125
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Failed_to_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f0b0
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a1750
mov edx, 0x575ac0
mov ecx, eax
call fcn.0047f0b0
mov edx, edi
mov ecx, eax
call fcn.004a1750
mov edx, str.._Error_Code
mov ecx, eax
call fcn.0047f0b0
mov edi, dword [ebp - 0x14]
mov ecx, eax
push edi
call fcn.004c5ec0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x1c
call fcn.0047abe0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x1e
cmp dword [esi + 0x14], 0x10
jb 0x4ce1c1
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
lea ecx, [ebp + 0x18]
call fcn.0047abe0
lea ecx, [ebp - 0xbc]
call fcn.00479050
jmp 0x4ce1ee
mov edi, dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x8044]
call fcn.0047b0a0
mov eax, edi
jmp 0x4cea4d
call fcn.004a1320
mov ecx, eax
call fcn.004a14d0
test al, al
je 0x4ce312
sub esp, 8
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0xbc]
call fcn.0047b4d0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x21
call fcn.004a1680
mov byte [ebp - 4], 0x22
cmp dword [ebx + 0x14], 8
jb 0x4ce247
mov ebx, dword [ebx]
mov edx, eax
lea ecx, [ebp - 0xbc]
call fcn.0047ee50
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x129
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Succeeded_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f0b0
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a1750
mov edx, 0x575ac0
mov ecx, eax
call fcn.0047f0b0
mov edx, edi
mov ecx, eax
call fcn.004a1750
mov edx, str.._Value
mov ecx, eax
call fcn.0047f0b0
mov edx, ebx
mov ecx, eax
call fcn.004a1820
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x21
call fcn.0047abe0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x23
cmp dword [esi + 0x14], 0x10
jb 0x4ce2f0
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
lea ecx, [ebp + 0x18]
call fcn.0047abe0
lea ecx, [ebp - 0xbc]
call fcn.00479050
jmp 0x4cea26
mov edx, str.EXPAND_SZ
lea ecx, [esi + 0x1c]
call fcn.00485880
test al, al
je 0x4ce594
lea ebx, [esi + 0x4c]
push ebx
call fcn.00495300
cmp dword [ebx + 0x14], 8
mov eax, dword [esi + 0x5c]
jb 0x4ce348
mov edx, dword [ebx]
jmp 0x4ce34a
mov edx, ebx
cmp dword [edi + 0x14], 8
jb 0x4ce354
mov ecx, dword [edi]
jmp 0x4ce356
mov ecx, edi
lea eax, [eax*2 + 2]
push eax
push edx
push 2
push 0
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x14], eax
push 6
test eax, eax
je 0x4ce488
call fcn.004a1320
mov ecx, eax
call fcn.004a14d0
test al, al
je 0x4ce1eb
sub esp, 8
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xbc]
call fcn.0047b4d0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x26
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0xbc]
call fcn.0047ee50
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x138
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Failed_to_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f0b0
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a1750
mov edx, 0x575ac0
mov ecx, eax
call fcn.0047f0b0
mov edx, edi
mov ecx, eax
call fcn.004a1750
mov edx, str.._Error_Code__d
mov ecx, eax
call fcn.0047f0b0
mov edi, dword [ebp - 0x14]
mov ecx, eax
push edi
call fcn.004c5ec0
lea ecx, [ebp + 0x18]
mov byte [ebp - 4], 0x26
call fcn.0047abe0
lea eax, [ebp]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x28
cmp dword [esi + 0x14], 0x10
jb 0x4ce45b
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
lea ecx, [ebp]
call fcn.0047abe0
lea ecx, [ebp - 0xbc]
call fcn.00479050
jmp 0x4ce1ee
call fcn.004a1320
mov ecx, eax
call fcn.004a14d0
test al, al
je 0x4ce589
sub esp, 8
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0xbc]
call fcn.0047b4d0
lea ecx, [ebp]
mov byte [ebp - 4], 0x2b
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0xbc]
call fcn.0047ee50
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x13c
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Succeeded_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f0b0
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a1750
mov edx, 0x575ac0
mov ecx, eax
call fcn.0047f0b0
mov edx, edi
mov ecx, eax
call fcn.004a1750
mov edx, str.._Value
mov ecx, eax
call fcn.0047f0b0
mov edx, ebx
mov ecx, eax
call fcn.004a1750
lea ecx, [ebp]
mov byte [ebp - 4], 0x2b
call fcn.0047abe0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x2d
cmp dword [esi + 0x14], 0x10
jb 0x4ce567
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
lea ecx, [ebp + 0x18]
call fcn.0047abe0
lea ecx, [ebp - 0xbc]
call fcn.00479050
jmp 0x4cea26
mov edx, str.MULTI_SZ
lea ecx, [esi + 0x1c]
call fcn.00485880
test al, al
je 0x4ce981
xor eax, eax
push 0x7ffc
push eax
mov word [ebp + 0x30], ax
lea eax, [ebp + 0x32]
push eax
call fcn.0050c510
add esp, 0xc
xor ebx, ebx
cmp dword [esi + 0x5c], 0x3fff
jbe 0x4ce6ec
push 6
call fcn.004a1320
mov ecx, eax
call fcn.004a14d0
test al, al
je 0x4ce6ca
sub esp, 8
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0xbc]
call fcn.0047b4d0
lea ecx, [ebp]
mov byte [ebp - 4], 0x30
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0xbc]
call fcn.0047ee50
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x145
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Failed_to_set_the_MULTI_SZ_value_for_registry_key:
mov ecx, eax
call fcn.0047f0b0
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a1750
mov edx, 0x575ac0
mov ecx, eax
call fcn.0047f0b0
mov edx, edi
mov ecx, eax
call fcn.004a1750
mov edx, str.._Length_is_longer_than_MAX_VALUE_LENGTH_16383_.
mov ecx, eax
call fcn.0047f0b0
lea ecx, [ebp]
mov byte [ebp - 4], 0x30
call fcn.0047abe0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x32
cmp dword [esi + 0x14], 0x10
jb 0x4ce6a8
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
lea ecx, [ebp + 0x18]
call fcn.0047abe0
lea ecx, [ebp - 0xbc]
call fcn.00479050
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x8044]
call fcn.0047b0a0
mov eax, dword [ebp - 0x14]
jmp 0x4cea4d
mov ecx, dword [ebp - 0x20]
xor esi, esi
add ecx, 0x4c
mov dword [ebp - 0x1c], ecx
jmp 0x4ce700
push esi
push 0x5757ac
call fcn.0048e4a0
cmp esi, eax
jne 0x4ce71f
cmp ebx, 0x3fff
jae 0x4ce749
mov ecx, dword [ebp - 0x1c]
xor eax, eax
inc esi
jmp 0x4ce732
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x14], 8
jb 0x4ce72c
mov eax, dword [ecx]
jmp 0x4ce72e
mov eax, ecx
mov ax, word [eax + esi*2]
mov word [ebp + ebx*2 + 0x30], ax
inc esi
inc ebx
cmp esi, dword [ecx + 0x10]
jbe 0x4ce700
inc ebx
cmp dword [edi + 0x14], 8
jb 0x4ce74e
mov ecx, dword [edi]
jmp 0x4ce750
call fcn.0050a445
mov ecx, edi
lea eax, [ebx + ebx]
push eax
lea eax, [ebp + 0x30]
push eax
push 7
push 0
push ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
push 6
mov dword [ebp - 0x14], ebx
call fcn.004a1320
mov ecx, eax
call fcn.004a14d0
test ebx, ebx
je 0x4ce880
test al, al
je 0x4cdf67
sub esp, 8
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0xbc]
call fcn.0047b4d0
lea ecx, [ebp]
mov byte [ebp - 4], 0x35
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0xbc]
call fcn.0047ee50
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x15f
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Failed_to_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f0b0
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a1750
mov edx, 0x575ac0
mov ecx, eax
call fcn.0047f0b0
mov edx, edi
mov ecx, eax
call fcn.004a1750
mov edx, str.._Error_Code
mov ecx, eax
call fcn.0047f0b0
push ebx
mov ecx, eax
call fcn.004c5ec0
lea ecx, [ebp]
mov byte [ebp - 4], 0x35
call fcn.0047abe0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x37
cmp dword [esi + 0x14], 0x10
jb 0x4ce853
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
lea ecx, [ebp + 0x18]
call fcn.0047abe0
lea ecx, [ebp - 0xbc]
call fcn.00479050
jmp 0x4cdf67
test al, al
je 0x4ce976
sub esp, 8
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0xbc]
call fcn.0047b4d0
lea ecx, [ebp]
mov byte [ebp - 4], 0x3a
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 0x3b
lea ecx, [ebp - 0xbc]
call fcn.0047ee50
mov edx, str..RegistryOperation.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x163
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Succeeded_set_the_value_for_registry_key:
mov ecx, eax
call fcn.0047f0b0
lea edx, [ebp + 0x8044]
mov ecx, eax
call fcn.004a1750
mov edx, 0x575ac0
mov ecx, eax
call fcn.0047f0b0
mov edx, edi
mov ecx, eax
call fcn.004a1750
mov edx, str.._Value
mov ecx, eax
call fcn.0047f0b0
mov edx, dword [ebp - 0x1c]
mov ecx, eax
call fcn.004a1750
lea ecx, [ebp]
mov byte [ebp - 4], 0x3a
call fcn.0047abe0
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp - 0xbc]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0x3c
cmp dword [esi + 0x14], 0x10
jb 0x4ce954
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
lea ecx, [ebp + 0x18]
call fcn.0047abe0
lea ecx, [ebp - 0xbc]
call fcn.00479050
jmp 0x4cea26
mov edx, str.BINARY
lea ecx, [esi + 0x1c]
call fcn.00485880
test al, al
je 0x4cea26
push 0x3ffe
lea eax, [ebp + 0x402d]
mov byte [ebp + 0x402c], 0
push 0
push eax
call fcn.0050c510
mov eax, dword [esi + 0x5c]
add esp, 0xc
xor ebx, ebx
mov dword [ebp - 0x20], eax
test eax, eax
je 0x4cea08
xor edi, edi
cmp ebx, 0x3fff
jae 0x4cea05
push 2
push edi
lea eax, [ebp]
push eax
lea ecx, [esi + 0x4c]
call fcn.0047b0d0
cmp dword [eax + 0x14], 8
jb 0x4ce9e0
mov eax, dword [eax]
push 0x10
push 0
push eax
call fcn.0050a2f5
add esp, 0xc
mov byte [ebp + ebx + 0x402c], al
lea ecx, [ebp]
call fcn.0047b0a0
add edi, 2
inc ebx
cmp edi, dword [ebp - 0x20]
jb 0x4ce9c1
mov edi, dword [ebp - 0x1c]
cmp dword [edi + 0x14], 8
jb 0x4cea10
mov edi, dword [edi]
push ebx
lea eax, [ebp + 0x402c]
push eax
push 3
push 0
push edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x8058], 8
jb 0x4cea4b
mov eax, dword [ebp + 0x8044]
test eax, eax
je 0x4cea4b
push eax
call fcn.00507b54
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8030]
xor ecx, ebp
call fcn.005072fd
lea esp, [ebp + 0x8034]
pop ebp
ret 0x20