Function at 0x406590
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x56d698
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x641030]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x641030]
xor eax, esp
push eax
lea eax, [esp + 0x7c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x90]
mov eax, dword [esp + 0x98]
mov esi, dword [esp + 0x8c]
mov edx, dword [esp + 0x94]
xor ebp, ebp
xor ecx, ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x74], 7
mov dword [esp + 0x70], ebp
mov word [esp + 0x60], cx
cmp dword [0x6423d0], 1
mov dword [esp + 0x84], ebp
jne 0x406614
mov eax, dword [0x630848]
mov dword [esp + 0x14], eax
cmp edx, ebp
je 0x40663a
mov eax, edx
lea edi, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x406620
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x64]
call fcn.004026f0
push esi
lea ecx, [esp + 0x60]
push ecx
lea edx, [esp + 0x48]
push edx
call fcn.004061e0
push 0x58d4e4
push eax
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x9c], 1
call fcn.004061e0
add esp, 0x18
push 0xffffffffffffffff
push ebp
push eax
lea ecx, [esp + 0x68]
mov byte [esp + 0x90], 2
call fcn.004025f0
mov esi, 8
cmp dword [esp + 0x3c], esi
jb 0x406692
mov ecx, dword [esp + 0x28]
push ecx
call fcn.00554bd9
add esp, 4
xor edx, edx
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], ebp
mov word [esp + 0x28], dx
cmp dword [esp + 0x58], esi
jb 0x4066b8
mov eax, dword [esp + 0x44]
push eax
call fcn.00554bd9
add esp, 4
mov edx, dword [esp + 0x14]
cmp edx, reloc.WS2_32.dll_bind
jne 0x4066d2
mov eax, dword [esp + 0x9c]
or eax, 0x20006
jmp 0x4066d7
mov eax, 0x20006
mov ecx, dword [esp + 0x60]
cmp dword [esp + 0x74], esi
jae 0x4066e5
lea ecx, [esp + 0x60]
push ebp
lea edi, [esp + 0x20]
push edi
push ebp
push eax
push ebp
push ebp
push ebp
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4067d2
mov ecx, dword [ebx + 0x18]
mov edi, dword [ecx]
mov esi, dword [ebx]
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], edi
nop
mov ebp, dword [ebx + 0x18]
mov eax, dword [ebx]
test esi, esi
je 0x40671d
cmp esi, eax
je 0x406722
call fcn.0055521c
cmp edi, ebp
je 0x4067c2
test esi, esi
jne 0x406762
call fcn.0055521c
xor eax, eax
cmp edi, dword [eax + 0x18]
jne 0x40673f
call fcn.0055521c
mov ebx, dword [edi + 0x3c]
test esi, esi
jne 0x406766
call fcn.0055521c
xor eax, eax
cmp edi, dword [eax + 0x18]
jne 0x406757
call fcn.0055521c
cmp dword [edi + 0x40], 8
jb 0x40676a
mov ebp, dword [edi + 0x2c]
jmp 0x40676d
mov eax, dword [esi]
jmp 0x406735
mov eax, dword [esi]
jmp 0x40674d
lea ebp, [edi + 0x2c]
test esi, esi
jne 0x40678b
call fcn.0055521c
cmp edi, dword [esi + 0x18]
jne 0x406780
call fcn.0055521c
cmp dword [edi + 0x24], 8
jb 0x40678f
mov edi, dword [edi + 0x10]
jmp 0x406792
mov esi, dword [esi]
jmp 0x406776
add edi, 0x10
mov eax, dword [esp + 0x1c]
lea edx, [ebx + ebx + 2]
push edx
push ebp
push 1
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [esp + 0x14]
call fcn.004018a0
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
mov ebx, dword [esp + 0x20]
jmp 0x406710
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 8
cmp dword [esp + 0x74], esi
jb 0x4067e5
mov edx, dword [esp + 0x60]
push edx
call fcn.00554bd9
add esp, 4
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.005550b0
add esp, 0x74
ret