Function at 0x414aef
Capabilities:
Set registry value

Disassembly:
mov eax, 0x427cbf
call fcn.0041ba64
sub esp, 0x150
mov eax, dword [0x42c300]
push ebx
mov dword [ebp - 0x10], eax
call dword [0x42c090]
call fcn.004136b1
cmp eax, 4
je 0x414dd2
lea eax, [ebp - 0x120]
push eax
call fcn.0041465d
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x124], eax
jne 0x414ddc
push dword [ebp + 0x14]
lea ecx, [ebp - 0x118]
call fcn.00405759
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x118]
cmp eax, ebx
mov dword [ebp - 0x11c], eax
jne 0x414b5f
mov eax, dword [ebp - 0x120]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], edi
mov dword [ebp - 0x12c], ebx
mov dword [ebp + 0x14], ebx
mov byte [ebp - 4], 1
lea eax, [ebp + 0x14]
push eax
push 0x1d4d
call fcn.00414127
test eax, eax
jne 0x414bad
lea eax, [ebp - 0x12c]
push eax
push dword [ebp + 0x14]
call fcn.0041361d
test eax, eax
jne 0x414bad
mov edi, dword [ebp - 0x12c]
mov dword [ebp - 0x124], edi
push dword [ebp + 0xc]
lea ecx, [ebp - 0x94]
call fcn.00405759
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x11c]
cmp eax, ebx
mov esi, dword [ebp - 0x94]
jne 0x414bd5
mov eax, dword [ebp - 0x120]
push dword [ebp + 0x10]
lea ecx, [ebp - 0x128]
push dword [ebp + 0xc]
push ebx
push 2
push ecx
push eax
call fcn.00413964
test eax, eax
jl 0x414c2d
xor eax, eax
inc eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x150], esi
mov dword [ebp - 0x144], 0x4031ec
mov dword [ebp - 0x138], 0x4031f4
lea eax, [ebp - 0x150]
mov dword [ebp + 0xc], 3
jmp 0x414c91
mov eax, dword [ebp - 0x11c]
cmp eax, ebx
jne 0x414c3d
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x15c], eax
xor eax, eax
inc eax
mov dword [ebp - 0x158], eax
mov byte [ebp - 0x154], al
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x134], eax
mov byte [ebp - 0x153], bl
mov dword [ebp - 0x150], 0x4031ec
mov dword [ebp - 0x144], 0x4031f4
mov dword [ebp - 0x138], edi
lea eax, [ebp - 0x15c]
mov dword [ebp + 0xc], 4
mov dword [ebp - 0x11c], eax
lea eax, [ebp - 0x124]
push eax
push ebx
push ebx
push dword [ebp + 0xc]
mov byte [ebp - 0x148], 1
push dword [ebp - 0x11c]
mov byte [ebp - 0x147], bl
push dword [ebp - 0x120]
mov byte [ebp - 0x13c], 1
push dword [ebp - 0x120]
mov byte [ebp - 0x13b], bl
mov byte [ebp - 0x130], 1
mov byte [ebp - 0x12f], bl
call fcn.00413edf
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorLength]
jne 0x414d19
push dword [ebp - 0x124]
call edi
push eax
push dword [ebp - 0x124]
push 3
push ebx
push 0x4032f4
push dword [ebp + 8]
call esi
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x11c]
push eax
push ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
push dword [ebp - 0x120]
call fcn.00413edf
cmp eax, ebx
mov dword [ebp - 0x124], eax
jne 0x414d6e
push dword [ebp - 0x11c]
call edi
push eax
push dword [ebp - 0x11c]
push 3
push ebx
push 0x4032e0
push dword [ebp + 8]
call esi
push dword [ebp - 0x11c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x12c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [ebp - 0x120]
call fcn.0041bace
pop ecx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x90]
cmp dword [ebp - 0x94], eax
pop edi
pop esi
je 0x414da6
push dword [ebp - 0x94]
call fcn.0041b1d4
pop ecx
mov byte [ebp - 4], bl
push dword [ebp + 0x14]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x114]
cmp dword [ebp - 0x118], eax
je 0x414ddc
push dword [ebp - 0x118]
call fcn.0041b1d4
pop ecx
jmp 0x414ddc
mov dword [ebp - 0x124], 1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x124]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0041b4ee
leave
ret 0x10