Function at 0x485710
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4f3380
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov ebp, ecx
mov dword [esp + 0x1c], ebp
push 0x5232bc
mov dword [esp + 0x2c], 0x5232bc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x3c], 0
mov dword [esp + 0x20], 0
mov edx, str.Compression
mov byte [esp + 0x3c], 1
lea ecx, [esp + 0x20]
call fcn.00485000
cmp byte [ebp + 0x2d], 0
mov esi, dword [esp + 0x20]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
je 0x4857af
mov al, byte [ebp + 0x2c]
xor ecx, ecx
push 4
test al, al
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.Security
setne cl
push esi
mov dword [esp + 0x30], ecx
call ebx
cmp byte [ebp + 0x2f], 0
je 0x4857d6
mov al, byte [ebp + 0x2e]
xor ecx, ecx
push 4
test al, al
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.AltStreams
setne cl
push esi
mov dword [esp + 0x30], ecx
call ebx
cmp byte [ebp + 0x31], 0
je 0x4857fd
mov al, byte [ebp + 0x30]
xor ecx, ecx
push 4
test al, al
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.HardLinks
setne cl
push esi
mov dword [esp + 0x30], ecx
call ebx
cmp byte [ebp + 0x33], 0
je 0x485824
mov al, byte [ebp + 0x32]
xor ecx, ecx
push 4
test al, al
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.SymLinks
setne cl
push esi
mov dword [esp + 0x30], ecx
call ebx
mov al, byte [ebp + 4]
xor ecx, ecx
push 4
test al, al
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.ShowPassword
setne cl
push esi
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [ebp]
push 4
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.Level
push esi
call ebx
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push edi
push 1
push 0
push str.Archiver
push esi
call ebx
mov al, byte [ebp + 4]
xor ecx, ecx
push 4
test al, al
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.ShowPassword
setne cl
push esi
mov dword [esp + 0x30], ecx
call ebx
mov al, byte [ebp + 5]
xor ecx, ecx
push 4
test al, al
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.EncryptHeaders
setne cl
push esi
mov dword [esp + 0x30], ecx
call ebx
push str.ArcHistory
lea ecx, [esp + 0x24]
call fcn.0041dae0
lea eax, [ebp + 0x14]
push eax
push str.ArcHistory
lea ecx, [esp + 0x28]
call fcn.0041de80
push 0x5040c0
lea ecx, [esp + 0x24]
call fcn.0041dae0
lea eax, [esp + 0x24]
xor edi, edi
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edi
push eax
push edi
push 0xf003f
push edi
push edi
mov ebx, dword [esp + 0x38]
push edi
push 0x5040c0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
cmove edi, dword [esp + 0x14]
xor ecx, ecx
cmp dword [ebp + 0x24], ecx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], ecx
jbe 0x485b33
mov ebx, dword [esp + 0x1c]
mov ebp, dword [ebx + 0x20]
lea eax, [esp + 0x2c]
push eax
xor esi, esi
lea eax, [esp + 0x18]
push eax
mov ebp, dword [ebp + ecx*4]
push esi
push 0xf003f
push esi
push esi
push esi
push dword [ebp + 0x14]
mov dword [esp + 0x34], esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov eax, dword [ebp]
cmove esi, dword [esp + 0x14]
cmp eax, 0xffffffff
jne 0x48597e
push str.Level
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x485999
push 4
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push 4
push 0
push str.Level
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 4]
cmp eax, 0xffffffff
jne 0x4859af
push str.Dictionary
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x4859ca
push 4
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push 4
push 0
push str.Dictionary
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x4859e0
push str.Order
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x4859fb
push 4
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push 4
push 0
push str.Order
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x485a11
push str.BlockSize
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x485a2c
push 4
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
push eax
push 4
push 0
push str.BlockSize
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [ebp + 0x10]
cmp eax, 0xffffffff
jne 0x485a42
push str.NumThreads
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x485a5d
push 4
mov dword [esp + 0x28], eax
lea eax, [esp + 0x28]
push eax
push 4
push 0
push str.NumThreads
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp + 0x24], 0
jne 0x485a71
push str.Method
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x485a9b
mov eax, dword [ebp + 0x20]
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [esp + 0x20]
push 1
push 0
push str.Method
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp + 0x30], 0
jne 0x485aaf
push 0x5040c0
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x485ad9
mov eax, dword [ebp + 0x2c]
push eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [esp + 0x20]
push 1
push 0
push 0x5040c0
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp + 0x3c], 0
jne 0x485aed
push str.EncryptionMethod
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x485b10
mov ebp, dword [ebp + 0x38]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push ebp
push 1
push 0
push str.EncryptionMethod
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x485b1d
push esi
call ebp
mov ecx, dword [esp + 0x18]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, dword [ebx + 0x24]
jb 0x485937
mov ebx, dword [esp + 0x20]
test edi, edi
je 0x485b3a
push edi
call ebp
test ebx, ebx
je 0x485b41
push ebx
call ebp
push 0x5232bc
mov dword [esp + 0x40], 0xffffffff
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004df96c
add esp, 0x2c
ret