Function at 0x4058b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push edi
mov eax, dword [0x41104c]
mov dword [eax], 0
mov ecx, dword [0x41105c]
mov dword [ecx], 0
lea edx, [ebp - 4]
push edx
push 0
call fcn.0040167a
add esp, 8
test eax, eax
je 0x405924
cmp dword [ebp - 4], 0
je 0x4058fd
mov eax, dword [0x41105c]
mov ecx, dword [eax]
or ecx, 1
mov edx, dword [0x41105c]
mov dword [edx], ecx
jmp 0x40590f
mov eax, dword [0x41105c]
mov ecx, dword [eax]
and ecx, 0xfffffffe
mov edx, dword [0x41105c]
mov dword [edx], ecx
mov eax, dword [0x41105c]
mov ecx, dword [eax]
or ecx, 0x10000
mov edx, dword [0x41105c]
mov dword [edx], ecx
lea eax, [ebp - 4]
push eax
push 0x10
call fcn.00401593
add esp, 8
test eax, eax
je 0x405984
mov ecx, dword [ebp - 4]
and ecx, 0xff
and ecx, 0xff
test ecx, ecx
je 0x40595d
mov edx, dword [0x41105c]
mov eax, dword [edx]
or al, 2
mov ecx, dword [0x41105c]
mov dword [ecx], eax
jmp 0x40596f
mov edx, dword [0x41105c]
mov eax, dword [edx]
and al, 0xfd
mov ecx, dword [0x41105c]
mov dword [ecx], eax
mov edx, dword [0x41105c]
mov eax, dword [edx]
or eax, 0x20000
mov ecx, dword [0x41105c]
mov dword [ecx], eax
mov dword [ebp - 0xc], 1
jmp 0x405996
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 3
jae 0x4059b1
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x411030
call fcn.004010f0
add esp, 0xc
jmp 0x40598d
call fcn.004014e0
mov ecx, dword [0x4110bc]
mov dword [ecx], eax
push 0
call fcn.00401513
add esp, 4
or eax, 0xc3f
mov edx, dword [0x41107c]
mov dword [edx], eax
mov eax, dword [0x41108c]
mov dword [eax], 0x64
mov ecx, dword [0x4110ac]
mov dword [ecx], 1
mov dword [ebp - 8], 0x1f
mov edx, dword [0x41107c]
mov eax, dword [edx]
and eax, dword [ebp - 8]
test eax, eax
je 0x405a10
mov ecx, dword [0x41109c]
mov dword [ecx], 1
jmp 0x405a1c
mov edx, dword [0x41109c]
mov dword [edx], 5
push 0
mov eax, 0x4110c0
sub eax, 0x411060
sar eax, 4
push eax
push 0x411060
call fcn.004011d0
add esp, 0xc
push 0x414044
mov ecx, dword [0x4110cc]
push ecx
call fcn.004083f0
add esp, 8
test eax, eax
jne 0x405a97
mov dword [ebp - 0xc], 1
jmp 0x405a63
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 7
jae 0x405a95
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x411060
call fcn.004011d0
add esp, 0xc
test eax, eax
je 0x405a93
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x411060
call fcn.004010f0
add esp, 0xc
jmp 0x405a5a
jmp 0x405ad8
push 0x41404c
mov edx, dword [0x4110cc]
push edx
call fcn.00408170
add esp, 8
mov dword [ebp - 0xc], 1
jmp 0x405abd
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 7
jae 0x405ad8
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x411060
call fcn.004010f0
add esp, 0xc
jmp 0x405ab4
mov edx, dword [0x41107c]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
jmp 0x405af5
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x20
jge 0x405b35
mov edx, dword [ebp - 8]
and edx, 1
test edx, edx
je 0x405b2b
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x70
mov edx, dword [ecx + 0x411208]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
shr ecx, 1
mov dword [ebp - 8], ecx
jmp 0x405aec
push 0
mov edx, 0x413768
sub edx, 0x413738
sar edx, 4
push edx
push 0x413738
call fcn.004011d0
add esp, 0xc
test eax, eax
jne 0x405b61
mov dword [0x416de8], 1
mov dword [ebp - 0xc], 0
jmp 0x405b73
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jae 0x405b9d
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0x21c
mov edx, 1
mov ecx, dword [ecx + 0x413778]
shl edx, cl
mov eax, dword [0x4170e0]
or eax, edx
mov dword [0x4170e0], eax
jmp 0x405b6a
push 0
mov ecx, 0x4110e0
sub ecx, 0x4110d0
sar ecx, 4
push ecx
push 0x4110d0
call fcn.004011d0
add esp, 0xc
test eax, eax
je 0x405be8
mov edx, dword [0x4110ec]
mov dword [edx], 1
push 1
mov eax, 0x4110e0
sub eax, 0x4110d0
sar eax, 4
push eax
push 0x4110d0
call fcn.004010f0
add esp, 0xc
mov dword [ebp - 0xa4], 0x94
mov dword [ebp - 0xa0], 0
mov ecx, 0x23
xor eax, eax
lea edi, [ebp - 0x9c]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0xa4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 2
jne 0x405c2d
mov edx, dword [0x4110ec]
mov dword [edx], 0
mov eax, dword [0x41107c]
mov ecx, dword [eax]
and ecx, 0x80000
test ecx, ecx
je 0x405c6b
lea edx, [ebp - 0xa8]
push edx
push 0x13
call fcn.00401593
add esp, 8
mov eax, dword [ebp - 0xa8]
and eax, 0xff
cmp eax, 3
je 0x405c6b
mov ecx, dword [0x4110ec]
mov dword [ecx], 0
push 2
mov edx, 0x4110e0
sub edx, 0x4110d0
sar edx, 4
push edx
push 0x4110d0
call fcn.004010f0
add esp, 0xc
lea eax, [ebp - 0xac]
push eax
push 0x414054
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x405cbb
lea ecx, [ebp - 0xac]
push ecx
push 0x414070
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [ebp - 0xac]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xb0]
push eax
push 0x41408c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x405cfa
lea ecx, [ebp - 0xb0]
push ecx
push 0x4140a8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [ebp - 0xb0]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xb4], 1
mov dword [ebp - 0x148], 0x94
mov dword [ebp - 0x144], 0
mov ecx, 0x23
xor eax, eax
lea edi, [ebp - 0x140]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x144], 4
jne 0x405d54
mov dword [ebp - 0xb4], 0
lea ecx, [ebp - 0x14c]
push ecx
push 0x4140c4
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x405d9b
push 4
lea edx, [ebp - 0xb4]
push edx
push 4
push 0
push 0x4140e0
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov esp, ebp
pop ebp
ret