Function at 0x443951
Capabilities:
Set registry value

Disassembly:
mov eax, 0x44bb86
call fcn.00415350
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0x1c]
mov eax, dword [ebx]
mov ecx, eax
imul ecx, ecx, 0x1c
cmp eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov edx, dword [ecx + esi + 0x14]
mov dword [ebp - 0x14], edx
jge 0x443b00
push edi
jmp 0x443983
mov edx, dword [ebp - 0x14]
mov eax, dword [ebx]
imul eax, eax, 0x1c
lea ecx, [eax + esi]
cmp edx, dword [ecx + 0x14]
jg 0x443aff
test byte [ecx + 0x18], 1
je 0x4439ad
push edx
mov edx, dword [ebp + 0xc]
push esi
mov eax, ebx
call fcn.004437a3
pop ecx
pop ecx
jmp 0x443af4
xor edi, edi
mov dword [ebp + 0x1c], edi
mov edx, dword [ecx + 0x18]
xor eax, eax
test dl, 6
mov dword [ebp - 4], edi
je 0x4439f9
lea eax, [ebp + 0x1c]
push eax
push 4
push edi
push dword [ecx]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [ebx]
imul ecx, ecx, 0x1c
add ecx, esi
mov edx, dword [ecx + 0x18]
test dl, 4
je 0x4439f9
cmp eax, edi
je 0x4439f9
push dword [ebp - 0x14]
mov edx, dword [ebp + 0xc]
push esi
mov eax, ebx
call fcn.004437a3
pop ecx
pop ecx
jmp 0x443adf
test dl, 8
je 0x443a1a
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
push edi
push 0xf000f
push edi
push edi
push edi
push dword [ecx]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
jne 0x443b0e
mov eax, dword [ebx]
imul eax, eax, 0x1c
add eax, esi
mov ecx, dword [eax + 0xc]
cmp ecx, edi
je 0x443ab4
cmp dword [eax + 8], 1
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + 0x10]
jne 0x443a95
mov esi, dword [ebp - 0x10]
mov eax, 0x404d18
push 3
mov edi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
jne 0x443a58
mov eax, dword [ebp + 0x10]
jmp 0x443a7b
push 2
push eax
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x443a7e
mov eax, dword [ebp - 0x10]
movsx eax, byte [eax + 2]
mov ecx, dword [ebp + 0x14]
sub eax, 0x30
mov eax, dword [ecx + eax*4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x443a84
mov esi, dword [ebp + 8]
sub eax, edx
lea ecx, [eax + 1]
xor edi, edi
mov eax, dword [ebx]
imul eax, eax, 0x1c
push ecx
push dword [ebp - 0x10]
add eax, esi
push dword [eax + 8]
push edi
push dword [eax + 4]
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, edi
jne 0x443b0e
inc dword [ebx]
mov eax, dword [ebx]
cmp eax, dword [ebp + 0xc]
jge 0x443adf
mov ecx, dword [ebp - 0x14]
imul eax, eax, 0x1c
cmp ecx, dword [eax + esi + 0x14]
jge 0x443adf
push ebx
push dword [ebp + 0x1c]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00443951
add esp, 0x18
or dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x1c], edi
je 0x443af4
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x1c], edi
mov eax, dword [ebx]
cmp eax, dword [ebp + 0xc]
jl 0x443980
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
push 0x454964
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], 0x80004005
call sub.msvcrt.dll__CxxThrowException
int3