Function at 0x406920
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
mov eax, dword [0x418ec0]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
xor ebp, ebp
push edi
push ebp
push ebp
push pe_nt_image_headers32
push 0x417
push eax
xor ebx, ebx
call esi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
call edi
test eax, eax
je 0x40696a
fld qword [0x4132b0]
fld qword [0x413378]
call fcn.0040a2c0
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x418
push ecx
call esi
push eax
call edi
test eax, eax
je 0x4069ac
fld qword [0x4132b0]
fld qword [0x413370]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x41c
push edx
call esi
push eax
call edi
test eax, eax
je 0x4069ee
fld qword [0x4132b0]
fld qword [0x4132b0]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x41d
push eax
call esi
push eax
call edi
test eax, eax
je 0x406a2f
fld qword [0x4132b0]
fld qword [0x413368]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x42e
push ecx
call esi
push eax
call edi
test eax, eax
je 0x406a71
fld qword [0x4132b0]
fld qword [0x413360]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x42f
push edx
call esi
push eax
call edi
test eax, eax
je 0x406ab3
fld qword [0x4132b0]
fld qword [0x413358]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x430
push eax
call esi
push eax
call edi
test eax, eax
je 0x406af4
fld qword [0x4132b0]
fld qword [0x413350]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x431
push ecx
call esi
push eax
call edi
test eax, eax
je 0x406b36
fld qword [0x4132b0]
fld qword [0x413348]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x432
push edx
call esi
push eax
call edi
test eax, eax
je 0x406b78
fld qword [0x4132b0]
fld qword [0x413340]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x433
push eax
call esi
push eax
call edi
test eax, eax
je 0x406bb9
fld qword [0x4132b0]
fld qword [0x413338]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x437
push ecx
call esi
push eax
call edi
test eax, eax
je 0x406bfb
fld qword [0x4132b0]
fld qword [0x413330]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x438
push edx
call esi
push eax
call edi
test eax, eax
je 0x406c3d
fld qword [0x4132b0]
fld qword [0x413328]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x439
push eax
call esi
push eax
call edi
test eax, eax
je 0x406c7e
fld qword [0x4132b0]
fld qword [0x413320]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x43a
push ecx
call esi
push eax
call edi
test eax, eax
je 0x406cc0
fld qword [0x4132b0]
fld qword [0x413318]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x43b
push edx
call esi
push eax
call edi
test eax, eax
je 0x406d02
fld qword [0x4132b0]
fld qword [0x413310]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x43c
push eax
call esi
push eax
call edi
test eax, eax
je 0x406d43
fld qword [0x4132b0]
fld qword [0x413308]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x43d
push ecx
call esi
push eax
call edi
test eax, eax
je 0x406d85
fld qword [0x4132b0]
fld qword [0x413300]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x43e
push edx
call esi
push eax
call edi
test eax, eax
je 0x406dc7
fld qword [0x4132b0]
fld qword [0x4132f8]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x43f
push eax
call esi
push eax
call edi
test eax, eax
je 0x406e08
fld qword [0x4132b0]
fld qword [0x4132f0]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x440
push ecx
call esi
push eax
call edi
test eax, eax
je 0x406e4a
fld qword [0x4132b0]
fld qword [0x4132e8]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x441
push edx
call esi
push eax
call edi
test eax, eax
je 0x406e8c
fld qword [0x4132b0]
fld qword [0x4132e0]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x442
push eax
call esi
push eax
call edi
test eax, eax
je 0x406ecd
fld qword [0x4132b0]
fld qword [0x4132d8]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x443
push ecx
call esi
push eax
call edi
test eax, eax
je 0x406f0f
fld qword [0x4132b0]
fld qword [0x4132d0]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov edx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x444
push edx
call esi
push eax
call edi
test eax, eax
je 0x406f51
fld qword [0x4132b0]
fld qword [0x4132c8]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov eax, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x445
push eax
call esi
push eax
call edi
test eax, eax
je 0x406f92
fld qword [0x4132b0]
fld qword [0x4132c0]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
mov ecx, dword [0x418ec0]
push ebp
push ebp
push pe_nt_image_headers32
push 0x446
push ecx
call esi
push eax
call edi
test eax, eax
je 0x406fd4
fld qword [0x4132b0]
fld qword [0x4132b8]
call fcn.0040a2c0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
fild qword [esp + 0x14]
faddp st(1)
call fcn.0040a290
mov ebx, eax
push 4
call fcn.0040a1df
mov esi, eax
add esp, 4
mov byte [esi], bl
shr ebx, 8
mov eax, ebx
mov byte [esi + 1], al
cdq
and edx, 0xff
add eax, edx
sar eax, 8
mov byte [esi + 2], al
cdq
and edx, 0xff
add eax, edx
lea edx, [esp + 0x10]
push edx
push 0x20006
push ebp
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer
sar eax, 8
push Ordinal_2
mov byte [esi + 3], al
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x10]
push 4
push esi
push 3
push ebp
push str.Noviewondrive
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret