Function at 0x408625
Capabilities:
Set registry value

Disassembly:
push ebp
push ebx
push edi
mov edx, 0x11
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x40862d
call fcn.00475020
mov edx, dword [esp + 0x58]
lea ecx, [esp]
call fcn.0042b000
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 4]
call fcn.0042b000
mov edx, dword [esp + 0x60]
lea ecx, [esp + 8]
call fcn.0042b000
mov dword [esp + 0x10], 0x20006
cmp dword [esp + 0x68], 0
je 0x408682
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00472790
call fcn.00475080
mov edx, 0x530a1e
call fcn.0042b330
mov ecx, eax
call fcn.0042b340
je 0x4086e8
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push dword [esp + 8]
call fcn.00472760
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00472800
lea eax, [esp + 4]
push eax
call fcn.00474f50
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00472800
call fcn.00475080
mov edx, 0x530a1e
call fcn.0042b330
mov ecx, eax
call fcn.0042b340
je 0x40874e
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
push dword [esp + 8]
call fcn.00472760
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00472790
lea eax, [esp + 4]
push eax
call fcn.00474f50
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x4087cb
mov ebx, dword [esp + 0x64]
cmp ebx, 3
je 0x408774
push 0x53f9f0
push 0x24
push dword [esp + 0x74]
call fcn.00473d70
jmp 0x4087cb
mov ebp, dword [esp + 0x6c]
mov dword [ebp], 0
mov ebp, dword [esp + 0x6c]
mov dword [ebp + 8], 0
mov ebp, dword [esp + 0x6c]
mov edx, 0x52f028
lea ecx, [ebp + 0xc]
call fcn.0042b008
mov ebp, dword [esp + 0x6c]
mov dword [ebp + 0x10], 0
mov ebp, dword [esp + 0x6c]
lea eax, [ebp + 0x14]
mov dword [eax + 4], 0
mov dword [eax], 0
mov ebp, dword [esp + 0x6c]
mov edx, 0x52f028
lea ecx, [ebp + 0x20]
call fcn.0042b008
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x1c]
push 0
xor eax, eax
push eax
push 0
push dword [esp + 0x1c]
push dword [esp + 0x74]
call sub.ADVAPI32.dll_RegCreateKeyExW
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x40884b
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x408834
push dword [esp + 0xc]
mov ebp, dword [esp + 0x70]
pop dword [ebp + 8]
push edx
call fcn.00474eb0
pop edx
push eax
push dword [esp + 0x10]
call fcn.004099ff
mov ebp, dword [esp + 0x70]
lea eax, [ebp + 0xc]
push eax
call fcn.00474f50
cmp dword [esp + 0x14], 0
je 0x408844
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
jmp 0x408c33
push dword [esp + 0x64]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x408956
mov ebx, dword [esp + 0x70]
and ebx, ebx
jne 0x40889c
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x408889
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xfffffffd
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_Required_Ret.RegValue_parameter_not_found_
lea ecx, [ebp + 0xc]
call fcn.0042b008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x408c33
mov ebp, dword [esp + 0x70]
mov eax, dword [ebp + 4]
cdq
push edx
push eax
pop dword [esp + 0x24]
pop dword [esp + 0x24]
mov ebp, dword [esp + 0x70]
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x4088f8
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x4088e5
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xfffffffe
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_No_Pointer_to_BINARY_defined_
lea ecx, [ebp + 0xc]
call fcn.0042b008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x408c33
push dword [esp + 0x24]
push dword [esp + 0x24]
pop ebx
pop edi
cmp ebx, 0
jne 0x40890c
cmp edi, 0
je 0x408910
xor eax, eax
jmp 0x408915
mov eax, 1
or eax, eax
je 0x40892d
push dword [esp + 0x1c]
call fcn.00473d80
cdq
push edx
push eax
pop dword [esp + 0x24]
pop dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push eax
push dword [esp + 0x20]
push 3
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x408be5
mov ebx, 4
cmp ebx, dword [esp]
jne 0x408997
push dword [esp + 0xc]
call fcn.00472880
mov dword [esp + 0x3c], eax
push 4
lea eax, [esp + 0x40]
push eax
push 4
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x408be5
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x4089de
push dword [esp + 0xc]
call fcn.00472880
push edx
push eax
pop dword [esp + 0x44]
pop dword [esp + 0x44]
push 8
lea eax, [esp + 0x44]
push eax
push 0xb
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x408be5
mov ebx, 2
cmp ebx, dword [esp]
je 0x4089f2
mov ebx, 1
cmp ebx, dword [esp]
jne 0x408a25
push dword [esp + 0xc]
call fcn.004729c0
mov ebx, eax
add ebx, 2
push ebx
mov eax, dword [esp + 0x10]
push eax
push dword [esp + 0x70]
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x408be5
mov ebx, 7
cmp ebx, dword [esp]
jne 0x408be5
mov eax, 0x52f372
push eax
push dword [esp + 0x10]
call fcn.004729f0
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0
jmp 0x408a50
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x30]
jl 0x408abe
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
mov eax, 0x52f372
push eax
mov ebx, dword [esp + 0x3c]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.00472a80
lea eax, [esp + 0x38]
push eax
call fcn.00474f50
push dword [esp + 0x24]
push dword [esp + 0x24]
push 0x19
push dword [esp + 0x40]
call fcn.00472bb0
cdq
add dword [esp], eax
adc dword [esp + 4], edx
add dword [esp], 2
adc dword [esp + 4], 0
pop dword [esp + 0x24]
pop dword [esp + 0x24]
inc dword [esp + 0x30]
jno 0x408a50
push dword [esp + 0x24]
push dword [esp + 0x24]
pop ebx
pop edi
cmp ebx, 0
jne 0x408ad6
cmp edi, 0
jne 0x408ad6
xor eax, eax
jmp 0x408adb
mov eax, 1
or eax, eax
je 0x408be5
mov eax, dword [esp + 0x20]
push eax
call fcn.00473de0
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x408bb1
mov dword [esp + 0x30], 0
jmp 0x408b06
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x30]
jl 0x408b7c
push edx
call fcn.00474eb0
pop edx
push eax
push edx
call fcn.00474eb0
pop edx
push eax
mov eax, 0x52f372
push eax
mov ebx, dword [esp + 0x3c]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.00472a80
lea eax, [esp + 0x38]
push eax
call fcn.00474f50
push 0x19
push 0xffffffff
push dword [esp + 0x3c]
mov ebx, dword [esp + 0x28]
add ebx, dword [esp + 0x44]
push ebx
call fcn.00473e00
mov ebx, dword [esp + 0x38]
push 0x19
push dword [esp + 0x38]
call fcn.00472bb0
add ebx, eax
add ebx, 2
mov dword [esp + 0x38], ebx
inc dword [esp + 0x30]
jno 0x408b06
sub esp, 4
mov eax, dword [esp + 0x24]
push eax
push dword [esp + 0x24]
push dword [esp + 0x74]
push 0
push dword [esp + 0x1c]
push dword [esp + 0x30]
call dword [0x63d5e8]
add esp, 4
mov dword [esp + 0x10], eax
push dword [esp + 0x1c]
call fcn.00473f50
jmp 0x408be5
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x408bd5
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.0042b008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x408c33
pop eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 0xc], 0
je 0x408c2b
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x408c27
push dword [esp + 0xc]
mov ebp, dword [esp + 0x70]
pop dword [ebp + 8]
push edx
call fcn.00474eb0
pop edx
push eax
push dword [esp + 0x10]
call fcn.004099ff
mov ebp, dword [esp + 0x70]
lea eax, [ebp + 0xc]
push eax
call fcn.00474f50
xor eax, eax
jmp 0x408c33
mov eax, dword [esp + 0x28]
jmp 0x408c33
push dword [esp + 0x30]
call fcn.004750b0
push dword [esp]
call fcn.004750b0
push dword [esp + 8]
call fcn.004750b0
push dword [esp + 4]
call fcn.004750b0
add esp, 0x44
pop edi
pop ebx
pop ebp
ret 0x1c