Function at 0x10004280
Capabilities:
Set registry value

Disassembly:
mov eax, 0x49c4
call fcn.10006b00
mov eax, dword [str.SUBSYS_]
mov ecx, dword [0x100179b0]
mov dword [esp + 0x2c], eax
mov al, byte [0x10017d74]
mov dword [esp + 0x30], ecx
xor ecx, ecx
mov byte [esp + 0x20], al
mov eax, dword [0x10017d6c]
mov word [esp + 0x21], cx
push ebx
mov byte [esp + 0x27], cl
mov ecx, dword [str.__n_]
push ebp
mov dword [esp + 0x40], eax
push esi
xor eax, eax
push edi
mov dword [esp + 0x10], ecx
mov word [esp + 0x15], ax
mov ecx, 0x1e
lea edi, [esp + 0xec]
mov edx, dword [str.SID]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x5c4]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0x1b4]
rep stosd dword es:[edi], eax
mov ecx, 0x14
lea edi, [esp + 0x4c]
rep stosd dword es:[edi], eax
mov ecx, 0x14
lea edi, [esp + 0x164]
mov dword [esp + 0x2c], edx
mov edx, dword [str.RegKey_]
rep stosd dword es:[edi], eax
mov ecx, 0x14
lea edi, [esp + 0x9c]
mov dword [esp + 0x44], edx
mov dl, byte [0x10017d64]
rep stosd dword es:[edi], eax
mov byte [esp + 0x14], dl
mov edx, dword [esp + 0x49d8]
lea ecx, [esp + 0x3c]
xor ebx, ebx
push ecx
push edx
mov dword [esp + 0x24], ebx
mov byte [esp + 0x1f], al
mov dword [esp + 0x20], ebx
mov dword [esp + 0x3c], ebx
call fcn.1000691a
lea ecx, [esp + 0xa4]
add esp, 8
test ecx, ecx
jne 0x1000437e
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x49c4
ret
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x9c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dl, byte [esp + 0xa3]
mov cl, 0x26
cmp dl, cl
je 0x100043bf
mov dl, byte [esp + eax + 0xa4]
inc eax
cmp dl, cl
jne 0x100043b3
lea ecx, [esp + 0x1c]
push 0x10
lea edx, [esp + 0xa7]
push ecx
push edx
mov byte [esp + eax + 0xaf], 0
call fcn.10006e76
mov edi, dword [esp + 0x49e8]
mov dword [esp + 0x2c], eax
mov ebx, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x170]
shr ebx, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x10017a0c
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x174]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov dword [esp + 0x48], ebx
rep movsb byte es:[edi], byte [esi]
mov edi, 0x100178dc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x174]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x49f0]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x174]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.10006aa0
mov ebp, eax
add esp, 0x14
test ebp, ebp
mov dword [esp + 0x28], ebp
jne 0x100044a2
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x49c4
ret
mov edi, 0x10018e14
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x4c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebp
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x78
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xf4]
push ecx
call fcn.10006a0d
add esp, 0xc
test eax, eax
je 0x1000481a
lea edx, [esp + 0x2c]
lea eax, [esp + 0xec]
push edx
push eax
call fcn.1000691a
add esp, 8
test eax, eax
je 0x100047ff
lea ecx, [esp + 0x10]
lea edx, [esp + 0xec]
push ecx
push edx
call fcn.10006b2f
lea eax, [esp + 0x18]
push eax
push 0
call fcn.10006b2f
lea ecx, [esp + 0x2c]
push 0x10
push ecx
push eax
call fcn.10006e76
lea edx, [esp + 0x2c]
mov esi, eax
push edx
push 0
call fcn.10006b2f
lea eax, [esp + 0x34]
push eax
push 0
call fcn.10006b2f
lea ecx, [esp + 0x48]
push 0x10
push ecx
push eax
call fcn.10006e76
add esp, 0x38
cmp si, bx
jne 0x10004561
cmp ax, word [esp + 0x20]
je 0x10004589
test si, si
jne 0x1000456b
test ax, ax
je 0x10004589
cmp si, bx
jne 0x10004575
test ax, ax
je 0x10004589
test si, si
jne 0x100047ff
cmp ax, word [esp + 0x20]
jne 0x100047ff
lea edx, [esp + 0x10]
push edx
push 0
call fcn.10006b2f
lea eax, [esp + 0x18]
push eax
push 0
call fcn.10006b2f
mov edi, dword [esp + 0x49ec]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
lea ebp, [esp + 0x4c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, ebp
lea ebp, [esp + 0x4c]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x100178dc
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, ebp
mov ebp, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea ebp, [esp + 0x4c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10004840
lea eax, [esp + 0x4c]
push 0x10017a0c
push eax
call fcn.10006aa0
mov esi, eax
add esp, 8
test esi, esi
mov dword [esp + 0x24], esi
je 0x100047fb
push esi
lea ecx, [esp + 0xf0]
push 0x78
push ecx
xor ebp, ebp
call fcn.10006a0d
add esp, 0xc
test eax, eax
je 0x10004759
lea ebx, [esp + 0x9d4]
cmp byte [esp + 0xec], 0x23
je 0x1000473a
lea edx, [esp + 0x44]
lea eax, [esp + 0xec]
push edx
push eax
call fcn.1000691a
add esp, 8
test eax, eax
je 0x1000473a
lea ecx, [esp + 0x10]
lea edx, [esp + 0xec]
push ecx
push edx
call fcn.10006b2f
lea eax, [esp + 0x18]
push eax
push 0
call fcn.10006b2f
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x20]
mov edx, ecx
mov esi, edi
mov edi, ebx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.10006b2f
lea ecx, [esp + 0x34]
push 0x10
push ecx
push eax
call fcn.10006e76
lea edx, [esp + 0x34]
mov dword [esp + ebp*4 + 0x5e8], eax
push edx
push 0
call fcn.10006b2f
lea ecx, [esp + 0x48]
push 0x10
push ecx
push eax
call fcn.10006e76
add esp, 0x38
mov dword [esp + ebp*4 + 0x1b4], eax
inc ebp
add ebx, 0x40
cmp ebp, 0x100
jge 0x10004833
mov esi, dword [esp + 0x24]
push esi
lea edx, [esp + 0xf0]
push 0x78
push edx
call fcn.10006a0d
add esp, 0xc
test eax, eax
jne 0x1000467b
mov ebx, dword [esp + 0x38]
push esi
call fcn.10006990
add esp, 4
mov edx, dword [esp + 0x49e4]
lea eax, [esp + 0x34]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10004840
xor esi, esi
test ebp, ebp
jle 0x100047e8
lea edi, [esp + 0x9d4]
mov eax, dword [esp + esi*4 + 0x5c4]
cmp eax, 4
jne 0x100047c2
mov ecx, dword [esp + 0x18]
push eax
lea eax, [esp + esi*4 + 0x1b8]
push eax
push 4
push 0
push edi
push ecx
jmp 0x100047da
cmp eax, 3
jne 0x100047e0
lea edx, [esp + esi*4 + 0x1b4]
push 4
push edx
push eax
mov eax, dword [esp + 0x24]
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc esi
add edi, 0x40
cmp esi, ebp
jl 0x100047a1
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], 0
mov ebp, dword [esp + 0x28]
push ebp
lea edx, [esp + 0xf0]
push 0x78
push edx
call fcn.10006a0d
add esp, 0xc
test eax, eax
jne 0x100044e3
push ebp
call fcn.10006990
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x49c4
ret
mov eax, dword [esp + 0x24]
push eax
call fcn.10006990
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x49c4
ret