Function at 0x414020
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x451e18
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x4663d8]
xor eax, esp
mov dword [esp + 0x48], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4663d8]
xor eax, esp
push eax
lea eax, [esp + 0x64]
mov dword fs:[0], eax
mov eax, dword [esp + 0x74]
xor ebp, ebp
mov edi, ecx
mov dword [esp + 0x14], ebp
mov dword [esp + 0x6c], ebp
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebp
mov word [esp + 0x44], bp
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov byte [esp + 0x6c], 2
cmp byte [edi + 0x3e], 0
mov dword [esp + 0x1c], 0x1000
je 0x414337
push ebp
lea ecx, [esp + 0x18]
push ecx
push ebp
push 0xf003f
push ebp
push ebp
push ebp
push eax
push 0x80000002
mov dword [esp + 0x38], ebp
mov dword [esp + 0x3c], ebp
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebp
jne 0x414311
mov edx, 0x45849c
call fcn.00401e60
test eax, eax
je 0x4140db
mov ecx, 0x45849c
call fcn.00401f00
jmp 0x4140e6
push edi
mov ecx, 0x4584a0
call fcn.00412310
mov ecx, eax
lea esi, [ecx + 2]
jmp 0x4140f0
mov dx, word [ecx]
add ecx, 2
cmp dx, bp
jne 0x4140f0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, esi
sar ecx, 1
lea edx, [ecx + ecx]
push edx
push eax
mov eax, dword [esp + 0x1c]
push 1
push ebp
push str.InstallPath
push eax
call ebx
lea ecx, [esp + 0x40]
push ecx
call fcn.00424920
mov edx, dword [esp + 0x48]
add esp, 4
cmp dword [esp + 0x58], 8
jae 0x414135
lea edx, [esp + 0x44]
mov eax, edx
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x414140
mov ecx, dword [esp + 0x14]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
push 1
push ebp
push str.Version
push ecx
call ebx
cmp dword [edi + 0x34], ebp
mov edx, 0x457c48
jne 0x414171
mov edx, 0x457c50
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x414176
mov ecx, dword [esp + 0x14]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
push 1
push ebp
push str.Reboot
push ecx
call ebx
cmp dword [edi + 0x38], ebp
mov edx, str.success
je 0x4141a7
mov edx, str.failure
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x4141b0
mov ecx, dword [esp + 0x14]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
push 1
push ebp
push str.Install
push ecx
call ebx
mov ecx, dword [0x468b50]
add ecx, 0xa38
mov eax, ecx
lea edx, [eax + 2]
mov si, word [eax]
add eax, 2
cmp si, bp
jne 0x4141e3
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [esp + 0x14]
push edx
push ecx
push 1
push ebp
push 0x458500
push eax
call ebx
mov ecx, dword [edi + 0x44]
mov eax, dword [ecx]
lea ebp, [edi + 0x40]
mov esi, ebp
mov edi, eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], edi
lea ebx, [ebx]
test esi, esi
mov edx, dword [ebp + 4]
mov dword [esp + 0x3c], edx
je 0x41422f
cmp esi, ebp
je 0x414234
call fcn.00439412
cmp edi, dword [esp + 0x3c]
je 0x4142a4
test esi, esi
jne 0x414243
call fcn.00439412
cmp edi, dword [esi + 4]
jne 0x41424d
call fcn.00439412
cmp byte [edi + 0x28], 0
je 0x41428e
cmp edi, dword [esi + 4]
jne 0x41425d
call fcn.00439412
cmp dword [edi + 0x24], 8
lea ebx, [edi + 0xc]
jb 0x41426b
mov eax, dword [ebx + 4]
jmp 0x41426e
lea eax, [ebx + 4]
cmp word [eax], 0x40
je 0x414288
cmp edi, dword [esi + 4]
jne 0x41427e
call fcn.00439412
push ebx
lea esi, [esp + 0x24]
call fcn.0040d330
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea esi, [esp + 0x30]
call fcn.00430ef0
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
jmp 0x414220
xor ecx, ecx
mov eax, 0x1000
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00437e01
mov esi, eax
add esp, 4
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x28]
call fcn.004368e0
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
add esp, 8
lea edx, [ecx + ecx]
push edx
push esi
push 7
push 0
push str.InstallConfig
push eax
call ebx
push esi
call fcn.0043a723
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
je 0x414307
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
xor ebp, ebp
mov eax, dword [esp + 0x24]
cmp eax, ebp
je 0x414337
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x28]
push ecx
call fcn.004115d0
mov edx, dword [esp + 0x28]
add esp, 4
push edx
call fcn.00439935
add esp, 4
cmp dword [esp + 0x58], 8
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
jb 0x414357
mov eax, dword [esp + 0x44]
push eax
call fcn.00439935
add esp, 4
mov eax, dword [esp + 0x14]
cmp eax, ebp
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebp
mov word [esp + 0x44], bp
je 0x414377
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00437ffa
add esp, 0x5c
ret 4