Function at 0x4022c0
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x40d018]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], 0
mov dword [ebp - 0x10], 0
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0x2001d
push 0
push 0
push 0
push 0x401260
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402314
jmp 0x402492
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x402345
jmp 0x402492
push 0xe
push 0x40124c
push 2
push 0
push 0x40122c
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40236d
jmp 0x402492
mov dword [ebp - 0x14], 1
push 4
lea ecx, [ebp - 0x14]
push ecx
push 4
push 0
push 0x40121c
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40239b
jmp 0x402492
mov dword [ebp - 0x14], 1
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push 0x401200
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4023c9
jmp 0x402492
jmp 0x4023d3
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x402492
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x18]
push edx
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40240e
jmp 0x40248d
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov dword [ebp - 0x2c], edx
mov eax, dword [ecx + 4]
mov dword [ebp - 0x28], eax
mov edx, dword [ecx + 8]
mov dword [ebp - 0x24], edx
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x80]
push edx
call fcn.00402190
push 0x4a
lea eax, [ebp - 0x80]
push eax
push 1
push 0
push 0x4011f4
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
call fcn.00406426
add esp, 4
shl eax, 1
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
push 1
push 0
push 0x4011e0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4023cb
cmp dword [ebp - 0x10], 0
je 0x4024a2
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x4024b2
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
call fcn.00406102
mov esp, ebp
pop ebp
ret 8