Function at 0x408b70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x449314]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x220], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x210], eax
xor edi, edi
mov eax, dword [ebp + 0x18]
push 0x208
mov dword [ebp - 0x214], eax
lea eax, [ebp - 0x20c]
push edi
push eax
mov dword [ebp - 0x218], 0
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
test esi, esi
je 0x408ebb
cmp dword [ebp - 0x220], edi
je 0x408ebb
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
add esp, 0xc
test ebx, ebx
je 0x408c21
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea eax, [ebp - 0x20c]
push 0x43d7d8
push 0x104
push eax
call esi
push ebx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call esi
add esp, 0x18
push 0
lea eax, [ebp - 0x218]
push eax
push 0
push 0xf023f
push 0
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x408d18
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x408cff
mov edi, dword [ecx]
mov eax, edi
mov ebx, dword [ecx + 4]
or eax, ebx
je 0x408cff
test byte [ecx + 8], 1
je 0x408cff
cmp byte [ecx + 0xf], 9
jb 0x408cff
mov dx, word [ebp - 0x20c]
mov dword [ebp - 0x21c], esi
test dx, dx
je 0x408cc2
lea ecx, [ebp - 0x20c]
lea eax, [ecx + 2]
mov dword [ebp - 0x210], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408ca6
sub ecx, dword [ebp - 0x210]
sar ecx, 1
lea ecx, [ecx*2 + 2]
jmp 0x408cc7
mov ecx, 0xe
push 0
push 4
test dx, dx
lea eax, [ebp - 0x20c]
mov edx, str._NULL_
cmove eax, edx
lea edx, [ebp - 0x21c]
push edx
push ecx
push eax
push 0xf
push str.setKeyAndValue
push 0x1c
push 0x43d36c
push 0x2b
push ebx
push edi
call fcn.0041bd20
add esp, 0x30
test esi, esi
jg 0x408d07
mov edi, esi
jmp 0x408d10
movzx edi, si
or edi, 0x80070000
test edi, edi
js 0x408ea6
mov ebx, dword [ebp - 0x220]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408d23
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
push 0
push dword [ebp - 0x214]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x408e10
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x408dff
mov edi, dword [ecx]
mov eax, edi
mov edx, dword [ecx + 4]
or eax, edx
mov dword [ebp - 0x210], edx
je 0x408dff
test byte [ecx + 8], 1
je 0x408dff
cmp byte [ecx + 0xf], 9
jb 0x408dff
movzx edx, word [ebx]
mov dword [ebp - 0x21c], esi
test dx, dx
je 0x408dc3
mov ecx, ebx
lea eax, [ecx + 2]
mov dword [ebp - 0x214], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408da7
sub ecx, dword [ebp - 0x214]
sar ecx, 1
lea ecx, [ecx*2 + 2]
jmp 0x408dc8
mov ecx, 0xe
push 0
push 4
test dx, dx
mov eax, str._NULL_
lea edx, [ebp - 0x21c]
push edx
push ecx
cmovne eax, ebx
push eax
push 0xf
push str.setKeyAndValue
push 0x1d
push 0x43d36c
push 0x2b
push dword [ebp - 0x210]
push edi
call fcn.0041bd20
add esp, 0x30
test esi, esi
jg 0x408e07
mov edi, esi
jmp 0x408e10
movzx edi, si
or edi, 0x80070000
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, eax
test esi, esi
je 0x408ea6
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x408e72
mov edi, dword [ecx]
mov eax, edi
mov edx, dword [ecx + 4]
or eax, edx
je 0x408e72
test byte [ecx + 8], 1
je 0x408e72
cmp byte [ecx + 0xf], 9
jb 0x408e72
push 0
push 4
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], esi
push eax
push 0xf
push str.setKeyAndValue
push 0x1e
push 0x43d36c
push 0x2b
push edx
push edi
call fcn.0041bd20
add esp, 0x28
test esi, esi
jg 0x408e8b
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043624e
mov esp, ebp
pop ebp
ret 0x14
pop edi
movzx eax, si
pop esi
or eax, 0x80070000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043624e
mov esp, ebp
pop ebp
ret 0x14
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043624e
mov esp, ebp
pop ebp
ret 0x14
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x408ef8
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x408ef8
test byte [ecx + 8], 1
je 0x408ef8
cmp byte [ecx + 0xf], 9
jb 0x408ef8
push 0
push 0xf
push str.setKeyAndValue
push 0x1b
push 0x43d36c
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x20
mov ecx, dword [ebp - 4]
mov eax, 0x80070057
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043624e
mov esp, ebp
pop ebp
ret 0x14