Function at 0x405600
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x42d0d8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push ebp
push esi
xor esi, esi
push edi
mov ebx, ecx
mov dword [esp + 0x10], 1
mov dword [esp + 0x1c], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0x18], esi
mov eax, dword [0x45e970]
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x24]
lea edx, [esp + 0x20]
push ecx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push edx
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWAREABB_VEI_METRONICA1.00
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x84], 2
mov dword [esp + 0x44], esi
call ebp
cmp eax, esi
jne 0x4056ba
mov edi, dword [esp + 0x20]
push str.RegDb_Key_:HKLMSOFTWAREABB_VEI_METRONICA1.00_r_n
push 0x3c
mov dword [esp + 0x24], edi
call fcn.00404290
add esp, 8
lea eax, [esp + 0x24]
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], esi
push eax
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWAREABB_VEI_METRONICA1.00LOG
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
cmp eax, esi
jne 0x4056de
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x18], ebp
jmp 0x40570d
lea ecx, [esp + 0x14]
mov byte [esp + 0x60], 1
call fcn.00422625
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
lea ecx, [esp + 0x14]
mov byte [esp + 0x60], 1
call fcn.00422625
cmp edi, esi
je 0x4056f7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
add esp, 0x54
ret
push str.RegDb_Key_:HKLMSOFTWAREABB_VEI_METRONICA1.00LOG_r_n
push 0x3c
call fcn.00404290
add esp, 8
push 1
push 0x4623a8
push 1
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x45e0bc
push edi
call esi
test eax, eax
jne 0x4057aa
push str.RegDb_Val_:HKLMSOFTWAREABB_VEI_METRONICA1.00LOGKOD_r_n
push 0x3c
call fcn.00404290
add esp, 8
push 1
push 0x4623a8
push 1
push 0
push str.NKON
push edi
call esi
test eax, eax
jne 0x4057aa
push str.RegDb_Val_:HKLMSOFTWAREABB_VEI_METRONICA1.00LOGNKON_r_n
push 0x3c
call fcn.00404290
add esp, 8
push 1
push 0x4623a8
push 1
push 0
push str.SECNO
push edi
call esi
test eax, eax
jne 0x4057aa
push str.RegDb_Val_:HKLMSOFTWAREABB_VEI_METRONICA1.00LOGSECNO_r_n
push 0x3c
call fcn.00404290
add esp, 8
push 1
push 0x4623a8
push 1
push 0
push 0x45dff4
push edi
call esi
test eax, eax
je 0x4057ce
test ebp, ebp
mov dword [esp + 0x10], 0xffffffff
je 0x405941
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], 0
jmp 0x405941
push str.RegDb_Val_:HKLMSOFTWAREABB_VEI_METRONICA1.00LOGTXT_r_n
push 0x3c
call fcn.00404290
add esp, 8
test ebp, ebp
je 0x4057f0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x18], 0
mov edx, dword [ebx + 0x60]
mov eax, dword [edx + 0x8c]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push 0
push str.root_dirl
push edi
call esi
test eax, eax
je 0x40581c
mov dword [esp + 0x10], 0xffffffff
jmp 0x405941
mov eax, dword [ebx + 0x60]
mov eax, dword [eax + 0x8c]
push eax
push str.RegDb_Val_:root_dir__s_n
push 0x3c
call fcn.00404290
add esp, 0xc
push 4
push str.Admin
push 1
push 0
push str.USERL
push edi
call esi
test eax, eax
je 0x405859
mov dword [esp + 0x10], 0xffffffff
jmp 0x405941
push str.RegDb_Val_:USER_Admin_r_n
push 0x3c
call fcn.00404290
mov ecx, dword [0x4623a4]
add esp, 8
lea edx, [esp + 0x14]
push ecx
push 0x45df70
push edx
call fcn.00420acf
mov eax, dword [esp + 0x20]
add esp, 0xc
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push 0
push str.Langl
push edi
call esi
test eax, eax
je 0x4058a8
mov dword [esp + 0x10], 0xffffffff
jmp 0x405941
mov eax, dword [0x4623a4]
push eax
push str.RegDb_Val_:Lang__d_r_n
push 0x3c
call fcn.00404290
push str.vtnhjybrf
call fcn.00405c50
mov ecx, dword [ebx + 0x60]
lea edx, [esp + 0x50]
mov eax, dword [ecx + 0x94]
mov ecx, dword [eax - 8]
push ecx
push edx
push eax
call fcn.00405ce0
mov eax, dword [ebx + 0x60]
lea edx, [esp + 0x44]
mov ecx, dword [eax + 0x94]
mov eax, dword [ecx - 8]
push eax
lea eax, [esp + 0x60]
push edx
push eax
call fcn.00405b70
add esp, 0x28
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x18]
call fcn.0042271e
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 8]
inc ecx
push ecx
push eax
push 1
push 0
push str.PASSWORDL
push edi
call esi
test eax, eax
je 0x40592d
mov dword [esp + 0x10], 0xffffffff
jmp 0x405941
lea edx, [esp + 0x28]
push edx
push str.RegDb_Val_:PASSWORD__hs_r_n
push 0x3c
call fcn.00404290
add esp, 0xc
test edi, edi
je 0x405956
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
xor esi, esi
mov dword [esp + 0x1c], esi
jmp 0x405960
mov esi, dword [esp + 0x1c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x14]
mov byte [esp + 0x60], 1
call fcn.00422625
mov eax, dword [esp + 0x18]
test eax, eax
je 0x405979
push eax
call edi
test esi, esi
je 0x405980
push esi
call edi
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x54
ret