Function at 0x4061c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push edi
push esi
push ebx
sub esp, 0x6e4
mov dword [esp + 0x2c], ecx
mov ebx, eax
movzx edx, dl
test edx, edx
je 0x4062a9
call fcn.00422fe0
movzx esi, byte [0x56e794]
movzx edi, byte [0x56e796]
movzx edx, byte [ebx]
movzx eax, byte [ebx + 1]
movzx ecx, byte [ebx + 2]
xor edx, esi
mov dword [esp + 0x14], edx
movzx edx, byte [0x56e795]
mov dword [esp + 0x28], edi
xor eax, edx
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx + 3]
xor ecx, edi
movzx edi, byte [0x56e798]
mov dword [esp + 0x18], ecx
movzx ecx, byte [0x56e797]
xor eax, ecx
movzx ecx, byte [0x56e799]
mov dword [esp + 0x10], eax
movzx eax, byte [ebx + 4]
movzx ebx, byte [ebx + 5]
xor eax, edi
mov dword [esp + 0x20], eax
xor ebx, ecx
mov dword [esp + 0x24], ebx
mov ebx, 1
test esi, esi
mov eax, ebx
jne 0x40625e
mov eax, 0
test edx, edx
movzx esi, byte [0x56e797]
je 0x40626e
mov eax, 1
cmp dword [esp + 0x28], 0
je 0x40627a
mov eax, 1
test esi, esi
je 0x406283
mov eax, 1
test edi, edi
je 0x40628c
mov eax, 1
test ecx, ecx
cmovne eax, ebx
movzx eax, al
test eax, eax
jne 0x40656a
add esp, 0x6e4
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
lea eax, [esp + 0x695]
mov edx, ebx
call fcn.00407220
movsd xmm0, qword [0x53ec3c]
movsd qword [esp + 0x6b5], xmm0
movzx esi, word [0x53ec44]
mov word [esp + 0x6bd], si
mov al, byte [0x53ec46]
mov byte [esp + 0x6bf], al
pxor xmm0, xmm0
movaps xmmword [esp + 0x6c0], xmm0
lea eax, [esp + 0x610]
call fcn.004252d0
lea eax, [esp + 0x610]
mov edx, str.0420
mov ecx, 4
call fcn.00401c90
lea eax, [esp + 0x610]
lea edx, [esp + 0x6b5]
mov ecx, 0xb
call fcn.00401c90
lea eax, [esp + 0x610]
mov edx, str.0420
mov ecx, 4
call fcn.00401c90
lea ebx, [esp + 0x695]
mov edx, ebx
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x40636c
mov eax, edx
add edx, ecx
call fcn.00425520
mov ecx, eax
lea eax, [esp + 0x610]
mov edx, ebx
call fcn.00401c90
lea eax, [esp + 0x6c0]
lea edx, [esp + 0x610]
call fcn.00408c90
movzx edi, byte [esp + 0x6ca]
movzx esi, byte [esp + 0x6cb]
movzx ebx, byte [esp + 0x6cc]
movzx ecx, byte [esp + 0x6cd]
movzx edx, byte [esp + 0x6ce]
movzx eax, byte [esp + 0x6cf]
push eax
push edx
push ecx
push ebx
push esi
push edi
movzx eax, byte [esp + 0x6e1]
push eax
movzx edx, byte [esp + 0x6e4]
push edx
movzx ecx, byte [esp + 0x6e7]
push ecx
movzx ebx, byte [esp + 0x6ea]
push ebx
movzx esi, byte [esp + 0x6ed]
push esi
movzx edi, byte [esp + 0x6f0]
push edi
movzx eax, byte [esp + 0x6f3]
push eax
movzx edx, byte [esp + 0x6f6]
push edx
movzx ecx, byte [esp + 0x6f9]
push ecx
movzx ebx, byte [esp + 0x6fc]
push ebx
push str._.2X_.2X_.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X_.2X_.2X_.2X_.2X
lea esi, [esp + 0x6b2]
push esi
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x48
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x410]
call fcn.004224a0
mov edi, eax
mov edx, dword [ebp + 0x14]
lea eax, [esp + 0x510]
call fcn.004224a0
mov ebx, eax
test ebx, ebx
je 0x4064cd
movsx eax, byte [ebx]
test eax, eax
je 0x4064cd
call fcn.00422e10
test eax, eax
je 0x406485
lea esi, [esp + 0x695]
mov dword [esp + 0xc], esi
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov edx, edi
mov ecx, ebx
call fcn.00406800
lea esi, [esp + 0x10]
mov dword [esp + 0x210], ebx
push 0x5428fc
push edi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4065c4
sub ebx, edi
push ebx
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
push 0
push 0x542830
add esi, ebx
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0x18
lea edi, [ebx + edi + 1]
jmp 0x406490
mov edx, dword [ebp + 0x18]
lea eax, [esp + 0x510]
call fcn.004224a0
mov ebx, eax
test ebx, ebx
je 0x40629c
movsx eax, byte [ebx]
test eax, eax
je 0x40629c
call fcn.00422e10
test eax, eax
je 0x406518
lea esi, [esp + 0x66e]
mov dword [esp + 0xc], esi
lea edx, [esp + 0x410]
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, ebx
call fcn.00406800
lea edi, [esp + 0x410]
lea esi, [esp + 0x210]
mov dword [esp + 0x6d4], ebx
push 0x5428fc
push edi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4066d4
sub ebx, edi
push ebx
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
push 0
push 0x542830
add esi, ebx
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0x18
lea edi, [ebx + edi + 1]
jmp 0x40652d
mov ecx, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov byte [esp + 0x66d], cl
mov ecx, dword [esp + 0x1c]
mov byte [esp + 0x66c], bl
mov ebx, dword [esp + 0x14]
mov byte [esp + 0x66b], al
mov byte [esp + 0x66a], dl
mov byte [esp + 0x669], cl
mov byte [esp + 0x668], bl
lea eax, [esp + 0x695]
lea edx, [esp + 0x668]
call fcn.00407220
jmp 0x4062b7
mov ebx, dword [esp + 0x210]
mov edx, edi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x4065f1
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
call fcn.00401b70
mov esi, eax
cmp dword [0x56e6a8], 0
jne 0x406645
pxor xmm0, xmm0
movq qword [0x56e660], xmm0
movd dword [0x56e668], xmm0
mov dword [0x56e660], 0xc
call fcn.00407150
mov dword [0x56e664], eax
mov eax, 1
mov dword [0x56e668], eax
mov dword [0x56e6a8], eax
mov eax, 0xf013f
mov edx, 0xf003f
test esi, esi
cmovne edx, eax
lea esi, [esp + 0x6d0]
xor ecx, ecx
push ecx
push esi
push 0x56e660
push edx
push ecx
push ecx
push ecx
lea edi, [esp + 0x2c]
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4064cd
lea esi, [esp + 0x695]
mov edx, esi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x4066ad
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push esi
push 1
push 0
push ebx
push dword [esp + 0x6e4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x6d0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4064cd
mov ebx, dword [esp + 0x6d4]
mov edx, edi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x406701
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
call fcn.00401b70
mov esi, eax
cmp dword [0x56e6a8], 0
jne 0x406755
pxor xmm0, xmm0
movq qword [0x56e660], xmm0
movd dword [0x56e668], xmm0
mov dword [0x56e660], 0xc
call fcn.00407150
mov dword [0x56e664], eax
mov eax, 1
mov dword [0x56e668], eax
mov dword [0x56e6a8], eax
mov eax, 0xf013f
mov edx, 0xf003f
test esi, esi
cmovne edx, eax
lea esi, [esp + 0x6d4]
xor ecx, ecx
push ecx
push esi
push 0x56e660
push edx
push ecx
push ecx
push ecx
lea edi, [esp + 0x22c]
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40629c
lea edx, [esp + 0x66e]
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x4067be
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
lea edx, [esp + 0x672]
push edx
push 1
push 0
push ebx
push dword [esp + 0x6e8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [esp + 0x6d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x6e4
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret