Function at 0x4025f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42b806
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x438040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [ebp - 0x424], ebx
cmp byte [ebx + 0x14], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
jne 0x40267d
mov eax, dword [ebx + 4]
cmp dword [eax - 0xc], 0
jle 0x402673
lea ecx, [ebp - 0x414]
mov dword [ebp - 0x414], 0
push ecx
push eax
push dword [ebx + 0x18]
call esi
test eax, eax
jne 0x402673
mov ecx, dword [ebx]
test ecx, ecx
je 0x402663
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x414]
mov dword [ebx], ecx
test eax, eax
jne 0x402673
mov byte [ebx + 0x14], 1
cmp byte [ebx + 0x14], 0
je 0x4028eb
xor edi, edi
lea eax, [ebp - 0x414]
mov dword [ebp - 4], edi
push eax
push 0x433e5c
push dword [ebx]
mov dword [ebp - 0x414], edi
call esi
test eax, eax
mov eax, dword [ebx + 0xc]
cmove edi, dword [ebp - 0x414]
xor ecx, ecx
sub eax, dword [ebx + 8]
sar eax, 2
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x414], ecx
test eax, eax
jle 0x4028e0
lea eax, [ebp - 0x410]
test ecx, ecx
jle 0x4026e0
push ecx
push str.Directory_d
push 0x3ff
push eax
call fcn.00404220
add esp, 0x10
jmp 0x4026f3
push str.Directory
push 0x3ff
push eax
call fcn.00404220
add esp, 0xc
call fcn.00401920
test eax, eax
je 0x402907
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
mov dword [ebp - 0x428], eax
lea esi, [eax + 0x10]
mov dword [ebp - 0x418], esi
lea eax, [ebp - 0x410]
mov byte [ebp - 4], 1
test eax, 0xffff0000
jne 0x402813
movzx ecx, ax
call fcn.00403e70
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x402838
lea edx, [ebp - 0x410]
movzx ecx, dx
shr ecx, 4
push 6
inc ecx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edx, eax
test edx, edx
je 0x402838
lea ecx, [ebp - 0x410]
movzx eax, cx
mov ecx, dword [ebp - 0x41c]
push eax
call fcn.00403e00
add esp, 4
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x402838
movzx ecx, word [eax]
add eax, 2
push 0
push 0
push 0
push 0
push ecx
push eax
push 0
push 3
mov dword [ebp - 0x420], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, eax
test ebx, ebx
js 0x402911
mov ecx, dword [ebp - 0x428]
mov edx, 1
sub edx, dword [ecx + 0xc]
mov ecx, dword [ecx + 8]
sub ecx, ebx
or ecx, edx
jge 0x4027db
push ebx
lea ecx, [ebp - 0x418]
call fcn.004014a0
mov esi, dword [ebp - 0x418]
mov eax, dword [ebp - 0x41c]
push 0
push 0
push ebx
movzx eax, word [eax]
push esi
push eax
push dword [ebp - 0x420]
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp ebx, dword [esi - 8]
jg 0x402911
mov dword [esi - 0xc], ebx
mov byte [ebx + esi], 0
mov ebx, dword [ebp - 0x424]
jmp 0x402838
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402816
sub eax, edx
lea ecx, [ebp - 0x418]
push eax
lea eax, [ebp - 0x410]
push eax
call fcn.00403650
mov esi, dword [ebp - 0x418]
lea edx, [ebp - 0x418]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x42c]
call fcn.00401100
mov ecx, dword [ebx + 8]
mov ebx, dword [ebp - 0x414]
mov eax, dword [eax]
mov dword [ebp - 0x420], eax
mov ebx, dword [ecx + ebx*4]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0
push dword [ebp - 0x420]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x42c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4028a0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4028bc
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x424]
mov ecx, dword [ebp - 0x414]
inc ecx
mov dword [ebp - 0x414], ecx
mov eax, dword [ebx + 0xc]
sub eax, dword [ebx + 8]
sar eax, 2
cmp ecx, eax
jl 0x4026c0
test edi, edi
je 0x4028eb
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040f784
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004016f0
push 0x80070057
call fcn.004016f0
int3