Function at 0x474e30
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0x10]
mov dword [esp], ecx
push ebx
push ebp
push esi
push edi
test edx, edx
je 0x4750fb
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x4750fb
cmp edi, 0xfffffffe
je 0x4750fb
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x24]
push eax
mov eax, dword [0x4d89c0]
push 0
mov eax, dword [eax + 0xd0]
or eax, 0x20006
push eax
push 0
push 0x4c602c
push 0
push dword [esp + 0x40]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x475100
dec edi
cmp edi, 6
ja case.0x474ea0.5
jmp dword [edi*4 + 0x475130]
mov edx, dword [esp + 0x2c]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x474eb0
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push dword [esp + 0x38]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x20]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x475100
mov edx, dword [esp + 0x2c]
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x474ef4
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 2
jmp 0x474eca
mov ebx, dword [esp + 0x2c]
mov esi, ebx
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x474f20
sub esi, ecx
sar esi, 1
lea eax, [esi*2 + 4]
push eax
call fcn.00495d48
mov edi, eax
add esp, 4
test edi, edi
jne 0x474f59
push dword [esp + 0x20]
mov esi, 0xe
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x475100
push esi
push ebx
push edi
call fcn.0049ef24
xor eax, eax
lea ecx, [esi + esi]
add esp, 0xc
mov dword [ecx + edi], eax
test esi, esi
je 0x474f80
cmp word [ecx + edi - 2], 0xa
jne 0x474f80
dec esi
lea ecx, [esi + esi]
mov word [ecx + edi], ax
cmp word [edi], 0
mov eax, edi
je 0x474f9c
cmp word [eax], 0xa
jne 0x474f93
xor edx, edx
mov word [eax], dx
add eax, 2
cmp word [eax], 0
jne 0x474f88
neg esi
lea eax, [ecx + 4]
sbb esi, esi
and esi, eax
push esi
push edi
push 7
push 0
push dword [esp + 0x38]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call fcn.00495d53
add esp, 4
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x475100
mov ecx, dword [esp + 0x2c]
cmp word [ecx], 0
je 0x474ff4
call fcn.00403e60
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push 4
push eax
push 4
jmp 0x474eca
push 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0
push eax
push 4
jmp 0x474eca
mov ebp, dword [esp + 0x2c]
mov edi, ebp
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x475013
sub edi, ecx
sar edi, 1
mov eax, edi
and eax, 0x80000001
jns 0x475030
dec eax
or eax, 0xfffffffe
inc eax
jne case.0x474ea0.5
mov eax, edi
cdq
sub eax, edx
sar eax, 1
push eax
mov dword [esp + 0x28], eax
call fcn.00495d48
add esp, 4
mov dword [esp + 0x2c], eax
test eax, eax
je 0x474f45
xor ebx, ebx
xor esi, esi
test edi, edi
jle 0x4750b7
nop
cmp ebx, dword [esp + 0x24]
jge 0x4750b7
xor ecx, ecx
lea edx, [ecx + 0x10]
nop dword [eax + eax]
movzx eax, word [ebp + esi*2]
cmp eax, 0x30
jb 0x475084
cmp eax, 0x39
ja 0x475084
sub eax, 0x30
jmp 0x4750a0
cmp eax, 0x41
jb 0x475093
cmp eax, 0x46
ja 0x475093
sub eax, 0x37
jmp 0x4750a0
cmp eax, 0x61
jb 0x4750e5
cmp eax, 0x66
ja 0x4750e5
sub eax, 0x57
imul eax, edx
inc esi
add ecx, eax
sub edx, 0xf
jns 0x475070
mov eax, dword [esp + 0x2c]
mov byte [ebx + eax], cl
inc ebx
cmp esi, edi
jl 0x475060
push ebx
push eax
push 3
push 0
push dword [esp + 0x38]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x2c]
mov esi, eax
call fcn.00495d53
add esp, 4
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x475100
push dword [esp + 0x2c]
call fcn.00495d53
add esp, 4
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x57
mov ecx, dword [esp + 0x10]
test esi, esi
push esi
setne al
movzx eax, al
push eax
call fcn.00435120
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x14
push dword [esp + 0x20]
mov esi, 0x57
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x475100