Function at 0x41a9d2
Capabilities:
Set registry value

Disassembly:
push 0x2c
mov eax, 0x4696c1
call fcn.004506ab
mov esi, ecx
mov ecx, dword [esi + 0x74]
call fcn.00413b17
mov ecx, dword [esi + 0x7c]
call fcn.0041d91c
mov ecx, dword [esi + 0x84]
call fcn.0042baa3
mov ecx, dword [esi + 0x80]
call fcn.004190c4
mov ecx, dword [esi + 0x88]
call fcn.0040717b
mov ecx, dword [esi + 0x8c]
call fcn.00406774
mov ecx, dword [esi + 0x90]
call fcn.00406dce
mov ecx, dword [esi + 0x78]
call fcn.00414559
push 0xa
lea ecx, [ebp - 0x38]
call fcn.00401ed9
mov ecx, dword [esi + 0x80]
lea eax, [ebp - 0x10]
push eax
xor edi, edi
lea eax, [ebp - 0x14]
push eax
add ecx, 0x1c4
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
call fcn.00435ba0
movzx eax, word [ebp - 0x10]
movzx ecx, word [ebp - 0x14]
shl eax, 0x10
or eax, ecx
je 0x41aa75
push eax
lea ecx, [ebp - 0x38]
call fcn.0041cd48
mov ecx, dword [esi + 0x80]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
add ecx, 0x74
call fcn.00435ba0
movzx ebx, word [ebp - 0x10]
movzx eax, word [ebp - 0x14]
shl ebx, 0x10
or ebx, eax
je 0x41aac2
push edi
push ebx
lea ecx, [ebp - 0x38]
call fcn.0041ca4e
lea ecx, [ebp - 0x38]
test eax, eax
je 0x41aabc
or dword [ebp - 4], 0xffffffff
call fcn.00401efc
xor eax, eax
call fcn.00450783
ret
push ebx
call fcn.0041cd48
mov ecx, dword [esi + 0x74]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
add ecx, 0x174
call fcn.00435ba0
movzx ebx, word [ebp - 0x10]
movzx eax, word [ebp - 0x14]
shl ebx, 0x10
or ebx, eax
je 0x41aafe
push edi
push ebx
lea ecx, [ebp - 0x38]
call fcn.0041ca4e
lea ecx, [ebp - 0x38]
test eax, eax
jne 0x41aaab
push ebx
call fcn.0041cd48
mov ecx, dword [esi + 0x74]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
add ecx, 0x78
call fcn.00435ba0
movzx ebx, word [ebp - 0x10]
movzx eax, word [ebp - 0x14]
shl ebx, 0x10
or ebx, eax
je 0x41ab3b
push edi
push ebx
lea ecx, [ebp - 0x38]
call fcn.0041ca4e
lea ecx, [ebp - 0x38]
test eax, eax
jne 0x41aaab
push ebx
call fcn.0041cd48
mov ecx, dword [esi + 0x78]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
add ecx, 0xc8
call fcn.00435ba0
movzx ebx, word [ebp - 0x10]
movzx eax, word [ebp - 0x14]
shl ebx, 0x10
or ebx, eax
je 0x41ab7b
push edi
push ebx
lea ecx, [ebp - 0x38]
call fcn.0041ca4e
lea ecx, [ebp - 0x38]
test eax, eax
jne 0x41aaab
push ebx
call fcn.0041cd48
mov ecx, dword [esi + 0x78]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
add ecx, 0x74
call fcn.00435ba0
movzx ebx, word [ebp - 0x10]
movzx eax, word [ebp - 0x14]
shl ebx, 0x10
or ebx, eax
je 0x41abb8
push edi
push ebx
lea ecx, [ebp - 0x38]
call fcn.0041ca4e
lea ecx, [ebp - 0x38]
test eax, eax
jne 0x41aaab
push ebx
call fcn.0041cd48
mov ecx, dword [esi + 0x84]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
add ecx, 0xcc
call fcn.00435ba0
movzx ebx, word [ebp - 0x10]
movzx eax, word [ebp - 0x14]
shl ebx, 0x10
or ebx, eax
je 0x41abfb
push edi
push ebx
lea ecx, [ebp - 0x38]
call fcn.0041ca4e
lea ecx, [ebp - 0x38]
test eax, eax
jne 0x41aaab
push ebx
call fcn.0041cd48
mov ecx, dword [esi + 0x7c]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
add ecx, 0x74
call fcn.00435ba0
movzx ebx, word [ebp - 0x10]
movzx eax, word [ebp - 0x14]
shl ebx, 0x10
or ebx, eax
je 0x41ac47
push edi
push ebx
lea ecx, [ebp - 0x38]
call fcn.0041ca4e
test eax, eax
je 0x41ac3e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.00401efc
mov eax, edi
jmp 0x41aab6
push ebx
lea ecx, [ebp - 0x38]
call fcn.0041cd48
call dword [0x46d87c]
push edi
push str.HideW32
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, edi
je 0x41ac74
push 0x7bd
push 0x7ba
push dword [0x48e7e0]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esi + 0x88]
push dword [eax + 0x74]
mov ecx, 0x48ec1c
call fcn.00413af5
mov ebx, dword [0x46d06c]
test eax, eax
mov eax, dword [esi + 0x88]
je 0x41ad31
add eax, 0x74
push eax
mov ecx, 0x48ec1c
call fcn.00402735
push edi
lea eax, [ebp - 0x18]
push str.PFHide
push eax
mov dword [ebp - 0x18], edi
call fcn.00428cd6
add esp, 0xc
test eax, eax
je 0x41ad05
mov eax, dword [esi + 0x88]
lea ecx, [eax + 0x74]
mov eax, dword [ecx]
mov eax, dword [eax - 0xc]
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402262
mov ecx, dword [ebp - 0x1c]
inc ecx
push ecx
push eax
push 1
push edi
push 0x4729cc
push dword [ebp - 0x18]
call ebx
mov ecx, dword [esi + 0x88]
push 0xffffffffffffffff
add ecx, 0x74
call fcn.004064f0
push dword [ebp - 0x18]
call dword [0x46d004]
push edi
push edi
push edi
push 0xfffffffffffffffe
push edi
push fcn.00429cd9
call fcn.0043c3b9
mov eax, dword [esi + 0x88]
mov eax, dword [eax + 0x74]
cmp dword [eax - 0xc], 5
jge 0x41ad53
push 0x48e488
call dword [0x46d1c8]
jmp 0x41ad53
mov eax, dword [eax + 0x74]
cmp dword [eax - 0xc], 4
jle 0x41ad53
call fcn.00428ff6
test eax, eax
jne 0x41ad53
push edi
push edi
push edi
push 0xfffffffffffffffe
push edi
push fcn.00429cd9
call fcn.0043c3b9
mov eax, dword [esi + 0x88]
push dword [eax + 0x7c]
mov ecx, 0x48ec24
call fcn.00413af5
test eax, eax
jne 0x41adcd
mov eax, dword [esi + 0x88]
push dword [eax + 0x78]
mov ecx, 0x48ec20
call fcn.00413af5
test eax, eax
jne 0x41adcd
mov esi, dword [esi + 0x88]
mov eax, dword [esi + 0x78]
cmp dword [eax - 0xc], edi
jg 0x41ad9b
mov eax, dword [esi + 0x7c]
cmp dword [eax - 0xc], edi
jle 0x41af7d
call fcn.00429065
test eax, eax
jne 0x41af7d
push edi
push edi
push edi
push 0xfffffffffffffffe
push edi
push fcn.00429ec5
call fcn.0043c3b9
push edi
push edi
push edi
push 0xfffffffffffffffe
push edi
push fcn.00429dcf
call fcn.0043c3b9
jmp 0x41af7d
mov eax, dword [esi + 0x88]
add eax, 0x78
push eax
mov ecx, 0x48ec20
call fcn.00402735
mov eax, dword [esi + 0x88]
add eax, 0x7c
push eax
mov ecx, 0x48ec24
call fcn.00402735
push edi
lea eax, [ebp - 0x18]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push str.SOFTWAREU_HIDEPFHide
push 0x80000002
mov dword [ebp - 0x18], edi
call dword [0x46d068]
test eax, eax
jne 0x41ae97
mov eax, dword [esi + 0x88]
lea ecx, [eax + 0x78]
mov eax, dword [ecx]
mov eax, dword [eax - 0xc]
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402262
mov ecx, dword [ebp - 0x1c]
inc ecx
push ecx
push eax
push 1
push edi
push str.FOLDER
push dword [ebp - 0x18]
call ebx
mov ecx, dword [esi + 0x88]
push 0xffffffffffffffff
add ecx, 0x78
call fcn.004064f0
mov eax, dword [esi + 0x88]
lea ecx, [eax + 0x7c]
mov eax, dword [ecx]
mov eax, dword [eax - 0xc]
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402262
mov ecx, dword [ebp - 0x1c]
inc ecx
push ecx
push eax
push 1
push edi
push str.FILE
push dword [ebp - 0x18]
call ebx
mov ecx, dword [esi + 0x88]
push 0xffffffffffffffff
add ecx, 0x7c
call fcn.004064f0
push dword [ebp - 0x18]
call dword [0x46d004]
push edi
lea eax, [ebp - 0x18]
push str.PFHide
push eax
call fcn.00428cd6
add esp, 0xc
test eax, eax
je 0x41af2a
mov eax, dword [esi + 0x88]
lea ecx, [eax + 0x78]
mov eax, dword [ecx]
mov eax, dword [eax - 0xc]
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402262
mov ecx, dword [ebp - 0x1c]
inc ecx
push ecx
push eax
push 1
push edi
push str.FOLDER
push dword [ebp - 0x18]
call ebx
mov ecx, dword [esi + 0x88]
push 0xffffffffffffffff
add ecx, 0x78
call fcn.004064f0
mov eax, dword [esi + 0x88]
lea ecx, [eax + 0x7c]
mov eax, dword [ecx]
mov eax, dword [eax - 0xc]
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402262
mov ecx, dword [ebp - 0x1c]
inc ecx
push ecx
push eax
push 1
push edi
push str.FILE
push dword [ebp - 0x18]
call ebx
mov ecx, dword [esi + 0x88]
push 0xffffffffffffffff
add ecx, 0x7c
call fcn.004064f0
push dword [ebp - 0x18]
call dword [0x46d004]
push edi
push edi
push edi
push 0xfffffffffffffffe
push edi
push fcn.00429dcf
call fcn.0043c3b9
push edi
push edi
push edi
push 0xfffffffffffffffe
push edi
push fcn.00429ec5
call fcn.0043c3b9
mov esi, dword [esi + 0x88]
mov eax, dword [esi + 0x7c]
cmp dword [eax - 0xc], edi
jne 0x41af6b
mov eax, dword [esi + 0x78]
cmp dword [eax - 0xc], edi
jne 0x41af6b
push 0x48e590
call dword [0x46d1c8]
push edi
push edi
push 0x1000
push 0x8000000
call dword [0x46d490]
cmp dword [0x48eaa4], edi
je 0x41af96
push edi
push edi
push edi
push edi
push edi
push 0x429b32
call fcn.0043c3b9
jmp 0x41afa2
push dword [0x48e58c]
call dword [0x46d1c4]
xor edi, edi
inc edi
jmp 0x41ac2b