Function at 0x407d8d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
push str.String
push esi
call fcn.0041a1a0
pop ecx
test eax, eax
pop ecx
jne 0x407db1
push 1
jmp 0x407dee
push str.Unexpanded_String
push esi
call fcn.0041a1a0
pop ecx
test eax, eax
pop ecx
jne 0x407dc6
push 2
jmp 0x407dee
push str.Multiple_Strings
push esi
call fcn.0041a1a0
pop ecx
test eax, eax
pop ecx
jne 0x407ddb
push 7
jmp 0x407dee
push str.DWORD
push esi
call fcn.0041a1a0
pop ecx
test eax, eax
pop ecx
jne 0x407df1
push 4
pop esi
jmp 0x407e0a
push str.Binary_Hex
push esi
call fcn.0041a1a0
mov esi, eax
pop ecx
neg esi
sbb esi, esi
pop ecx
and esi, 0xfffffffe
add esi, 3
mov edi, dword [ebp + 8]
push 0x5c
push edi
call fcn.00414320
xor ebx, ebx
pop ecx
cmp eax, ebx
pop ecx
je 0x407e25
and byte [eax], bl
lea ecx, [eax + 1]
mov dword [ebp - 8], ecx
push str._Default_
push dword [ebp + 0xc]
call fcn.0041a1a0
pop ecx
test eax, eax
pop ecx
jne 0x407e3f
mov dword [ebp + 0xc], 0x420548
push str.HKEY_CLASSES_ROOT
push edi
call fcn.0041a1a0
pop ecx
test eax, eax
pop ecx
jne 0x407e5c
mov dword [ebp + 8], 0x80000000
jmp 0x407ee0
push str.HKEY_LOCAL_MACHINE
push edi
call fcn.0041a1a0
pop ecx
test eax, eax
pop ecx
jne 0x407e76
mov dword [ebp + 8], 0x80000002
jmp 0x407ee0
push str.HKEY_CURRENT_USER
push edi
call fcn.0041a1a0
pop ecx
test eax, eax
pop ecx
jne 0x407e90
mov dword [ebp + 8], 0x80000001
jmp 0x407ee0
push str.HKEY_USERS
push edi
call fcn.0041a1a0
pop ecx
test eax, eax
pop ecx
jne 0x407eaa
mov dword [ebp + 8], 0x80000003
jmp 0x407ee0
push str.HKEY_CURRENT_CONFIG
push edi
call fcn.0041a1a0
pop ecx
test eax, eax
pop ecx
jne 0x407ec4
mov dword [ebp + 8], 0x80000005
jmp 0x407ee0
push str.HKEY_DYN_DATA
push edi
call fcn.0041a1a0
pop ecx
test eax, eax
pop ecx
jne 0x408208
mov dword [ebp + 8], 0x80000006
dec esi
je 0x40819e
dec esi
je 0x408148
dec esi
je 0x407faf
dec esi
je 0x407f75
sub esi, 3
jne 0x408208
mov esi, dword [ebp + 0x10]
push esi
call fcn.00413dd0
inc eax
push eax
call fcn.004132a2
pop ecx
mov ebx, eax
test eax, eax
pop ecx
je 0x408208
xor edi, edi
mov cl, byte [esi]
test cl, cl
je 0x407f3b
cmp cl, 0xd
jne 0x407f2f
and byte [eax], 0
jmp 0x407f36
cmp cl, 0xa
je 0x407f38
mov byte [eax], cl
inc eax
inc edi
inc esi
jmp 0x407f1f
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x407f69
push edi
push ebx
push 7
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.00413354
pop ecx
jmp 0x408208
push dword [ebp + 0x10]
call fcn.004148bb
mov dword [ebp - 0x14], eax
pop ecx
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x408208
push dword [ebp + 0x10]
call fcn.00413dd0
pop ecx
lea eax, [ebp - 0x14]
push 4
push eax
push 4
jmp 0x4081f2
mov esi, dword [ebp + 0x10]
push esi
call fcn.00413dd0
inc eax
add eax, eax
push eax
call fcn.004132a2
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
je 0x408208
cmp byte [esi], 0
je 0x40810e
mov edi, dword [sym.imp.USER32.dll_CharUpperA]
cmp byte [esi + 2], 0x20
jne 0x408085
and byte [esi + 2], 0
push esi
call edi
mov cl, byte [esi]
cmp dword [0x41dbbc], 1
mov bl, byte [esi + 1]
mov byte [ebp + 0x13], cl
jle 0x408017
movzx eax, cl
push 4
push eax
call fcn.00414aa0
pop ecx
pop ecx
mov cl, byte [ebp + 0x13]
jmp 0x408026
mov edx, dword [str.________________________________H]
movzx eax, cl
mov al, byte [edx + eax*2]
and eax, 4
test eax, eax
jne 0x40802d
add cl, 9
shl cl, 4
cmp dword [0x41dbbc], 1
mov byte [ebp + 0x13], cl
jle 0x40804b
movzx eax, bl
push 4
push eax
call fcn.00414aa0
pop ecx
pop ecx
jmp 0x40805a
mov ecx, dword [str.________________________________H]
movzx eax, bl
mov al, byte [ecx + eax*2]
and eax, 4
test eax, eax
jne 0x408063
add bl, 0xc9
jmp 0x408066
add bl, 0xd0
add bl, byte [ebp + 0x13]
mov eax, dword [ebp - 0xc]
inc dword [ebp - 0xc]
inc dword [ebp - 4]
add esi, 3
mov byte [eax], bl
cmp byte [esi], 0
jne 0x407fe3
jmp 0x40810e
cmp byte [esi + 2], 0
jne 0x408208
push esi
call edi
mov cl, byte [esi + 1]
cmp dword [0x41dbbc], 1
mov bl, byte [esi]
mov byte [ebp + 0x13], cl
jle 0x4080b5
movzx eax, bl
push 4
push eax
call fcn.00414aa0
pop ecx
pop ecx
mov cl, byte [ebp + 0x13]
jmp 0x4080c4
mov edx, dword [str.________________________________H]
movzx eax, bl
mov al, byte [edx + eax*2]
and eax, 4
test eax, eax
jne 0x4080cb
add bl, 9
shl bl, 4
cmp dword [0x41dbbc], 1
jle 0x4080e9
movzx eax, cl
push 4
push eax
call fcn.00414aa0
pop ecx
pop ecx
mov cl, byte [ebp + 0x13]
jmp 0x4080f8
mov edx, dword [str.________________________________H]
movzx eax, cl
mov al, byte [edx + eax*2]
and eax, 4
test eax, eax
jne 0x408101
add cl, 0xc9
jmp 0x408104
add cl, 0xd0
mov eax, dword [ebp - 0xc]
add cl, bl
inc dword [ebp - 4]
mov byte [eax], cl
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x408140
push dword [ebp - 4]
push dword [ebp - 0x10]
push 3
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
jmp 0x407f6a
mov esi, dword [ebp + 0x10]
push 0x3c
push esi
call fcn.00414320
pop ecx
test eax, eax
pop ecx
je 0x40817c
push 0x3e
push esi
call fcn.00414320
pop ecx
test eax, eax
pop ecx
je 0x40817c
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.00404f59
pop ecx
lea esi, [ebp - 0x208]
pop ecx
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x408208
push esi
call fcn.00413dd0
pop ecx
inc eax
push eax
push esi
push 2
jmp 0x4081f2
mov esi, dword [ebp + 0x10]
push 0x3c
push esi
call fcn.00414320
pop ecx
test eax, eax
pop ecx
je 0x4081d2
push 0x3e
push esi
call fcn.00414320
pop ecx
test eax, eax
pop ecx
je 0x4081d2
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.00404f59
pop ecx
lea esi, [ebp - 0x208]
pop ecx
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x408208
push esi
call fcn.00413dd0
pop ecx
inc eax
push eax
push esi
push 1
push ebx
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret