Function at 0x4dc290
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x220]
mov esi, edx
push ebx
sub esp, 0x8cc
mov dword [ebp - 0x8a4], eax
mov eax, ecx
cmp dword [0x58b8e4], 1
lea ecx, [ebp - 0x428]
sbb ebx, ebx
mov dword [esp + 8], eax
mov dword [esp + 0x10], ecx
xor bl, bl
mov dword [esp + 0x14], 0x104
add ebx, 0xf013f
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0x428]
mov edx, edi
sub esp, 0x18
mov eax, ecx
call fcn.004dc1a0
lea edx, [ebp - 0x889]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x104
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
lea edx, [ebp - 0x889]
sub esp, 0x20
cmp esi, 4
je 0x4dc4d0
cmp esi, 2
je 0x4dc540
cmp esi, 1
je 0x4dc5a0
lea eax, [ebp - 0x785]
lea edx, [ebp - 0x57d]
mov dword [ebp - 0x89c], 0
mov dword [ebp - 0x8a0], eax
lea edi, [ebp - 0x890]
mov dword [esp + 4], edx
lea esi, [ebp - 0x681]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
sub esp, 0x24
mov dword [esp + 4], 0x58b7e0
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_strcpy]
mov dword [esp], esi
call sub.msvcrt.dll_strlen
mov ecx, dword [ebp + 0xc]
mov edx, 0x5c
mov word [esi + eax], dx
test ecx, ecx
je 0x4dc4b0
mov dword [esp], esi
call dword [sym.imp.msvcrt.dll_strlen]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x89c]
mov dword [esp + 0xc], 1
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x890]
mov dword [esp + 8], 0
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0x890]
sub esp, 0x18
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
mov eax, dword [ebp - 0x8a0]
sub esp, 4
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov eax, dword [ebp - 0x890]
sub esp, 0x24
mov dword [esp], eax
call sub.advapi32.dll_RegCloseKey
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp - 0x8a4]
lea eax, [esi + eax + 1]
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strcpy
jmp 0x4dc401
mov dword [esp + 8], edx
lea edx, [ebp - 0x57d]
lea edi, [ebp - 0x784]
mov esi, str.SOFTWAREClassesInstallerProducts3D0DAE300FACA1300AD792060BCDAA92
mov dword [esp], edx
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Components_s
mov dword [ebp - 0x8a8], edx
call fcn.004d3c10
mov eax, dword [str.SOFTWAREClassesInstallerProducts3D0DAE300FACA1300AD792060BCDAA92]
lea ecx, [ebp - 0x785]
mov dword [ebp - 0x8a0], ecx
sub ecx, edi
mov dword [ebp - 0x785], eax
mov eax, dword [0x569129]
sub esi, ecx
add ecx, 0x45
shr ecx, 2
mov dword [ebp - 0x744], eax
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x89c], str.3D0DAE300FACA1300AD792060BCDAA92
mov edx, dword [ebp - 0x8a8]
jmp 0x4dc385
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x57d]
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData_sComponents_s
mov dword [esp + 8], eax
mov dword [esp], edx
mov dword [ebp - 0x8a8], edx
call fcn.004d3c10
mov eax, dword [ebp + 8]
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionInstaller_sInstallerProducts7D2F387510109040002000060BECB6AB
mov dword [esp + 8], eax
lea eax, [ebp - 0x785]
mov dword [esp], eax
mov dword [ebp - 0x8a0], eax
call fcn.004d3c10
mov edx, dword [ebp - 0x8a8]
mov dword [ebp - 0x89c], str.7D2F387510109040002000060BECB6AB
jmp 0x4dc385
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x57d]
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserData_sComponents_s
mov dword [esp + 8], eax
mov dword [esp], edx
mov dword [ebp - 0x8a8], edx
call fcn.004d3c10
mov eax, dword [ebp + 8]
mov dword [esp + 4], str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerManaged_sInstallerProducts7D2F387510109040002000060BECB6AB
mov dword [esp + 8], eax
jmp 0x4dc576