Function at 0x408880
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
mov dword [ebp - 4], 0
test ebx, ebx
je 0x408b1c
cmp dword [ebp + 0xc], esi
je 0x408b1c
cmp dword [ebp + 0x10], esi
je 0x408b1c
push edi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push ebx
push reloc.SHLWAPI.dll_ParseURLW
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
test edi, edi
je 0x408978
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x40895f
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
mov dword [ebp - 0xc], edx
je 0x40895f
test byte [ecx + 8], 1
je 0x40895f
cmp byte [ecx + 0xf], 9
jb 0x40895f
movzx edx, word [ebx]
mov dword [ebp - 8], edi
test dx, dx
je 0x408929
mov ecx, ebx
lea eax, [ecx + 2]
mov dword [ebp + 8], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408910
sub ecx, dword [ebp + 8]
sar ecx, 1
lea ecx, [ecx*2 + 2]
jmp 0x40892e
mov ecx, 0xe
push 0
push 4
test dx, dx
mov eax, str._NULL_
lea edx, [ebp - 8]
push edx
push ecx
cmovne eax, ebx
push eax
push 0xe
push str.WriteRegKeySZ
push 0x10
push 0x43d36c
push 0x2b
push dword [ebp - 0xc]
push esi
call fcn.0041bd20
add esp, 0x30
test edi, edi
jg 0x408967
mov esi, edi
jmp 0x408970
movzx esi, di
or esi, 0x80070000
test esi, esi
js 0x408b11
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408980
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test edi, edi
je 0x408a9c
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x408a8b
mov eax, dword [ecx]
mov edx, dword [ecx + 4]
mov dword [ebp - 8], eax
or eax, edx
mov dword [ebp - 0xc], edx
je 0x408a8b
test byte [ecx + 8], 1
je 0x408a8b
cmp byte [ecx + 0xf], 9
jb 0x408a8b
movzx esi, word [ebx]
mov dword [ebp + 8], edi
test si, si
je 0x408a12
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4089f7
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
mov dword [ebp + 0x10], eax
jmp 0x408a19
mov dword [ebp + 0x10], 0xe
mov eax, dword [ebp + 0xc]
test si, si
mov edx, str._NULL_
cmovne edx, ebx
movzx esi, word [eax]
test si, si
je 0x408a4f
mov ecx, eax
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x408a34
mov eax, dword [ebp + 0xc]
sub ecx, ebx
sar ecx, 1
lea ecx, [ecx*2 + 2]
jmp 0x408a54
mov ecx, 0xe
push 0
push 4
test si, si
mov ebx, str._NULL_
cmovne ebx, eax
lea eax, [ebp + 8]
push eax
push dword [ebp + 0x10]
push edx
push ecx
push ebx
push 0xe
push str.WriteRegKeySZ
push 0x11
push 0x43d36c
push 0x2b
push dword [ebp - 0xc]
push dword [ebp - 8]
call fcn.0041bd20
add esp, 0x38
test edi, edi
jg 0x408a93
mov esi, edi
jmp 0x408a9c
movzx esi, di
or esi, 0x80070000
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
test edi, edi
je 0x408b11
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x408af1
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x408af1
test byte [ecx + 8], 1
je 0x408af1
cmp byte [ecx + 0xf], 9
jb 0x408af1
push 0
push 4
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], edi
push eax
push 0xe
push str.WriteRegKeySZ
push 0x12
push 0x43d36c
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x28
test edi, edi
jg 0x408b00
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
movzx eax, di
pop edi
pop esi
or eax, 0x80070000
pop ebx
mov esp, ebp
pop ebp
ret 0xc
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [0x449ff8]
test ecx, ecx
je 0x408b59
mov esi, dword [ecx]
mov eax, esi
mov edx, dword [ecx + 4]
or eax, edx
je 0x408b59
test byte [ecx + 8], 1
je 0x408b59
cmp byte [ecx + 0xf], 9
jb 0x408b59
push 0
push 0xe
push str.WriteRegKeySZ
push 0xf
push 0x43d36c
push 0x2b
push edx
push esi
call fcn.0041bd20
add esp, 0x20
pop esi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret 0xc