Function at 0x57c840
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5f5de8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6670f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 0
call fcn.00579a10
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x57c9f5
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 1
push eax
call fcn.0057cae0
add esp, 4
mov edx, dword [eax]
mov ecx, edx
mov byte [ebp - 4], 2
lea eax, [ecx + 2]
mov dword [ebp - 0x3c], eax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x57c8e0
sub ecx, dword [ebp - 0x3c]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x28]
call fcn.00449bc0
mov edx, dword [ebp - 0x40]
or eax, 0xffffffff
mov byte [ebp - 4], 1
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x57c919
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push 0x64528c
lea ecx, [ebp - 0x28]
call fcn.0044ed80
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x57c930
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.0044ed80
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x2001f
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x34]
push eax
push SysStringLen
call fcn.0057b750
test eax, eax
je 0x57c9a7
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0
cmovae eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x34]
push 0
push 0x2001f
push 0
push 0
push eax
push SysStringLen
call fcn.0057a7e0
test eax, eax
je 0x57c9a7
lea ecx, [ebp - 0x28]
call fcn.00449860
mov esi, dword [ebp - 0x34]
xor ebx, ebx
jmp 0x57ca7b
test esi, esi
je 0x57caa4
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x57c9b4
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
mov esi, dword [ebp - 0x34]
push 1
push 0
push dword [ebp - 0x38]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x57c9e8
push esi
call ebx
xor esi, esi
lea ecx, [ebp - 0x28]
call fcn.00449860
jmp 0x57ca74
push 0x2001f
push edi
push SysReAllocString
lea ecx, [ebp - 0x34]
call fcn.0057b750
test eax, eax
je 0x57ca32
push 0
push 0
push 0x2001f
push 0
push 0
push edi
push SysReAllocString
lea ecx, [ebp - 0x34]
call fcn.0057a7e0
test eax, eax
je 0x57ca32
mov esi, dword [ebp - 0x34]
xor ebx, ebx
jmp 0x57ca7b
test esi, esi
je 0x57caae
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x57ca40
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
mov esi, dword [ebp - 0x34]
push 1
push 0
push dword [ebp - 0x38]
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x57ca74
push esi
call ebx
xor esi, esi
xor ebx, ebx
test edi, edi
sete bl
test esi, esi
je 0x57ca86
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0050ed5c
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004b3510
push 0x80004005
call fcn.004b3510
int3