Function at 0x401e2f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x22c], 0
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x108], 0
mov byte [ebp - 0x10c], 0
push 0x101
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x104]
push ecx
call fcn.0041c968
add esp, 4
mov dword [ebp - 0x218], eax
jmp 0x401ed9
mov edx, dword [ebp - 0x218]
sub edx, 1
mov dword [ebp - 0x218], edx
cmp dword [ebp - 0x218], 0
jle 0x401f08
mov eax, dword [ebp - 0x218]
xor ecx, ecx
mov cl, byte [ebp + eax - 0x104]
cmp ecx, 0x5c
jne 0x401f06
mov edx, dword [ebp - 0x218]
mov byte [ebp + edx - 0x103], 0
jmp 0x401f08
jmp 0x401eca
push str.k95g.exe
lea eax, [ebp - 0x104]
push eax
call fcn.0041c8ae
add esp, 8
lea ecx, [ebp - 0x220]
push ecx
push 0x2001f
push 0
push 0x44a300
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401f91
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x220]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push 0x44a308
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x401f74
xor al, al
jmp 0x40237c
cmp dword [ebp - 0x114], 1
je 0x401f91
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x40237c
push 0xe
push 0x44a310
push 1
push 0
push 0x4520c8
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0x13
push str.application_kermit
push 1
push 0
push str.Content_Type
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x220]
push edx
push 0x2001f
push 0
push 0x44a344
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40204d
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x220]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push 0x44a374
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x402030
xor al, al
jmp 0x40237c
cmp dword [ebp - 0x114], 1
je 0x40204d
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x40237c
push 4
push str..KSC
push 1
push 0
push str.Extension
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x220]
push edx
push 0x2001f
push 0
push 0x44a3b8
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4020ec
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x220]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push 0x44a3c8
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4020cf
xor al, al
jmp 0x40237c
cmp dword [ebp - 0x114], 1
je 0x4020ec
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x40237c
push 0x10
push str.C_Kermit_Script
push 1
push 0
push 0x4520cc
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 3
lea ecx, [ebp - 0x104]
push ecx
push str._s__d
lea edx, [ebp - 0x214]
push edx
call fcn.0041c750
add esp, 0x10
push 0x100
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push str.DefaultIcon
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [ebp - 0x22c]
push edx
push 0x2001f
push 0
push 0x44a3fc
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4021ce
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push 0x44a404
mov eax, dword [ebp - 0x220]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4021a4
xor al, al
jmp 0x40237c
cmp dword [ebp - 0x114], 1
je 0x4021ce
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x220]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x40237c
lea eax, [ebp - 0x230]
push eax
push 0x2001f
push 0
push 0x44a40c
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402261
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x230]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push 0x44a414
mov ecx, dword [ebp - 0x22c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40222a
xor al, al
jmp 0x40237c
cmp dword [ebp - 0x114], 1
je 0x402261
mov edx, dword [ebp - 0x230]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x40237c
lea edx, [ebp - 0x228]
push edx
push 0x2001f
push 0
push 0x44a41c
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4022fe
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x228]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push 0x44a424
mov eax, dword [ebp - 0x230]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4022bd
xor al, al
jmp 0x40237c
cmp dword [ebp - 0x114], 1
je 0x4022fe
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x230]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x40237c
lea edx, [ebp - 0x104]
push edx
push str._s____1_
lea eax, [ebp - 0x214]
push eax
call fcn.0041c750
add esp, 0xc
lea ecx, [ebp - 0x214]
push ecx
call fcn.0041c968
add esp, 4
push eax
lea edx, [ebp - 0x214]
push edx
push 1
push 0
push 0x4520d0
mov eax, dword [ebp - 0x228]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x228]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x230]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x220]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov esp, ebp
pop ebp
ret