Function at 0x40e4a2
Capabilities:
Set registry value

Disassembly:
mov eax, 0x2110
call fcn.004309c0
push ebx
push esi
lea eax, [esp + 0x118]
mov esi, ecx
xor ebx, ebx
mov dword [esp + 8], esi
push eax
mov dword [esp + 0x10], ebx
call fcn.0040ebb1
test eax, eax
js 0x40e7e0
lea edx, [esp + 0xc]
lea ecx, [esp + 0x118]
call fcn.0040e3e9
test eax, eax
jne 0x40e4ed
mov eax, 0x80020009
jmp 0x40e7e0
mov ecx, esi
call fcn.0040f27c
lea eax, [esp + 0x118]
mov ecx, esi
push eax
call fcn.0040ebb1
test eax, eax
js 0x40e7e0
movzx eax, word [esp + 0xc]
push ebp
push edi
push 2
pop edi
sub eax, 8
je 0x40e798
sub eax, 9
je 0x40e66f
sub eax, edi
je 0x40e626
sub eax, 0x3ff5
jne 0x40e7c7
lea ecx, [esp + 0x120]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, edi
cmp ax, bx
jne 0x40e544
sub ecx, edx
mov dword [esp + 0x1c], ebx
sar ecx, 1
lea eax, [ecx + 2]
mul edi
cmp edx, ebx
ja 0x40e7eb
jb 0x40e56e
cmp eax, 0xffffffff
ja 0x40e7eb
cmp eax, 0x100
jbe 0x40e585
push eax
lea ecx, [esp + 0x20]
call fcn.0040ded2
mov esi, dword [esp + 0x1c]
jmp 0x40e58d
lea esi, [esp + 0x20]
mov dword [esp + 0x1c], esi
test esi, esi
je 0x40e5fa
cmp word [esp + 0x120], 0
lea ebx, [esp + 0x120]
je 0x40e5d7
mov ebp, dword [sym.imp.USER32.dll_CharNextW]
push ebx
call ebp
movzx ecx, word [ebx]
cmp ecx, 0x5c
jne 0x40e5c8
push 0x30
pop edx
cmp word [eax], dx
jne 0x40e5c8
xor ecx, ecx
push eax
mov word [esi], cx
call ebp
mov ebx, eax
jmp 0x40e5cd
mov word [esi], cx
add ebx, edi
xor eax, eax
add esi, 2
cmp word [ebx], ax
jne 0x40e5a9
mov ecx, dword [esp + 0x2124]
xor eax, eax
mov dword [esi], eax
push dword [esp + 0x1c]
push dword [esp + 0x212c]
call fcn.0040e449
mov esi, dword [esp + 0x1c]
mov edi, eax
jmp 0x40e5fd
push 0xe
pop edi
lea eax, [esp + 0x20]
cmp esi, eax
je 0x40e60e
lea ecx, [esp + 0x1c]
call fcn.0040dec9
mov esi, dword [esp + 0x10]
test edi, edi
je 0x40e7c7
mov ecx, edi
call fcn.0040eba3
jmp 0x40e7de
lea eax, [esp + 0x14]
push eax
push ebx
push ebx
lea eax, [esp + 0x12c]
push eax
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
test eax, eax
js 0x40e7de
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push 4
push eax
push 4
mov eax, dword [esp + 0x2130]
push ebx
push dword [esp + 0x2138]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
jmp 0x40e612
lea ebx, [esp + 0x120]
xor edx, edx
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, edi
cmp ax, dx
jne 0x40e67b
sub ebx, ecx
sar ebx, 1
test bl, 1
jne 0x40e6d0
mov eax, ebx
xor ecx, ecx
cdq
sub eax, edx
mov dword [esp + 0x1c], ecx
mov esi, eax
sar esi, 1
mov dword [esp + 0x18], esi
cmp esi, 0x100
jbe 0x40e6bb
push esi
lea ecx, [esp + 0x20]
call fcn.0040ded2
mov eax, dword [esp + 0x1c]
xor ecx, ecx
jmp 0x40e6c3
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], eax
test eax, eax
jne 0x40e6da
lea ecx, [esp + 0x1c]
call fcn.0040dec9
mov eax, 0x80004005
jmp 0x40e7de
push esi
push ecx
push eax
call fcn.004183a0
xor eax, eax
add esp, 0xc
mov ebp, eax
test ebx, ebx
jle 0x40e75a
push 0x30
pop esi
movzx ecx, word [esp + ebp*2 + 0x120]
mov eax, ebp
cdq
mov edi, ecx
sub eax, edx
mov edx, ecx
sar eax, 1
add eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
cmp di, si
jb 0x40e738
cmp edi, 0x39
jbe 0x40e733
cmp edi, 0x40
jbe 0x40e738
cmp edi, 0x46
jbe 0x40e72e
cmp edi, 0x60
jbe 0x40e738
cmp edx, 0x66
ja 0x40e738
sub dl, 0x57
jmp 0x40e73c
sub dl, 0x37
jmp 0x40e73c
sub dl, 0x30
jmp 0x40e73c
xor eax, eax
mov dl, al
mov eax, ebp
and eax, 1
shl eax, 2
push 4
pop ecx
sub ecx, eax
mov eax, dword [esp + 0x14]
shl dl, cl
or byte [eax], dl
inc ebp
cmp ebp, ebx
jl 0x40e6f0
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x2124]
xor edx, edx
push esi
push dword [esp + 0x20]
push 3
push edx
push dword [esp + 0x2138]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
lea eax, [esp + 0x20]
cmp dword [esp + 0x1c], eax
je 0x40e60e
lea ecx, [esp + 0x1c]
call fcn.0040dec9
jmp 0x40e60e
lea ecx, [esp + 0x120]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, edi
cmp ax, bx
jne 0x40e7a2
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [esp + 0x124]
push eax
push 1
jmp 0x40e654
push dword [esp + 0x212c]
mov ecx, esi
call fcn.0040ebb1
xor ecx, ecx
test eax, eax
cmovs ecx, eax
mov eax, ecx
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x2110
ret 0xc
push 0x80070216
call fcn.0040e809
int3