Function at 0x40593e
Capabilities:
Set registry value

Disassembly:
push ebp
push ebx
push edi
mov edx, 0x11
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x405946
call fcn.0048afd0
mov edx, dword [esp + 0x58]
lea ecx, [esp]
call fcn.00441000
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 4]
call fcn.00441000
mov edx, dword [esp + 0x60]
lea ecx, [esp + 8]
call fcn.00441000
mov dword [esp + 0x10], 0x20006
cmp dword [esp + 0x68], 0
je 0x40599b
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00488710
call fcn.0048b030
mov edx, 0x547a00
call fcn.00441330
mov ecx, eax
call fcn.00441340
je 0x405a01
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push dword [esp + 8]
call fcn.00488780
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.004887b0
lea eax, [esp + 4]
push eax
call fcn.0048af00
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.004887b0
call fcn.0048b030
mov edx, 0x547a00
call fcn.00441330
mov ecx, eax
call fcn.00441340
je 0x405a67
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
push dword [esp + 8]
call fcn.00488780
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00488710
lea eax, [esp + 4]
push eax
call fcn.0048af00
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x405ae4
mov ebx, dword [esp + 0x64]
cmp ebx, 3
je 0x405a8d
push 0x561fa0
push 0x24
push dword [esp + 0x74]
call fcn.00489d20
jmp 0x405ae4
mov ebp, dword [esp + 0x6c]
mov dword [ebp], 0
mov ebp, dword [esp + 0x6c]
mov dword [ebp + 8], 0
mov ebp, dword [esp + 0x6c]
mov edx, 0x545028
lea ecx, [ebp + 0xc]
call fcn.00441008
mov ebp, dword [esp + 0x6c]
mov dword [ebp + 0x10], 0
mov ebp, dword [esp + 0x6c]
lea eax, [ebp + 0x14]
mov dword [eax + 4], 0
mov dword [eax], 0
mov ebp, dword [esp + 0x6c]
mov edx, 0x545028
lea ecx, [ebp + 0x20]
call fcn.00441008
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x1c]
push 0
xor eax, eax
push eax
push 0
push dword [esp + 0x1c]
push dword [esp + 0x74]
call sub.ADVAPI32.dll_RegCreateKeyExW
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x405b64
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x405b4d
push dword [esp + 0xc]
mov ebp, dword [esp + 0x70]
pop dword [ebp + 8]
push edx
call fcn.0048ae60
pop edx
push eax
push dword [esp + 0x10]
call fcn.00406af2
mov ebp, dword [esp + 0x70]
lea eax, [ebp + 0xc]
push eax
call fcn.0048af00
cmp dword [esp + 0x14], 0
je 0x405b5d
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
jmp 0x405f4c
push dword [esp + 0x64]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x405c6f
mov ebx, dword [esp + 0x70]
and ebx, ebx
jne 0x405bb5
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x405ba2
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xfffffffd
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_Required_Ret.RegValue_parameter_not_found_
lea ecx, [ebp + 0xc]
call fcn.00441008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x405f4c
mov ebp, dword [esp + 0x70]
mov eax, dword [ebp + 4]
cdq
push edx
push eax
pop dword [esp + 0x24]
pop dword [esp + 0x24]
mov ebp, dword [esp + 0x70]
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x405c11
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x405bfe
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xfffffffe
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_No_Pointer_to_BINARY_defined_
lea ecx, [ebp + 0xc]
call fcn.00441008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x405f4c
push dword [esp + 0x24]
push dword [esp + 0x24]
pop ebx
pop edi
cmp ebx, 0
jne 0x405c25
cmp edi, 0
je 0x405c29
xor eax, eax
jmp 0x405c2e
mov eax, 1
or eax, eax
je 0x405c46
push dword [esp + 0x1c]
call fcn.00489d30
cdq
push edx
push eax
pop dword [esp + 0x24]
pop dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push eax
push dword [esp + 0x20]
push 3
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x405efe
mov ebx, 4
cmp ebx, dword [esp]
jne 0x405cb0
push dword [esp + 0xc]
call fcn.00488830
mov dword [esp + 0x3c], eax
push 4
lea eax, [esp + 0x40]
push eax
push 4
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x405efe
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x405cf7
push dword [esp + 0xc]
call fcn.00488830
push edx
push eax
pop dword [esp + 0x44]
pop dword [esp + 0x44]
push 8
lea eax, [esp + 0x44]
push eax
push 0xb
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x405efe
mov ebx, 2
cmp ebx, dword [esp]
je 0x405d0b
mov ebx, 1
cmp ebx, dword [esp]
jne 0x405d3e
push dword [esp + 0xc]
call fcn.00488970
mov ebx, eax
add ebx, 2
push ebx
mov eax, dword [esp + 0x10]
push eax
push dword [esp + 0x70]
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x405efe
mov ebx, 7
cmp ebx, dword [esp]
jne 0x405efe
mov eax, 0x54560e
push eax
push dword [esp + 0x10]
call fcn.004889a0
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0
jmp 0x405d69
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x30]
jl 0x405dd7
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
mov eax, 0x54560e
push eax
mov ebx, dword [esp + 0x3c]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.00488a30
lea eax, [esp + 0x38]
push eax
call fcn.0048af00
push dword [esp + 0x24]
push dword [esp + 0x24]
push 0x19
push dword [esp + 0x40]
call fcn.00488b60
cdq
add dword [esp], eax
adc dword [esp + 4], edx
add dword [esp], 2
adc dword [esp + 4], 0
pop dword [esp + 0x24]
pop dword [esp + 0x24]
inc dword [esp + 0x30]
jno 0x405d69
push dword [esp + 0x24]
push dword [esp + 0x24]
pop ebx
pop edi
cmp ebx, 0
jne 0x405def
cmp edi, 0
jne 0x405def
xor eax, eax
jmp 0x405df4
mov eax, 1
or eax, eax
je 0x405efe
mov eax, dword [esp + 0x20]
push eax
call fcn.00489d90
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x405eca
mov dword [esp + 0x30], 0
jmp 0x405e1f
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x30]
jl 0x405e95
push edx
call fcn.0048ae60
pop edx
push eax
push edx
call fcn.0048ae60
pop edx
push eax
mov eax, 0x54560e
push eax
mov ebx, dword [esp + 0x3c]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.00488a30
lea eax, [esp + 0x38]
push eax
call fcn.0048af00
push 0x19
push 0xffffffff
push dword [esp + 0x3c]
mov ebx, dword [esp + 0x28]
add ebx, dword [esp + 0x44]
push ebx
call fcn.00489db0
mov ebx, dword [esp + 0x38]
push 0x19
push dword [esp + 0x38]
call fcn.00488b60
add ebx, eax
add ebx, 2
mov dword [esp + 0x38], ebx
inc dword [esp + 0x30]
jno 0x405e1f
sub esp, 4
mov eax, dword [esp + 0x24]
push eax
push dword [esp + 0x24]
push dword [esp + 0x74]
push 0
push dword [esp + 0x1c]
push dword [esp + 0x30]
call dword [0x635288]
add esp, 4
mov dword [esp + 0x10], eax
push dword [esp + 0x1c]
call fcn.00489f00
jmp 0x405efe
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x405eee
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.00441008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x405f4c
pop eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 0xc], 0
je 0x405f44
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x405f40
push dword [esp + 0xc]
mov ebp, dword [esp + 0x70]
pop dword [ebp + 8]
push edx
call fcn.0048ae60
pop edx
push eax
push dword [esp + 0x10]
call fcn.00406af2
mov ebp, dword [esp + 0x70]
lea eax, [ebp + 0xc]
push eax
call fcn.0048af00
xor eax, eax
jmp 0x405f4c
mov eax, dword [esp + 0x28]
jmp 0x405f4c
push dword [esp + 0x30]
call fcn.0048b060
push dword [esp]
call fcn.0048b060
push dword [esp + 8]
call fcn.0048b060
push dword [esp + 4]
call fcn.0048b060
add esp, 0x44
pop edi
pop ebx
pop ebp
ret 0x1c