Function at 0x40b2f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
push str.String
push esi
call fcn.00423160
pop ecx
test eax, eax
pop ecx
jne 0x40b314
push 1
jmp 0x40b351
push str.Unexpanded_String
push esi
call fcn.00423160
pop ecx
test eax, eax
pop ecx
jne 0x40b329
push 2
jmp 0x40b351
push str.Multiple_Strings
push esi
call fcn.00423160
pop ecx
test eax, eax
pop ecx
jne 0x40b33e
push 7
jmp 0x40b351
push str.DWORD
push esi
call fcn.00423160
pop ecx
test eax, eax
pop ecx
jne 0x40b354
push 4
pop esi
jmp 0x40b36d
push str.Binary_Hex
push esi
call fcn.00423160
mov esi, eax
pop ecx
neg esi
sbb esi, esi
pop ecx
and esi, 0xfffffffe
add esi, 3
push 0x5c
push dword [ebp + 8]
call fcn.0041c440
xor ebx, ebx
pop ecx
cmp eax, ebx
pop ecx
je 0x40b387
and byte [eax], bl
lea ecx, [eax + 1]
mov dword [ebp - 4], ecx
push str._Default_
push dword [ebp + 0xc]
call fcn.00423160
pop ecx
test eax, eax
pop ecx
jne 0x40b3a1
mov dword [ebp + 0xc], 0x42ab8c
push dword [ebp + 8]
call fcn.0040b257
mov edi, eax
pop ecx
cmp edi, ebx
mov dword [ebp - 0x10], edi
je 0x40b724
dec esi
je 0x40b678
dec esi
je 0x40b61d
dec esi
je 0x40b47e
dec esi
je 0x40b446
sub esi, 3
jne 0x40b724
mov esi, dword [ebp + 0x10]
push esi
call fcn.0041c080
inc eax
push eax
call fcn.0041b1a2
pop ecx
mov ebx, eax
test eax, eax
pop ecx
je 0x40b724
xor edi, edi
mov cl, byte [esi]
test cl, cl
je 0x40b412
cmp cl, 0xd
jne 0x40b406
and byte [eax], 0
jmp 0x40b40d
cmp cl, 0xa
je 0x40b40f
mov byte [eax], cl
inc eax
inc edi
inc esi
jmp 0x40b3f6
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40b440
push edi
push ebx
push 7
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
jmp 0x40b612
push dword [ebp + 0x10]
call fcn.0041c910
mov dword [ebp - 0x14], eax
pop ecx
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40b724
push dword [ebp + 0x10]
call fcn.0041c080
pop ecx
lea eax, [ebp - 0x14]
push 4
push eax
push 4
jmp 0x40b70e
mov esi, dword [ebp + 0x10]
push esi
call fcn.0041c080
inc eax
add eax, eax
push eax
call fcn.0041b1a2
pop ecx
cmp eax, ebx
pop ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp + 8], ebx
je 0x40b724
cmp byte [esi], 0
je 0x40b5dd
mov edi, dword [sym.imp.USER32.dll_CharUpperA]
cmp byte [esi + 2], 0x20
jne 0x40b554
and byte [esi + 2], 0
push esi
call edi
mov cl, byte [esi]
cmp dword [0x4280dc], 1
mov bl, byte [esi + 1]
mov byte [ebp + 0x13], cl
jle 0x40b4e6
movzx eax, cl
push 4
push eax
call fcn.0041cb23
pop ecx
pop ecx
mov cl, byte [ebp + 0x13]
jmp 0x40b4f5
mov edx, dword [str.________________________________H]
movzx eax, cl
mov al, byte [edx + eax*2]
and eax, 4
test eax, eax
jne 0x40b4fc
add cl, 9
shl cl, 4
cmp dword [0x4280dc], 1
mov byte [ebp + 0x13], cl
jle 0x40b51a
movzx eax, bl
push 4
push eax
call fcn.0041cb23
pop ecx
pop ecx
jmp 0x40b529
mov ecx, dword [str.________________________________H]
movzx eax, bl
mov al, byte [ecx + eax*2]
and eax, 4
test eax, eax
jne 0x40b532
add bl, 0xc9
jmp 0x40b535
add bl, 0xd0
add bl, byte [ebp + 0x13]
mov eax, dword [ebp - 8]
inc dword [ebp - 8]
inc dword [ebp + 8]
add esi, 3
mov byte [eax], bl
cmp byte [esi], 0
jne 0x40b4b2
jmp 0x40b5dd
cmp byte [esi + 2], 0
jne 0x40b724
push esi
call edi
mov cl, byte [esi + 1]
cmp dword [0x4280dc], 1
mov bl, byte [esi]
mov byte [ebp + 0x13], cl
jle 0x40b584
movzx eax, bl
push 4
push eax
call fcn.0041cb23
pop ecx
pop ecx
mov cl, byte [ebp + 0x13]
jmp 0x40b593
mov edx, dword [str.________________________________H]
movzx eax, bl
mov al, byte [edx + eax*2]
and eax, 4
test eax, eax
jne 0x40b59a
add bl, 9
shl bl, 4
cmp dword [0x4280dc], 1
jle 0x40b5b8
movzx eax, cl
push 4
push eax
call fcn.0041cb23
pop ecx
pop ecx
mov cl, byte [ebp + 0x13]
jmp 0x40b5c7
mov edx, dword [str.________________________________H]
movzx eax, cl
mov al, byte [edx + eax*2]
and eax, 4
test eax, eax
jne 0x40b5d0
add cl, 0xc9
jmp 0x40b5d3
add cl, 0xd0
mov eax, dword [ebp - 8]
add cl, bl
inc dword [ebp + 8]
mov byte [eax], cl
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40b60f
push dword [ebp + 8]
push dword [ebp - 0xc]
push 3
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc]
call fcn.0041b254
pop ecx
jmp 0x40b724
mov esi, dword [ebp + 0x10]
push 0x3c
push esi
call fcn.0041c440
pop ecx
test eax, eax
pop ecx
je 0x40b651
push 0x3e
push esi
call fcn.0041c440
pop ecx
test eax, eax
pop ecx
je 0x40b651
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.00406596
pop ecx
lea esi, [ebp - 0x208]
pop ecx
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40b724
push esi
call fcn.0041c080
pop ecx
inc eax
push eax
push esi
push 2
jmp 0x40b70e
mov esi, dword [ebp + 0x10]
push 0x3c
push esi
call fcn.0041c440
pop ecx
test eax, eax
pop ecx
je 0x40b6f0
push 0x3e
push esi
call fcn.0041c440
pop ecx
test eax, eax
pop ecx
je 0x40b6f0
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.00406596
push str._Password_
push esi
call fcn.0041c500
add esp, 0x10
test eax, eax
je 0x40b6ea
cmp dword [0x42e56c], ebx
je 0x40b6ea
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.0041c080
pop ecx
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.0041459b
add esp, 0xc
lea esi, [ebp - 0x2d0]
jmp 0x40b6f0
lea esi, [ebp - 0x208]
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40b724
push esi
call fcn.0041c080
pop ecx
inc eax
push eax
push esi
push 1
push ebx
push dword [ebp + 0xc]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret