Function at 0xf737465
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
push ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 8], 0xffffffff
push esi
push edi
mov edi, str.TypeLib
call fcn.0f72fd9a
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [ebp - 0xbc]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0xf7b3478
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [ebp - 0xbc]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push str.TypeLib
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, pe_nt_image_headers32
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call edi
sub esi, eax
push 0xf7b3478
call edi
sub esi, eax
push esi
push str.TypeLib
call edi
mov esi, eax
push 0xf7b3478
call edi
add esi, eax
mov ebx, dword [ebp + 8]
lea eax, [ebp + esi - 0xbc]
lea ecx, [ebx + 0x10]
push eax
push ecx
call fcn.0f73c4d0
push 0x10
lea eax, [ebp - 0x3c]
push eax
mov edi, 0xf7b3468
movzx ecx, word [ebx + 0xc]
push ecx
call dword [sym.imp.MSVCRT20.dll__ultoa]
add esp, 0xc
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [ebp - 0x3c]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x10
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x3c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [ebx + 0x24]
lea eax, [ecx + ebp - 0x3d]
movzx ecx, word [ebx + 0xe]
push eax
push ecx
call dword [sym.imp.MSVCRT20.dll__ultoa]
add esp, 0xc
mov ecx, esi
call fcn.0f733f83
push dword [ebx + 8]
lea ecx, [ebp - 0x1c]
call fcn.0f733fd2
push esi
lea ecx, [ebp - 0x1c]
call fcn.0f734059
mov esi, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xbc]
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0xf74b0f5
mov edi, eax
test eax, eax
jne 0xf737761
mov esi, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x3c]
push ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0xf74b0fd
mov edi, eax
test eax, eax
jne 0xf737761
mov edx, dword [ebx]
mov ecx, 0xffffffff
mov edi, edx
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push 1
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov edi, eax
test edi, edi
jne 0xf74b110
lea ecx, [ebp - 0x1c]
call fcn.0f732c7a
mov edi, eax
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [ebp - 0x1c]
call fcn.0f732c7a
push eax
push 1
push str.HelpDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov edi, eax
test edi, edi
jne 0xf74b110
push 0x10
lea eax, [ebp - 0xbc]
push eax
lea edi, [ebp - 0xbc]
movzx ecx, word [ebx + 0x20]
push ecx
call dword [sym.imp.MSVCRT20.dll__ultoa]
add esp, 0xc
mov ecx, 0xffffffff
sub eax, eax
lea edx, [ebp - 0xbc]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push 1
push str.Flags
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov edi, eax
test edi, edi
jne 0xf74b110
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0xc]
push eax
push 0xf7b3424
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edi, eax
test edi, edi
jne 0xf74b105
mov edx, dword [ebx + 4]
mov esi, 0xffffffff
mov edi, edx
mov ecx, esi
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, esi
push ecx
push edx
push 1
push str.win32
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov edi, eax
test edi, edi
jne 0xf74b110
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov dword [ebp - 0xc], esi
test edi, edi
jne 0xf74b110
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov dword [ebp - 4], esi
test edi, edi
jne 0xf74b110
mov ax, word [ebx + 0xe]
mov cx, word [ebx + 0xc]
push eax
push ecx
push dword [ebp - 8]
call fcn.0f7394c8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov dword [ebp - 8], esi
test edi, edi
jne 0xf74b110
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0xf74b154
test edi, edi
jne 0xf74b110
lea ecx, [ebp - 0x1c]
call fcn.0f730793
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 8], esi
jmp 0xf7375d5
mov dword [ebp - 4], esi
jmp 0xf7375fb
mov dword [ebp - 0xc], esi
test edi, edi
je 0xf7376d2
cmp dword [ebp - 4], 0xffffffff
je 0xf74b11f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], 0xffffffff
je 0xf74b12e
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0xffffffff
je 0xf74b13d
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.0f73a9de
mov esi, eax
lea ecx, [ebp - 0x1c]
call fcn.0f730793
mov eax, esi
jmp 0xf737773
lea ecx, [ebp - 0x1c]
call fcn.0f732c7a
push eax
push dword [0xf7b8990]
call fcn.0f72a15c
mov dword [esi], eax
test eax, eax
jne 0xf737761
mov edi, 6
jmp 0xf737761