Function at 0x402b00
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47b0c6
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x1124
call fcn.0045b380
mov eax, dword [0x493040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x112c], ecx
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1134], eax
lea eax, [ebp - 0x1014]
push eax
mov dword [ebp - 0x1018], ecx
mov dword [ebp - 0x1128], ebx
mov dword [ebp - 0x1124], edi
call fcn.004029a0
test eax, eax
js 0x4030b6
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x1014]
push str.SMDB
push eax
call esi
test eax, eax
jne 0x402b8e
lea esi, [eax + 8]
jmp 0x402bd7
push 0x48f540
lea eax, [ebp - 0x1014]
push eax
call esi
test eax, eax
jne 0x402ba7
mov esi, 0x4008
jmp 0x402bd7
push 0x48f544
lea eax, [ebp - 0x1014]
push eax
call esi
test eax, eax
jne 0x402bbe
lea esi, [eax + 0x13]
jmp 0x402bd7
push 0x48f548
lea eax, [ebp - 0x1014]
push eax
call esi
test eax, eax
jne 0x4030b1
lea esi, [eax + 0x11]
mov ecx, dword [ebp - 0x112c]
call fcn.00402950
mov ecx, dword [ebp - 0x112c]
lea eax, [ebp - 0x1014]
push eax
call fcn.004029a0
test eax, eax
js 0x4030b6
cmp esi, 0x13
ja 0x402f26
je 0x402dbe
cmp esi, 8
je 0x402d8d
cmp esi, 0x11
jne 0x403095
lea ebx, [ebp - 0x1014]
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x402c26
sub ebx, ecx
mov dword [ebp - 0x101c], ebx
test bl, 1
jne 0x402cd5
mov eax, ebx
cdq
sub eax, edx
mov esi, eax
lea eax, [ebp - 0x1120]
push 0x104
push 0
sar esi, 1
push eax
mov dword [ebp - 0x1130], esi
call fcn.0045c980
add esp, 0xc
mov dword [ebp - 0x1120], 0
mov dword [ebp - 4], 4
mov byte [ebp - 4], 5
cmp esi, 0x100
jbe 0x402cba
push esi
lea ecx, [ebp - 0x1120]
call fcn.0040b3a0
mov eax, dword [ebp - 0x1120]
jmp 0x402cc6
lea eax, [ebp - 0x111c]
mov dword [ebp - 0x1120], eax
test eax, eax
jne 0x402cdf
lea ecx, [ebp - 0x1120]
call fcn.0040b380
mov eax, 0x80004005
jmp 0x4030b6
push esi
push 0
push eax
call fcn.0045c980
add esp, 0xc
xor edi, edi
test ebx, ebx
jle 0x402d4a
mov dl, byte [ebp + edi - 0x1014]
mov esi, edi
shr esi, 1
add esi, dword [ebp - 0x1120]
movsx eax, dl
add eax, 0xffffffd0
cmp eax, 0x36
ja case.0x402d14.58
movzx eax, byte [eax + 0x4030f4]
jmp dword [eax*4 + 0x4030e4]
sub dl, 0x30
jmp 0x402d2c
sub dl, 0x37
jmp 0x402d2c
sub dl, 0x57
jmp 0x402d2c
xor dl, dl
mov eax, edi
mov ecx, 4
and eax, 1
inc edi
shl eax, 2
sub ecx, eax
shl dl, cl
or byte [esi], dl
cmp edi, ebx
jl 0x402cf1
mov esi, dword [ebp - 0x1130]
mov eax, dword [ebp - 0x1128]
push esi
push dword [ebp - 0x1120]
push 3
push 0
push dword [ebp - 0x1124]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
lea eax, [ebp - 0x111c]
cmp dword [ebp - 0x1120], eax
je 0x403088
lea ecx, [ebp - 0x1120]
call fcn.0040b380
jmp 0x403088
lea ecx, [ebp - 0x1014]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402d96
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x1014]
push eax
push 1
push 0
push edi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
jmp 0x403088
xor esi, esi
mov dword [ebp - 0x1018], esi
lea ecx, [ebp - 0x1014]
mov dword [ebp - 4], 3
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402dd6
sub ecx, edx
lea eax, [ecx + 1]
mov ecx, 2
imul ecx
mov edi, eax
test edx, edx
jg 0x402e81
jl 0x402e01
cmp edi, 0x7fffffff
ja 0x402e81
cmp edx, 0xffffffff
jl 0x402e81
jg 0x402e10
cmp edi, 0x80000000
jb 0x402e81
cmp edi, 0x400
jg 0x402e31
mov ecx, edi
call fcn.004011e0
test al, al
je 0x402e31
mov eax, edi
call fcn.0045b2a0
mov dword [ebp - 0x10], esp
mov ebx, esp
jmp 0x402e59
mov eax, edi
not eax
cmp eax, 8
jb 0x4030da
lea eax, [edi + 8]
push eax
call fcn.004602a5
add esp, 4
test eax, eax
je 0x402e81
mov dword [eax], 0
lea ebx, [eax + 8]
mov esi, eax
test ebx, ebx
je 0x402e81
shr edi, 1
xor eax, eax
push edi
push ebx
push 0xffffffffffffffff
mov word [ebx], ax
lea eax, [ebp - 0x1014]
push eax
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
neg eax
sbb eax, eax
and eax, ebx
jmp 0x402e83
xor eax, eax
test eax, eax
jne 0x402ea9
test esi, esi
je 0x402e9f
nop dword [eax + eax]
push esi
mov esi, dword [esi]
call fcn.004600e5
add esp, 4
test esi, esi
jne 0x402e90
mov eax, 0x8007000e
jmp 0x4030b6
lea ecx, [ebp - 0x101c]
push ecx
push 0
push 0
push eax
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov edi, eax
test edi, edi
jns 0x402edb
test esi, esi
je 0x402ed4
push esi
mov esi, dword [esi]
call fcn.004600e5
add esp, 4
test esi, esi
jne 0x402ec5
mov eax, edi
jmp 0x4030b6
mov eax, dword [ebp - 0x101c]
push 4
mov dword [ebp - 0x1018], eax
lea eax, [ebp - 0x1018]
push eax
mov eax, dword [ebp - 0x1128]
push 4
push 0
push dword [ebp - 0x1124]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, eax
test esi, esi
je 0x403088
push esi
mov esi, dword [esi]
call fcn.004600e5
add esp, 4
test esi, esi
jne 0x402f12
jmp 0x403088
cmp esi, 0x4008
jne 0x403095
lea ecx, [ebp - 0x1014]
lea edx, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402f40
sub ecx, edx
lea eax, [ebp - 0x1120]
push 0x104
push 0
push eax
lea esi, [ecx + 2]
call fcn.0045c980
add esp, 0xc
mov dword [ebp - 0x1120], 0
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
cmp esi, 0x100
jbe 0x402fad
push esi
lea ecx, [ebp - 0x1120]
call fcn.0040b3a0
mov edi, dword [ebp - 0x1120]
jmp 0x402fb9
lea edi, [ebp - 0x111c]
mov dword [ebp - 0x1120], edi
test edi, edi
je 0x40306e
cmp byte [ebp - 0x1014], 0
lea esi, [ebp - 0x1014]
je 0x403011
mov ebx, dword [sym.imp.USER32.dll_CharNextA]
push esi
call ebx
mov cl, byte [esi]
cmp cl, 0x5c
jne 0x402fef
cmp byte [eax], 0x30
jne 0x402fef
push eax
mov byte [edi], 0
call ebx
mov esi, eax
jmp 0x40300b
mov byte [edi], cl
movzx eax, byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x40300a
mov al, byte [esi + 1]
inc esi
inc edi
test al, al
je 0x403011
mov byte [edi], al
inc esi
inc edi
cmp byte [esi], 0
jne 0x402fd6
mov word [edi], 0
mov edi, dword [ebp - 0x1120]
test edi, edi
jne 0x403025
lea ebx, [edi + 0xd]
jmp 0x403073
xor esi, esi
mov edx, edi
nop dword [eax]
mov ecx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x403035
sub ecx, ebx
lea eax, [ecx + 1]
add edx, eax
add esi, eax
cmp eax, 1
jne 0x403030
mov eax, dword [ebp - 0x1128]
push esi
push edi
push 7
push 0
push dword [ebp - 0x1124]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [ebp - 0x1120]
mov ebx, eax
jmp 0x403073
mov ebx, 0xe
lea eax, [ebp - 0x111c]
cmp edi, eax
je 0x403088
lea ecx, [ebp - 0x1120]
call fcn.0040b380
test ebx, ebx
je 0x403095
mov ecx, ebx
call fcn.004013d0
jmp 0x4030b6
push dword [ebp - 0x1134]
mov ecx, dword [ebp - 0x112c]
call fcn.004029a0
xor ecx, ecx
test eax, eax
cmovs ecx, eax
mov eax, ecx
jmp 0x4030b6
mov eax, 0x80020009
lea esp, [ebp - 0x1144]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045a978
mov esp, ebp
pop ebp
ret 0xc
push 0x80070216
call fcn.004012c0
sbb ebp, dword [0x2d200040]
inc eax
add byte [0x2a00402d], ah
sub eax, 0x40
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add dword [ecx], eax
add dword [ecx], eax
add dword [ebx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add al, byte [edx]
add al, byte [edx]
add cl, ah
int3