Function at 0x41d4a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52ab88
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x588790]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov edi, str._ZRegedit::WriteKeyValue_Start
mov dword [ebp - 4], 2
call fcn.00408b90
mov edi, dword [ebp + 0x58]
mov eax, edi
cmp edi, 0x12
jb 0x41d4f4
mov eax, 0x12
cmp dword [ebp + 0x5c], 0x10
mov edx, dword [ebp + 0x48]
jae 0x41d500
lea edx, [ebp + 0x48]
push eax
mov ecx, str.HKEY_LOCAL_MACHINE
call fcn.00402130
xor esi, esi
add esp, 4
cmp eax, esi
jne 0x41d528
cmp edi, 0x12
jae 0x41d51e
or eax, 0xffffffff
jmp 0x41d526
xor eax, eax
cmp edi, 0x12
setne al
cmp eax, esi
sete al
test al, al
je 0x41d536
mov eax, reloc.OLEAUT32.dll_SysReAllocString
jmp 0x41d597
mov ecx, str.HKEY_CLASSES_ROOT
lea edi, [ebp + 0x48]
call fcn.00404da0
test al, al
je 0x41d54e
mov eax, SysReAllocStringLen
jmp 0x41d597
mov ecx, str.HKEY_CURRENT_USER
lea edi, [ebp + 0x48]
call fcn.00404da0
test al, al
je 0x41d566
mov eax, SysReAllocStringLen
jmp 0x41d597
mov ecx, str.HKEY_USERS
lea edi, [ebp + 0x48]
call fcn.00404da0
test al, al
je 0x41d57e
mov eax, SysReAllocStringLen
jmp 0x41d597
mov ecx, str.HKEY_CURRENT_CONFIG
lea edi, [ebp + 0x48]
call fcn.00404da0
test al, al
mov eax, VariantClear
jne 0x41d597
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x34]
lea ecx, [ebp - 0x30]
push ecx
push 0xf003f
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41d8c5
mov ecx, str.REG_SZ
lea edi, [ebp + 0x10]
call fcn.00404da0
test al, al
jne 0x41d7d4
mov ecx, 0x5369a8
call fcn.00404da0
test al, al
jne 0x41d7d4
mov ecx, str.REG_EXPAND_SZ
call fcn.00404da0
test al, al
jne 0x41d739
mov ecx, 0x5369c8
call fcn.00404da0
test al, al
jne 0x41d739
mov ecx, str.REG_DWORD
call fcn.00404da0
test al, al
jne 0x41d69c
mov ecx, 0x53b3d8
call fcn.00404da0
test al, al
jne 0x41d69c
mov ecx, str.REG_BINARY
call fcn.00404da0
test al, al
jne 0x41d63f
mov ecx, 0x53b3e8
call fcn.00404da0
test al, al
je 0x41d6cd
lea edx, [ebp + 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.00420c20
cmp dword [eax + 0x14], 8
jb 0x41d652
mov eax, dword [eax]
push 4
push eax
mov eax, dword [ebp - 0x30]
push 3
push esi
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, 1
lea ecx, [ebp - 0x2c]
sete bl
call fcn.00401c30
test bl, bl
je 0x41d6cd
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x10]
call fcn.00404390
lea ecx, [ebp + 0x2c]
call fcn.00404390
lea ecx, [ebp + 0x48]
call fcn.00404390
jmp 0x41d916
cmp dword [ebp + 0x40], 0x10
mov eax, dword [ebp + 0x2c]
jae 0x41d6a8
lea eax, [ebp + 0x2c]
push eax
call fcn.00505760
add esp, 4
push 4
lea edx, [ebp - 0x34]
push edx
push 4
push esi
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, 1
je 0x41d675
mov edx, dword [ebp - 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, str._ZRegedit::WriteKeyValue_End
call fcn.00408b90
mov edi, 0x10
cmp dword [ebp + 0x24], edi
jb 0x41d6f7
mov eax, dword [ebp + 0x10]
push eax
call fcn.004ad85d
add esp, 4
mov ebx, 0xf
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x20], esi
mov byte [ebp + 0x10], 0
cmp dword [ebp + 0x40], edi
jb 0x41d717
mov ecx, dword [ebp + 0x2c]
push ecx
call fcn.004ad85d
add esp, 4
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x3c], esi
mov byte [ebp + 0x2c], 0
cmp dword [ebp + 0x5c], edi
jb 0x41d732
mov edx, dword [ebp + 0x48]
push edx
call fcn.004ad85d
add esp, 4
mov al, 1
jmp 0x41d918
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x34], esp
push 0xffffffffffffffff
push esi
lea edx, [ebp + 0x2c]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], esi
push edx
mov byte [ecx], 0
call fcn.00404580
lea eax, [ebp - 0x2c]
push eax
call fcn.004208f0
add esp, 0x20
push eax
lea ecx, [ebp + 0x2c]
mov byte [ebp - 4], 4
call fcn.00404500
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 0x10
jb 0x41d789
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004ad85d
add esp, 4
lea edx, [ebp + 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.00420c20
mov edi, 8
cmp dword [eax + 0x14], edi
jb 0x41d7a0
mov eax, dword [eax]
mov edx, dword [ebp - 0x30]
push 0x104
push eax
push 2
push esi
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, 1
sete bl
cmp dword [ebp - 0x18], edi
jb 0x41d671
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004ad85d
add esp, 4
jmp 0x41d671
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x34], esp
push 0xffffffffffffffff
push esi
lea edx, [ebp + 0x2c]
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], esi
push edx
mov byte [ecx], 0
call fcn.00404580
lea eax, [ebp - 0x2c]
push eax
call fcn.004208f0
add esp, 0x20
push eax
lea ecx, [ebp + 0x2c]
mov byte [ebp - 4], 3
call fcn.00404500
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 0x10
jb 0x41d824
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.004ad85d
add esp, 4
lea edx, [ebp + 0x2c]
lea ecx, [ebp - 0x2c]
call fcn.00420c20
mov edi, 8
cmp dword [eax + 0x14], edi
jb 0x41d83b
mov eax, dword [eax]
mov edx, dword [ebp + 0x3c]
lea ecx, [edx + edx]
mov edx, dword [ebp - 0x30]
push ecx
push eax
push 1
push esi
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, 1
sete bl
cmp dword [ebp - 0x18], edi
jb 0x41d868
mov eax, dword [ebp - 0x2c]
push eax
call fcn.004ad85d
add esp, 4
test bl, bl
je 0x41d6cd
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x10
cmp dword [ebp + 0x24], edi
jb 0x41d890
mov edx, dword [ebp + 0x10]
push edx
call fcn.004ad85d
add esp, 4
mov ebx, 0xf
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x20], esi
mov byte [ebp + 0x10], 0
cmp dword [ebp + 0x40], edi
jb 0x41d8b0
mov eax, dword [ebp + 0x2c]
push eax
call fcn.004ad85d
add esp, 4
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x3c], esi
mov byte [ebp + 0x2c], 0
cmp dword [ebp + 0x5c], edi
jb 0x41d916
mov ecx, dword [ebp + 0x48]
push ecx
jmp 0x41d90e
mov edi, 0x10
cmp dword [ebp + 0x24], edi
jb 0x41d8db
mov eax, dword [ebp + 0x10]
push eax
call fcn.004ad85d
add esp, 4
mov ebx, 0xf
mov dword [ebp + 0x24], ebx
mov dword [ebp + 0x20], esi
mov byte [ebp + 0x10], 0
cmp dword [ebp + 0x40], edi
jb 0x41d8fb
mov ecx, dword [ebp + 0x2c]
push ecx
call fcn.004ad85d
add esp, 4
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x3c], esi
mov byte [ebp + 0x2c], 0
cmp dword [ebp + 0x5c], edi
jb 0x41d916
mov edx, dword [ebp + 0x48]
push edx
call fcn.004ad85d
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00503edf
mov esp, ebp
pop ebp
ret