Function at 0x416790
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x4ed018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
push 0x64
mov dword [ebp - 0xd0], eax
lea eax, [ebp - 0xcc]
push 0
push eax
mov dword [ebp - 0xdc], 0
mov dword [ebp - 0xd4], 0
call fcn.00411960
mov eax, dword [ebp + 0x1c]
add esp, 0xc
test esi, esi
je 0x416ad1
cmp dword [ebp - 0xd0], 0
je 0x416ad1
test eax, eax
je 0x416ad1
push 0x32
lea eax, [ebp - 0xcc]
push eax
push esi
call fcn.0041e5a0
add esp, 0xc
test eax, eax
jne 0x416838
push esi
push 0x4a0294
push 1
call fcn.00446b80
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0x14], 0
jne 0x416890
mov eax, dword [ebp + 0x1c]
cmp eax, 4
je 0x41686b
push eax
push 4
push 0x4a02c4
push 1
call fcn.00446b80
add esp, 0x10
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xd0]
test ebx, ebx
push dword [eax]
push esi
mov esi, 0x49e448
mov eax, esi
cmovne eax, ebx
test edi, edi
push eax
mov eax, esi
cmovne eax, edi
push eax
push 0x4a0338
jmp 0x4168b1
push dword [ebp - 0xd0]
test ebx, ebx
push esi
mov esi, 0x49e448
mov eax, esi
cmovne eax, ebx
test edi, edi
push eax
mov eax, esi
cmovne eax, edi
push eax
push 0x4a02f8
push 0x20
call fcn.00446b80
add esp, 0x18
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xd8]
push eax
push 7
push 0x49f010
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00417370
add esp, 0x14
mov dword [ebp - 0xe0], eax
test eax, eax
je 0x416903
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0xe0]
push 0x49f010
push 0x4a0380
jmp 0x416ade
cmp dword [ebp - 0xd4], 1
jne 0x416918
mov eax, 2
mov ecx, 0x4a03c4
jmp 0x416922
mov eax, 0x10
mov ecx, 0x4a03ec
push ecx
push eax
call fcn.00446b80
add esp, 8
test edi, edi
je 0x416a24
push 0x64
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.00411960
add esp, 0xc
test ebx, ebx
je 0x416969
cmp byte [ebx], 0
je 0x416969
push ebx
push edi
push 0x49f2e4
lea eax, [ebp - 0x68]
push 0x32
push eax
call fcn.00419510
add esp, 0x14
mov ebx, 1
jmp 0x41697f
push edi
push 0x49f2f0
lea eax, [ebp - 0x68]
xor ebx, ebx
push 0x32
push eax
call fcn.00419510
add esp, 0x10
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0xdc]
push eax
push 3
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0xd8]
call fcn.00417370
add esp, 0x14
mov dword [ebp - 0xe0], eax
test eax, eax
je 0x4169ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0xe0]
lea eax, [ebp - 0x68]
push eax
push 0x4a041c
push 1
call fcn.00446b80
add esp, 0x14
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0xd4], 1
mov eax, 0x49f33c
jne 0x416a04
mov ecx, 2
mov edx, 0x4a0458
jmp 0x416a0e
mov ecx, 0x10
mov edx, 0x4a0484
test ebx, ebx
cmove eax, esi
lea esi, [ebp - 0x68]
push esi
push eax
push edx
push ecx
call fcn.00446b80
add esp, 0x10
jmp 0x416a33
push 0x4a04b8
push 0x20
call fcn.00446b80
add esp, 8
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x14]
test edx, edx
lea eax, [ecx + ecx]
cmove eax, ecx
mov ecx, 1
push eax
push dword [ebp - 0xd0]
mov eax, 4
cmovne eax, ecx
test edi, edi
push eax
push 0
lea eax, [ebp - 0xcc]
push eax
mov eax, dword [ebp - 0xd8]
cmovne eax, dword [ebp - 0xdc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x416a9d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea eax, [ebp - 0xcc]
push eax
push 0x4a04fc
push 1
call fcn.00446b80
add esp, 0x14
xor ebx, ebx
jmp 0x416aa2
mov ebx, 1
test edi, edi
je 0x416ab2
push dword [ebp - 0xdc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xd8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401bd5
mov esp, ebp
pop ebp
ret
push eax
push dword [ebp - 0xd0]
push esi
push 0x4a0258
push 1
call fcn.00446b80
mov ecx, dword [ebp - 4]
add esp, 0x14
xor ecx, ebp
xor eax, eax
pop edi
pop esi
pop ebx
call fcn.00401bd5
mov esp, ebp
pop ebp
ret