Function at 0x402750
Capabilities:
Set registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x5c
mov dword [esp + 0x28], edx
mov dword [esp + 0x48], eax
mov dword [esp + 4], 0x7d2
mov dword [esp], eax
call dword [0x41565c]
sub esp, 8
mov edi, eax
mov dword [esp], eax
call dword [0x41568c]
mov ebx, dword [sym.imp.ucrtbase.dll_malloc]
lea esi, [eax + 1]
sub esp, 4
lea eax, [esi + esi]
mov dword [esp], eax
call ebx
mov dword [esp + 8], esi
mov ebp, eax
mov dword [esp + 4], eax
mov dword [esp], edi
call dword [0x415690]
sub esp, 0xc
mov esi, dword [esp + 0x28]
mov dword [esp + 0x34], eax
mov eax, dword [esi + 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.ucrtbase.dll_free]
mov dword [esp + 0x44], eax
call eax
mov esi, dword [esi + 8]
cmp esi, 7
je 0x402970
ja 0x4027f8
cmp esi, 2
ja 0x402938
test esi, esi
je 0x4028a0
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
lea edi, [ecx + ecx + 2]
mov dword [eax + 0xc], ebp
mov dword [eax + 0x10], edi
jmp 0x402851
cmp esi, 0xb
jne 0x4028a0
mov edi, dword [esp + 0x28]
mov dword [edi + 0x10], 8
mov dword [esp], 8
call ebx
mov esi, dword [0x41400c]
mov edx, str._I64x
mov ecx, str._I64u
mov dword [edi + 0xc], eax
test esi, esi
cmovne edx, ecx
mov dword [esp], ebp
mov dword [esp + 8], eax
mov dword [esp + 4], edx
call fcn.00402700
mov eax, dword [esp + 0x44]
mov dword [esp], ebp
call eax
mov eax, edi
mov edi, dword [edi + 0x10]
mov ebp, dword [eax + 0xc]
mov esi, dword [eax + 8]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0
mov eax, dword [ecx + 4]
mov dword [esp + 4], eax
mov eax, dword [ecx]
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegSetValueExW]
sub esp, 0x18
mov ebx, eax
test eax, eax
jne 0x402910
xor eax, eax
test ebx, ebx
sete al
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebp
mov eax, dword [esp + 0x44]
call eax
mov ebp, dword [0x4156fc]
mov dword [esp], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x401
call ebp
sub esp, 0x10
mov esi, eax
mov eax, dword [esp + 0x28]
mov dword [eax + 0x10], esi
mov dword [esp], esi
call ebx
mov ebx, dword [esp + 0x28]
mov dword [ebx + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp], edi
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x401
call ebp
mov edi, dword [ebx + 0x10]
mov ebp, dword [ebx + 0xc]
sub esp, 0x10
mov esi, dword [ebx + 8]
jmp 0x402851
mov eax, dword [esp + 0x48]
mov dword [esp + 4], 0x7da
mov dword [esp], eax
call fcn.004026d0
xor eax, eax
test ebx, ebx
sete al
add esp, 0x5c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp esi, 4
jne 0x4028a0
mov edi, dword [esp + 0x28]
mov dword [edi + 0x10], 4
mov dword [esp], 4
call ebx
mov edx, dword [0x41400c]
mov ecx, 0x411200
mov dword [edi + 0xc], eax
test edx, edx
mov edx, 0x411208
jmp 0x40282a
mov edi, dword [esp + 0x34]
lea eax, [edi + edi + 4]
mov dword [esp], eax
call ebx
mov dword [esp + 0x3c], eax
test edi, edi
je 0x402a60
xor ecx, ecx
xor eax, eax
xor edi, edi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x38], ebp
jmp 0x4029b9
mov eax, dword [esp + 0x2c]
lea edi, [ebp + ebp]
mov ecx, ebp
mov word [eax], dx
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
cmp eax, edx
jae 0x402a18
mov edx, dword [esp + 0x38]
lea ebx, [eax + eax]
mov dword [esp + 0x40], ebx
mov ebx, dword [esp + 0x3c]
lea esi, [eax + 1]
mov dword [esp + 0x30], esi
lea ebp, [ecx + 1]
movzx edx, word [edx + eax*2]
add ebx, edi
mov dword [esp + 0x2c], ebx
cmp dx, 0xd
jne 0x4029a0
mov esi, dword [esp + 0x38]
mov ebx, dword [esp + 0x40]
cmp word [esi + ebx + 2], 0xa
jne 0x4029a0
mov ebx, dword [esp + 0x3c]
add eax, 2
cmp word [ebx + edi - 2], 0
je 0x4029b1
mov ecx, dword [esp + 0x2c]
lea edi, [ebp + ebp]
xor ebx, ebx
mov word [ecx], bx
mov ecx, ebp
jmp 0x4029b1
mov eax, dword [esp + 0x3c]
mov esi, dword [esp + 0x4c]
mov ebp, dword [esp + 0x38]
lea edx, [eax + edi]
lea eax, [edi + 2]
add edi, 4
mov ebx, dword [esp + 0x3c]
xor ecx, ecx
mov word [edx], cx
xor edx, edx
mov word [ebx + eax], dx
mov eax, dword [esp + 0x44]
mov dword [esp], ebp
mov ebp, ebx
call eax
mov eax, dword [esp + 0x28]
mov dword [eax + 0xc], ebx
mov dword [eax + 0x10], edi
jmp 0x402851
mov edx, dword [esp + 0x3c]
mov edi, 4
mov eax, 2
jmp 0x402a2d