Function at 0x6bdda5
Capabilities:
Set registry value

Disassembly:
push ebp
push ebx
push edi
mov edx, 0x11
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x6bddad
call fcn.004159e0
mov edx, dword [esp + 0x58]
lea ecx, [esp]
call fcn.004011b0
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 4]
call fcn.004011b0
mov edx, dword [esp + 0x60]
lea ecx, [esp + 8]
call fcn.004011b0
mov dword [esp + 0x10], 0x20006
cmp dword [esp + 0x68], 0
je 0x6bde02
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00413f50
call fcn.00415b40
mov edx, 0x523cb6
call fcn.00401210
mov ecx, eax
call fcn.00401230
je 0x6bde68
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push dword [esp + 8]
call fcn.00413fc0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00414940
lea eax, [esp + 4]
push eax
call fcn.00415900
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00414940
call fcn.00415b40
mov edx, 0x523cb6
call fcn.00401210
mov ecx, eax
call fcn.00401230
je 0x6bdece
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
push dword [esp + 8]
call fcn.00413fc0
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00413f50
lea eax, [esp + 4]
push eax
call fcn.00415900
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x6bdf4b
mov ebx, dword [esp + 0x64]
cmp ebx, 3
je 0x6bdef4
push 0x53d538
push 0x24
push dword [esp + 0x74]
call fcn.00415290
jmp 0x6bdf4b
mov ebp, dword [esp + 0x6c]
mov dword [ebp], 0
mov ebp, dword [esp + 0x6c]
mov dword [ebp + 8], 0
mov ebp, dword [esp + 0x6c]
mov edx, 0x521028
lea ecx, [ebp + 0xc]
call fcn.004011b8
mov ebp, dword [esp + 0x6c]
mov dword [ebp + 0x10], 0
mov ebp, dword [esp + 0x6c]
lea eax, [ebp + 0x14]
mov dword [eax + 4], 0
mov dword [eax], 0
mov ebp, dword [esp + 0x6c]
mov edx, 0x521028
lea ecx, [ebp + 0x20]
call fcn.004011b8
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x1c]
push 0
xor eax, eax
push eax
push 0
push dword [esp + 0x1c]
push dword [esp + 0x74]
call sub.ADVAPI32.dll_RegCreateKeyExW
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x6bdfcb
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x6bdfb4
push dword [esp + 0xc]
mov ebp, dword [esp + 0x70]
pop dword [ebp + 8]
push edx
call fcn.00415b10
pop edx
push eax
push dword [esp + 0x10]
call fcn.006bef59
mov ebp, dword [esp + 0x70]
lea eax, [ebp + 0xc]
push eax
call fcn.00415900
cmp dword [esp + 0x14], 0
je 0x6bdfc4
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
jmp 0x6be3b3
push dword [esp + 0x64]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x6be0d6
mov ebx, dword [esp + 0x70]
and ebx, ebx
jne 0x6be01c
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x6be009
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xfffffffd
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_Required_Ret.RegValue_parameter_not_found_
lea ecx, [ebp + 0xc]
call fcn.004011b8
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x6be3b3
mov ebp, dword [esp + 0x70]
mov eax, dword [ebp + 4]
cdq
push edx
push eax
pop dword [esp + 0x24]
pop dword [esp + 0x24]
mov ebp, dword [esp + 0x70]
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x6be078
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x6be065
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xfffffffe
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_No_Pointer_to_BINARY_defined_
lea ecx, [ebp + 0xc]
call fcn.004011b8
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x6be3b3
push dword [esp + 0x24]
push dword [esp + 0x24]
pop ebx
pop edi
cmp ebx, 0
jne 0x6be08c
cmp edi, 0
je 0x6be090
xor eax, eax
jmp 0x6be095
mov eax, 1
or eax, eax
je 0x6be0ad
push dword [esp + 0x1c]
call fcn.004153d0
cdq
push edx
push eax
pop dword [esp + 0x24]
pop dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push eax
push dword [esp + 0x20]
push 3
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x6be365
mov ebx, 4
cmp ebx, dword [esp]
jne 0x6be117
push dword [esp + 0xc]
call fcn.00415020
mov dword [esp + 0x3c], eax
push 4
lea eax, [esp + 0x40]
push eax
push 4
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x6be365
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x6be15e
push dword [esp + 0xc]
call fcn.00415020
push edx
push eax
pop dword [esp + 0x44]
pop dword [esp + 0x44]
push 8
lea eax, [esp + 0x44]
push eax
push 0xb
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x6be365
mov ebx, 2
cmp ebx, dword [esp]
je 0x6be172
mov ebx, 1
cmp ebx, dword [esp]
jne 0x6be1a5
push dword [esp + 0xc]
call fcn.00414d80
mov ebx, eax
add ebx, 2
push ebx
mov eax, dword [esp + 0x10]
push eax
push dword [esp + 0x70]
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x6be365
mov ebx, 7
cmp ebx, dword [esp]
jne 0x6be365
mov eax, 0x521648
push eax
push dword [esp + 0x10]
call fcn.00413cc0
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0
jmp 0x6be1d0
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x30]
jl 0x6be23e
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
mov eax, 0x521648
push eax
mov ebx, dword [esp + 0x3c]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.00414db0
lea eax, [esp + 0x38]
push eax
call fcn.00415900
push dword [esp + 0x24]
push dword [esp + 0x24]
push 0x19
push dword [esp + 0x40]
call fcn.00414d20
cdq
add dword [esp], eax
adc dword [esp + 4], edx
add dword [esp], 2
adc dword [esp + 4], 0
pop dword [esp + 0x24]
pop dword [esp + 0x24]
inc dword [esp + 0x30]
jno 0x6be1d0
push dword [esp + 0x24]
push dword [esp + 0x24]
pop ebx
pop edi
cmp ebx, 0
jne 0x6be256
cmp edi, 0
jne 0x6be256
xor eax, eax
jmp 0x6be25b
mov eax, 1
or eax, eax
je 0x6be365
mov eax, dword [esp + 0x20]
push eax
call fcn.004151f0
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x6be331
mov dword [esp + 0x30], 0
jmp 0x6be286
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x30]
jl 0x6be2fc
push edx
call fcn.00415b10
pop edx
push eax
push edx
call fcn.00415b10
pop edx
push eax
mov eax, 0x521648
push eax
mov ebx, dword [esp + 0x3c]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.00414db0
lea eax, [esp + 0x38]
push eax
call fcn.00415900
push 0x19
push 0xffffffff
push dword [esp + 0x3c]
mov ebx, dword [esp + 0x28]
add ebx, dword [esp + 0x44]
push ebx
call fcn.004154f0
mov ebx, dword [esp + 0x38]
push 0x19
push dword [esp + 0x38]
call fcn.00414d20
add ebx, eax
add ebx, 2
mov dword [esp + 0x38], ebx
inc dword [esp + 0x30]
jno 0x6be286
sub esp, 4
mov eax, dword [esp + 0x24]
push eax
push dword [esp + 0x24]
push dword [esp + 0x74]
push 0
push dword [esp + 0x1c]
push dword [esp + 0x30]
call dword [0x639aa4]
add esp, 4
mov dword [esp + 0x10], eax
push dword [esp + 0x1c]
call fcn.00415350
jmp 0x6be365
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x6be355
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.004011b8
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x6be3b3
pop eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 0xc], 0
je 0x6be3ab
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x6be3a7
push dword [esp + 0xc]
mov ebp, dword [esp + 0x70]
pop dword [ebp + 8]
push edx
call fcn.00415b10
pop edx
push eax
push dword [esp + 0x10]
call fcn.006bef59
mov ebp, dword [esp + 0x70]
lea eax, [ebp + 0xc]
push eax
call fcn.00415900
xor eax, eax
jmp 0x6be3b3
mov eax, dword [esp + 0x28]
jmp 0x6be3b3
push dword [esp + 0x30]
call fcn.00415a70
push dword [esp]
call fcn.00415a70
push dword [esp + 8]
call fcn.00415a70
push dword [esp + 4]
call fcn.00415a70
add esp, 0x44
pop edi
pop ebx
pop ebp
ret 0x1c