Function at 0x41dc60
Capabilities:
Set registry value

Disassembly:
sub esp, 0x114
push ebx
mov ebx, ecx
mov eax, dword [ebx + 8]
test eax, eax
je 0x41def3
mov eax, dword [ebx + 4]
test eax, eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
je 0x41dce9
lea eax, [esp + 0x1c]
push 0x101
push eax
call fcn.00423be0
add esp, 8
test eax, eax
je 0x41def1
push edi
mov edi, 0x4405ca
lea esi, [esp + 0x20]
mov ecx, 1
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
pop edi
je 0x41def1
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
push 0x2001f
push edx
push edx
push edx
push str.SoftwareORLWinVNC3
push reloc.WSOCK32.dll_accept
call esi
test eax, eax
jne 0x41def1
jmp 0x41dd77
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x10]
push eax
push 0
push 0x20019
push 0
push 0
push 0
push str.SoftwareORLWinVNC3
push reloc.WSOCK32.dll_bind
call esi
test eax, eax
je 0x41dd34
push 0
push str.WVNC
push 0x4454d8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push str.Default
push eax
call esi
test eax, eax
je 0x41dd70
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
mov edx, dword [esp + 0xc]
push edx
call ebp
mov eax, dword [esp + 0x14]
push eax
mov ecx, ebx
call fcn.0041d080
mov ecx, dword [esp + 0x14]
push ecx
call ebp
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push str.SoftwareORLWinVNC3
push reloc.WSOCK32.dll_bind
call esi
test eax, eax
jne 0x41def1
mov ecx, dword [ebx]
mov edx, dword [ecx]
call dword [edx + 0x100]
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 4
push 0
push str.ConnectPriority
push ecx
call esi
mov ecx, dword [ebx]
mov edx, dword [ecx]
call dword [edx + 0x110]
mov ecx, dword [esp + 0x10]
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 4
push 0
push str.LoopbackOnly
push ecx
call esi
mov ecx, dword [ebx]
mov edx, dword [ecx]
call dword [edx + 0x17c]
mov ecx, dword [esp + 0x10]
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 4
push 0
push str.EnableHTTPDaemon
push ecx
call esi
mov ecx, dword [ebx]
mov edx, dword [ecx]
call dword [edx + 0x180]
mov ecx, dword [esp + 0x10]
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 4
push 0
push str.EnableURLParams
push ecx
call esi
mov ecx, dword [ebx]
mov edx, dword [ecx]
call dword [edx + 0x188]
mov ecx, dword [esp + 0x10]
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 4
push 0
push str.AllowLoopback
push ecx
call esi
mov ecx, dword [ebx]
mov edx, dword [ecx]
call dword [edx + 0x12c]
mov ecx, dword [esp + 0x10]
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 4
push 0
push str.AuthRequired
push ecx
call esi
mov ecx, 0x44ff14
call fcn.00402aa0
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
push str.DebugMode
push eax
call esi
mov ecx, 0x44ff14
call fcn.00402ac0
mov edx, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x10]
push ecx
push 4
push 0
push str.DebugLevel
push edx
mov dword [esp + 0x24], eax
call esi
mov eax, dword [esp + 0x10]
push eax
call ebp
push reloc.WSOCK32.dll_accept
call ebp
pop esi
pop ebp
pop ebx
add esp, 0x114
ret