Function at 0x412bd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov eax, dword [0x421040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x1a4], eax
mov ebx, edx
mov eax, dword [ebp + 0xc]
mov esi, 0x41da8c
push edi
mov edi, ecx
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], 0
mov eax, edi
nop dword [eax]
mov cx, word [eax]
cmp cx, word [esi]
jne 0x412c36
test cx, cx
je 0x412c32
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x412c36
add eax, 4
add esi, 4
test cx, cx
jne 0x412c10
xor eax, eax
jmp 0x412c3b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x412c49
mov eax, 0x80000000
jmp 0x412dc8
mov ecx, 0x41dab0
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412c76
test dx, dx
je 0x412c72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412c76
add eax, 4
add ecx, 4
test dx, dx
jne 0x412c50
xor eax, eax
jmp 0x412c7b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x412c89
mov eax, 0x80000001
jmp 0x412dc8
mov ecx, 0x41dad4
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412cb6
test dx, dx
je 0x412cb2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412cb6
add eax, 4
add ecx, 4
test dx, dx
jne 0x412c90
xor eax, eax
jmp 0x412cbb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x412cc9
mov eax, 0x80000002
jmp 0x412dc8
mov ecx, 0x41dafc
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412cf6
test dx, dx
je 0x412cf2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412cf6
add eax, 4
add ecx, 4
test dx, dx
jne 0x412cd0
xor eax, eax
jmp 0x412cfb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x412d09
mov eax, 0x80000003
jmp 0x412dc8
mov ecx, 0x41db14
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412d36
test dx, dx
je 0x412d32
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412d36
add eax, 4
add ecx, 4
test dx, dx
jne 0x412d10
xor eax, eax
jmp 0x412d3b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x412d49
mov eax, 0x80000004
jmp 0x412dc8
mov ecx, 0x41db40
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x412d76
test dx, dx
je 0x412d72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x412d76
add eax, 4
add ecx, 4
test dx, dx
jne 0x412d50
xor eax, eax
jmp 0x412d7b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x412d86
mov eax, 0x80000005
jmp 0x412dc8
mov eax, 0x41db68
nop dword [eax + eax]
mov cx, word [edi]
cmp cx, word [eax]
jne 0x412db6
test cx, cx
je 0x412db2
mov cx, word [edi + 2]
cmp cx, word [eax + 2]
jne 0x412db6
add edi, 4
add eax, 4
test cx, cx
jne 0x412d90
xor eax, eax
jmp 0x412dbb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x412e77
mov eax, 0x80000006
lea ecx, [ebp - 0x19c]
push ecx
lea ecx, [ebp - 0x198]
push ecx
push 0
push 0xf003f
push 0
push 0x41d4ec
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x412e77
push dword [ebp - 0x1a0]
lea eax, [ebp - 0x194]
push 0x41db84
push eax
call fcn.00401010
lea ecx, [ebp - 0x194]
add esp, 0xc
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x412e20
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x194]
push eax
push 1
push 0
push dword [ebp - 0x1a4]
push dword [ebp - 0x198]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x412e77
push dword [ebp - 0x198]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x412e77
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401288
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401288
mov esp, ebp
pop ebp
ret