Function at 0x404688
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4100a4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, ecx
mov edi, 0x2000
mov dword [ebp - 0x18], esi
push edi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.msvcrt.dll_malloc]
mov ebx, eax
mov dword [ebp - 0x24], ebx
pop ecx
test ebx, ebx
jne 0x4046ca
mov esi, 0x8007000e
jmp 0x404a76
push ebx
mov ecx, esi
call fcn.0040453b
mov esi, eax
test esi, esi
jns 0x4046e4
push ebx
call dword [sym.imp.msvcrt.dll_free]
jmp 0x404a75
xor eax, eax
mov esi, eax
push dword [esi*8 + 0x4010c0]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x404711
inc esi
cmp esi, 3
jb 0x4046e8
push ebx
call dword [sym.imp.msvcrt.dll_free]
mov esi, 0x80020009
jmp 0x404a75
movzx eax, word [esi*8 + 0x4010c4]
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
jne 0x40473b
push ebx
call dword [sym.imp.msvcrt.dll_free]
mov esi, 0x8007000e
jmp 0x404a75
mov ecx, dword [ebp - 0x18]
call fcn.00404510
mov ecx, dword [ebp - 0x18]
push edi
call fcn.0040453b
mov esi, eax
test esi, esi
jns 0x404765
push edi
call dword [sym.imp.msvcrt.dll_free]
push ebx
call dword [sym.imp.msvcrt.dll_free]
jmp 0x404a74
mov eax, dword [ebp - 0xc]
xor ecx, ecx
movzx eax, ax
mov dword [ebp - 0x1c], ecx
sub eax, 8
je 0x4048d9
sub eax, 9
je 0x4047aa
dec eax
sub eax, 1
jne 0x404a51
lea eax, [ebp - 0x1c]
push eax
push ecx
push ecx
push edi
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push 4
push eax
push 4
xor eax, eax
jmp 0x4048c5
mov ecx, edi
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4047b1
sub ecx, edx
sar ecx, 1
mov dword [ebp - 0x10], ecx
test cl, 1
jne 0x40481e
mov eax, ecx
cdq
sub eax, edx
mov esi, eax
sar esi, 1
mov dword [ebp - 0x14], esi
cmp esi, 0x400
ja 0x4047f4
mov ecx, esi
call fcn.00403da3
test al, al
je 0x4047f4
mov eax, esi
call fcn.0040f8f0
mov eax, esp
xor ecx, ecx
jmp 0x404817
lea eax, [esi + 8]
cmp eax, esi
jae 0x404801
xor ecx, ecx
mov eax, ecx
jmp 0x404817
push eax
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
xor ecx, ecx
test eax, eax
je 0x4047fd
mov dword [eax], ecx
mov dword [ebp - 0x20], eax
add eax, 8
mov dword [ebp - 8], eax
test eax, eax
jne 0x404836
push edi
call dword [sym.imp.msvcrt.dll_free]
push ebx
call dword [sym.imp.msvcrt.dll_free]
mov esi, 0x80004005
jmp 0x404a74
push esi
push ecx
push eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp - 0x10]
xor eax, eax
add esp, 0xc
mov edx, eax
mov dword [ebp - 0xc], edx
test esi, esi
jle 0x4048bd
mov ebx, dword [ebp - 8]
movzx ecx, word [edi + edx*2]
movzx eax, cx
cmp eax, 0x30
jb 0x404887
cmp eax, 0x39
jbe 0x40487f
cmp eax, 0x40
jbe 0x404887
cmp eax, 0x46
jbe 0x40487a
add eax, 0xffffff9f
cmp eax, 5
ja 0x404887
sub cl, 0x57
jmp 0x404882
sub cl, 0x37
jmp 0x404882
sub cl, 0x30
mov dword [ebp - 0x10], ecx
jmp 0x40488c
xor eax, eax
mov byte [ebp - 0x10], al
mov edx, edx
test edx, edx
jns 0x404895
add edx, 1
sar edx, 1
mov eax, dword [ebp - 0xc]
and eax, 1
shl eax, 2
push 4
pop ecx
sub ecx, eax
mov eax, dword [ebp - 0x10]
shl al, cl
or byte [edx + ebx], al
mov edx, dword [ebp - 0xc]
inc edx
mov dword [ebp - 0xc], edx
cmp edx, esi
jl 0x404852
mov ebx, dword [ebp - 0x24]
xor eax, eax
push dword [ebp - 0x14]
push dword [ebp - 8]
push 3
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x404a51
mov edx, edi
mov esi, ecx
mov dword [ebp - 0x10], edx
cmp byte [ebp + 0x14], cl
je 0x404a10
mov ecx, edi
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4048f0
sub ecx, edx
sar ecx, 1
cmp ecx, 0xffe
jg 0x40481e
push 0x2000
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebp - 8], eax
pop ecx
test eax, eax
jne 0x404936
push edi
call dword [sym.imp.msvcrt.dll_free]
push ebx
call dword [sym.imp.msvcrt.dll_free]
mov esi, 0x8007000e
jmp 0x404a74
mov ecx, dword [ebp - 0x18]
xor eax, eax
push 0x402144
mov dword [ebp - 0x14], eax
mov ecx, dword [ecx + 4]
call fcn.004043dc
mov esi, eax
test esi, esi
je 0x404a02
mov edx, esi
mov ecx, edi
call fcn.00404466
mov dword [ebp - 0xc], eax
test eax, eax
je 0x404a02
cmp eax, dword [ebp + 0x10]
je 0x404983
push eax
push edi
call dword [sym.imp.USER32.dll_CharPrevW]
cmp word [eax], 0x22
je 0x404a02
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
sub eax, edi
sar eax, 1
xor edx, edx
push eax
push edi
push ecx
mov word [ecx], dx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x402154
push 0x1000
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_wcscat_s]
push esi
push 0x1000
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_wcscat_s]
push 0x402154
push 0x1000
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_wcscat_s]
add esp, 0x24
lea ecx, [esi + 2]
xor edx, edx
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x4049d5
mov eax, dword [ebp - 0xc]
sub esi, ecx
sar esi, 1
lea eax, [eax + esi*2]
mov esi, dword [ebp - 8]
push eax
push 0x1000
push esi
call dword [sym.imp.msvcrt.dll_wcscat_s]
add esp, 0xc
mov dword [ebp - 0x10], esi
jmp 0x404a05
mov esi, dword [ebp - 8]
lea ecx, [ebp - 0x14]
call fcn.00405e0f
mov edx, dword [ebp - 0x10]
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x14], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x28]
jne 0x404a18
sub ecx, dword [ebp - 0x14]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
xor eax, eax
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test esi, esi
je 0x404a51
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.0040453b
push edi
mov esi, eax
call dword [sym.imp.msvcrt.dll_free]
push ebx
call dword [sym.imp.msvcrt.dll_free]
test esi, esi
js 0x404a74
xor eax, eax
mov esi, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
call fcn.00405e0f
mov eax, esi
lea esp, [ebp - 0x34]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f200
mov esp, ebp
pop ebp
ret 0x10