Function at 0x4047e1
Capabilities:
Set registry value

Disassembly:
push ebp
push ebx
push edi
mov edx, 0x11
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4047e9
call fcn.0048bfd0
mov edx, dword [esp + 0x58]
lea ecx, [esp]
call fcn.00442000
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 4]
call fcn.00442000
mov edx, dword [esp + 0x60]
lea ecx, [esp + 8]
call fcn.00442000
mov dword [esp + 0x10], 0x20006
cmp dword [esp + 0x68], 0
je 0x40483e
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.004896a0
call fcn.0048c030
mov edx, 0x5489ca
call fcn.00442330
mov ecx, eax
call fcn.00442340
je 0x4048a4
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push dword [esp + 8]
call fcn.00489710
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00489740
lea eax, [esp + 4]
push eax
call fcn.0048bf00
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00489740
call fcn.0048c030
mov edx, 0x5489ca
call fcn.00442330
mov ecx, eax
call fcn.00442340
je 0x40490a
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
push dword [esp + 8]
call fcn.00489710
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.004896a0
lea eax, [esp + 4]
push eax
call fcn.0048bf00
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x404987
mov ebx, dword [esp + 0x64]
cmp ebx, 3
je 0x404930
push 0x5635f4
push 0x24
push dword [esp + 0x74]
call fcn.0048ad20
jmp 0x404987
mov ebp, dword [esp + 0x6c]
mov dword [ebp], 0
mov ebp, dword [esp + 0x6c]
mov dword [ebp + 8], 0
mov ebp, dword [esp + 0x6c]
mov edx, 0x546028
lea ecx, [ebp + 0xc]
call fcn.00442008
mov ebp, dword [esp + 0x6c]
mov dword [ebp + 0x10], 0
mov ebp, dword [esp + 0x6c]
lea eax, [ebp + 0x14]
mov dword [eax + 4], 0
mov dword [eax], 0
mov ebp, dword [esp + 0x6c]
mov edx, 0x546028
lea ecx, [ebp + 0x20]
call fcn.00442008
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x1c]
push 0
xor eax, eax
push eax
push 0
push dword [esp + 0x1c]
push dword [esp + 0x74]
call sub.ADVAPI32.dll_RegCreateKeyExW
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x404a07
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x4049f0
push dword [esp + 0xc]
mov ebp, dword [esp + 0x70]
pop dword [ebp + 8]
push edx
call fcn.0048be60
pop edx
push eax
push dword [esp + 0x10]
call fcn.00405995
mov ebp, dword [esp + 0x70]
lea eax, [ebp + 0xc]
push eax
call fcn.0048bf00
cmp dword [esp + 0x14], 0
je 0x404a00
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
jmp 0x404def
push dword [esp + 0x64]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x404b12
mov ebx, dword [esp + 0x70]
and ebx, ebx
jne 0x404a58
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x404a45
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xfffffffd
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_Required_Ret.RegValue_parameter_not_found_
lea ecx, [ebp + 0xc]
call fcn.00442008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x404def
mov ebp, dword [esp + 0x70]
mov eax, dword [ebp + 4]
cdq
push edx
push eax
pop dword [esp + 0x24]
pop dword [esp + 0x24]
mov ebp, dword [esp + 0x70]
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x404ab4
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x404aa1
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xfffffffe
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_No_Pointer_to_BINARY_defined_
lea ecx, [ebp + 0xc]
call fcn.00442008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x404def
push dword [esp + 0x24]
push dword [esp + 0x24]
pop ebx
pop edi
cmp ebx, 0
jne 0x404ac8
cmp edi, 0
je 0x404acc
xor eax, eax
jmp 0x404ad1
mov eax, 1
or eax, eax
je 0x404ae9
push dword [esp + 0x1c]
call fcn.0048ad30
cdq
push edx
push eax
pop dword [esp + 0x24]
pop dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push eax
push dword [esp + 0x20]
push 3
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x404da1
mov ebx, 4
cmp ebx, dword [esp]
jne 0x404b53
push dword [esp + 0xc]
call fcn.004897c0
mov dword [esp + 0x3c], eax
push 4
lea eax, [esp + 0x40]
push eax
push 4
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x404da1
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x404b9a
push dword [esp + 0xc]
call fcn.004897c0
push edx
push eax
pop dword [esp + 0x44]
pop dword [esp + 0x44]
push 8
lea eax, [esp + 0x44]
push eax
push 0xb
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x404da1
mov ebx, 2
cmp ebx, dword [esp]
je 0x404bae
mov ebx, 1
cmp ebx, dword [esp]
jne 0x404be1
push dword [esp + 0xc]
call fcn.00489900
mov ebx, eax
add ebx, 2
push ebx
mov eax, dword [esp + 0x10]
push eax
push dword [esp + 0x70]
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x404da1
mov ebx, 7
cmp ebx, dword [esp]
jne 0x404da1
mov eax, 0x546628
push eax
push dword [esp + 0x10]
call fcn.00489930
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0
jmp 0x404c0c
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x30]
jl 0x404c7a
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
mov eax, 0x546628
push eax
mov ebx, dword [esp + 0x3c]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.004899c0
lea eax, [esp + 0x38]
push eax
call fcn.0048bf00
push dword [esp + 0x24]
push dword [esp + 0x24]
push 0x19
push dword [esp + 0x40]
call fcn.00489af0
cdq
add dword [esp], eax
adc dword [esp + 4], edx
add dword [esp], 2
adc dword [esp + 4], 0
pop dword [esp + 0x24]
pop dword [esp + 0x24]
inc dword [esp + 0x30]
jno 0x404c0c
push dword [esp + 0x24]
push dword [esp + 0x24]
pop ebx
pop edi
cmp ebx, 0
jne 0x404c92
cmp edi, 0
jne 0x404c92
xor eax, eax
jmp 0x404c97
mov eax, 1
or eax, eax
je 0x404da1
mov eax, dword [esp + 0x20]
push eax
call fcn.0048ad90
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x404d6d
mov dword [esp + 0x30], 0
jmp 0x404cc2
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x30]
jl 0x404d38
push edx
call fcn.0048be60
pop edx
push eax
push edx
call fcn.0048be60
pop edx
push eax
mov eax, 0x546628
push eax
mov ebx, dword [esp + 0x3c]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.004899c0
lea eax, [esp + 0x38]
push eax
call fcn.0048bf00
push 0x19
push 0xffffffff
push dword [esp + 0x3c]
mov ebx, dword [esp + 0x28]
add ebx, dword [esp + 0x44]
push ebx
call fcn.0048adb0
mov ebx, dword [esp + 0x38]
push 0x19
push dword [esp + 0x38]
call fcn.00489af0
add ebx, eax
add ebx, 2
mov dword [esp + 0x38], ebx
inc dword [esp + 0x30]
jno 0x404cc2
sub esp, 4
mov eax, dword [esp + 0x24]
push eax
push dword [esp + 0x24]
push dword [esp + 0x74]
push 0
push dword [esp + 0x1c]
push dword [esp + 0x30]
call dword [0x61c4f0]
add esp, 4
mov dword [esp + 0x10], eax
push dword [esp + 0x1c]
call fcn.0048af00
jmp 0x404da1
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x404d91
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.00442008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x404def
pop eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 0xc], 0
je 0x404de7
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x404de3
push dword [esp + 0xc]
mov ebp, dword [esp + 0x70]
pop dword [ebp + 8]
push edx
call fcn.0048be60
pop edx
push eax
push dword [esp + 0x10]
call fcn.00405995
mov ebp, dword [esp + 0x70]
lea eax, [ebp + 0xc]
push eax
call fcn.0048bf00
xor eax, eax
jmp 0x404def
mov eax, dword [esp + 0x28]
jmp 0x404def
push dword [esp + 0x30]
call fcn.0048c060
push dword [esp]
call fcn.0048c060
push dword [esp + 8]
call fcn.0048c060
push dword [esp + 4]
call fcn.0048c060
add esp, 0x44
pop edi
pop ebx
pop ebp
ret 0x1c