Function at 0x410ba0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416266
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2234
call fcn.00414030
mov eax, dword [0x41e008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2220], ecx
mov dword [ebp - 0x2230], ecx
mov edi, dword [ebp + 8]
mov dword [ebp - 0x2228], edi
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2224], ebx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x223c], eax
lea eax, [ebp - 0x2014]
push eax
call fcn.00410a00
test eax, eax
js 0x4110bc
push str.SMDB
lea eax, [ebp - 0x2014]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
call esi
test eax, eax
jne 0x410c2e
lea esi, [eax + 8]
jmp 0x410c77
push 0x4174fc
lea eax, [ebp - 0x2014]
push eax
call esi
test eax, eax
jne 0x410c47
mov esi, 0x4008
jmp 0x410c77
push 0x417500
lea eax, [ebp - 0x2014]
push eax
call esi
test eax, eax
jne 0x410c5e
lea esi, [eax + 0x13]
jmp 0x410c77
push 0x417504
lea eax, [ebp - 0x2014]
push eax
call esi
test eax, eax
jne 0x4110b7
lea esi, [eax + 0x11]
mov ecx, dword [ebp - 0x2220]
call fcn.004109b0
lea eax, [ebp - 0x2014]
push eax
mov ecx, dword [ebp - 0x2220]
call fcn.00410a00
test eax, eax
js 0x4110bc
cmp esi, 0x13
ja 0x410f0b
je 0x410ea2
cmp esi, 8
je 0x410e64
cmp esi, 0x11
jne 0x41109b
lea ebx, [ebp - 0x2014]
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
test ax, ax
jne 0x410cc6
sub ebx, ecx
sar ebx, 1
mov dword [ebp - 0x2234], ebx
test bl, 1
jne 0x410da8
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x222c], eax
mov dword [ebp - 0x2238], eax
mov dword [ebp - 0x2118], 0
mov dword [ebp - 4], 4
mov byte [ebp - 4], 5
mov dword [ebp - 0x2244], eax
mov dword [ebp - 0x2240], 0
cmp eax, 0x100
jbe 0x410d3e
push eax
lea ecx, [ebp - 0x2118]
call fcn.00412df0
mov eax, dword [ebp - 0x222c]
mov dword [ebp - 4], 4
jmp 0x410d7e
lea ecx, [ebp - 0x2114]
mov dword [ebp - 0x2118], ecx
mov dword [ebp - 4], 4
jmp 0x410d7e
mov ecx, dword [ebp - 0x2118]
test ecx, ecx
jne 0x410db2
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2114]
cmp dword [ebp - 0x2118], eax
je 0x410da8
lea ecx, [ebp - 0x2118]
call fcn.00412de0
mov eax, 0x80004005
jmp 0x4110bc
push eax
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor edi, edi
test ebx, ebx
jle 0x410e15
mov esi, edi
shr esi, 1
add esi, dword [ebp - 0x2118]
movzx edx, word [ebp + edi*2 - 0x2014]
lea eax, [edx - 0x30]
cmp eax, 0x36
ja case.0x410de5.58
movzx eax, byte [eax + 0x4110f4]
jmp dword [eax*4 + 0x4110e4]
sub dl, 0x30
jmp 0x410dfd
sub dl, 0x37
jmp 0x410dfd
sub dl, 0x57
jmp 0x410dfd
xor dl, dl
mov eax, edi
and eax, 1
shl eax, 2
mov ecx, 4
sub ecx, eax
shl dl, cl
or byte [esi], dl
inc edi
cmp edi, ebx
jl 0x410dc4
push dword [ebp - 0x222c]
push dword [ebp - 0x2118]
push 3
push 0
push dword [ebp - 0x2224]
mov eax, dword [ebp - 0x2228]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2114]
cmp dword [ebp - 0x2118], eax
je 0x41108e
lea ecx, [ebp - 0x2118]
call fcn.00412de0
jmp 0x41108e
lea ecx, [ebp - 0x2014]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410e70
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x2014]
push eax
push 1
push 0
push ebx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x41108e
mov dword [ebp - 0x2230], 0
mov dword [ebp - 4], 3
lea eax, [ebp - 0x2238]
push eax
push 0
push 0
lea eax, [ebp - 0x2014]
push eax
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
test eax, eax
jns 0x410edb
mov dword [ebp - 4], 0xffffffff
jmp 0x4110bc
mov eax, dword [ebp - 0x2238]
mov dword [ebp - 0x2234], eax
push 4
lea eax, [ebp - 0x2234]
push eax
push 4
push 0
push ebx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
jmp 0x41108e
cmp esi, 0x4008
jne 0x41109b
lea ecx, [ebp - 0x2014]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x410f20
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 2]
mov dword [ebp - 0x221c], 0
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov ecx, 2
mul ecx
mov dword [ebp - 0x2244], eax
mov dword [ebp - 0x2240], edx
test edx, edx
jne 0x4110da
cmp eax, 0xffffffff
ja 0x4110da
cmp eax, 0x100
jbe 0x410f87
push eax
lea ecx, [ebp - 0x221c]
call fcn.00412df0
mov dword [ebp - 4], 0
jmp 0x410fb5
lea eax, [ebp - 0x2218]
mov dword [ebp - 0x221c], eax
mov dword [ebp - 4], 0
jmp 0x410fb5
mov esi, dword [ebp - 0x221c]
test esi, esi
je 0x411069
lea edi, [ebp - 0x2014]
cmp word [ebp - 0x2014], 0
je 0x41100c
mov ebx, dword [sym.imp.USER32.dll_CharNextW]
nop dword [eax]
push edi
call ebx
movzx ecx, word [edi]
cmp ecx, 0x5c
jne 0x410ffd
cmp word [eax], 0x30
jne 0x410ffd
xor ecx, ecx
mov word [esi], cx
push eax
call ebx
mov edi, eax
jmp 0x411003
mov word [esi], cx
add edi, 2
add esi, 2
cmp word [edi], 0
jne 0x410fe0
xor eax, eax
mov dword [esi], eax
mov ebx, dword [ebp - 0x221c]
test ebx, ebx
jne 0x41101f
lea esi, [eax + 0xd]
jmp 0x41106e
xor edi, edi
mov edx, ebx
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x411030
sub ecx, esi
sar ecx, 1
inc ecx
lea edx, [edx + ecx*2]
lea edi, [edi + ecx*2]
cmp ecx, 1
jne 0x411023
push edi
push ebx
push 7
push 0
push dword [ebp - 0x2224]
mov eax, dword [ebp - 0x2228]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x41106e
mov esi, 0xe
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2218]
cmp dword [ebp - 0x221c], eax
je 0x41108e
lea ecx, [ebp - 0x221c]
call fcn.00412de0
test esi, esi
je 0x41109b
mov ecx, esi
call fcn.0040fa90
jmp 0x4110bc
push dword [ebp - 0x223c]
mov ecx, dword [ebp - 0x2220]
call fcn.00410a00
xor ecx, ecx
test eax, eax
cmovs ecx, eax
mov eax, ecx
jmp 0x4110bc
mov eax, 0x80020009
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00412ec6
mov esp, ebp
pop ebp
ret 0xc
push 0x80070216
call fcn.00401180
in al, dx
or eax, 233898049
inc ecx
add dh, dh
or eax, 0xdfb0041
inc ecx
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add dword [ecx], eax
add dword [ecx], eax
add dword [ecx], eax
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add al, byte [edx]
add al, byte [edx]
add al, byte [edx]
int3