Function at 0x437ee4
Capabilities:
Set registry value

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x30]
xor ebx, ebx
push edi
push esi
mov dword [esp + 0x14], ebx
call fcn.0044fe85
pop ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], eax
mov ebp, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x18], ecx
movsx ecx, byte [eax]
mov dword [esp + 0x38], ebp
cmp ecx, 0x74
jg 0x437f3f
je 0x437f9e
cmp ecx, 0x62
je 0x437fca
cmp ecx, 0x69
je 0x437fca
cmp ecx, 0x6e
je 0x437fca
cmp ecx, 0x71
jmp 0x437f50
sub ecx, 0x75
je 0x437fca
sub ecx, 3
je 0x437f9e
sub ecx, 1
je 0x437fca
mov dword [esp + 0x24], 1
cmp byte [eax], 0x73
jne 0x437f80
lea eax, [esp + 0x1c]
push eax
push esi
call fcn.0044fe07
push eax
call fcn.00447c7a
mov edi, dword [esp + 0x28]
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x28], ebx
inc edi
jmp 0x437fe0
push ebx
push ebx
push esi
call fcn.00450850
push ebx
push eax
mov edi, dword [eax + 4]
inc edi
call fcn.0044de03
mov ebx, eax
add esp, 0x14
mov dword [esp + 0x28], ebx
jmp 0x437fe0
push 8
pop edi
push edi
mov dword [esp + 0x28], 0xb
call fcn.00441ddc
push esi
mov dword [esp + 0x30], eax
call fcn.0043827f
pop ecx
pop ecx
mov ecx, dword [esp + 0x28]
mov dword [ecx], eax
mov dword [ecx + 4], edx
mov ebx, dword [esp + 0x28]
jmp 0x437fe0
push 4
pop edi
push esi
mov dword [esp + 0x28], edi
call fcn.004381ff
pop ecx
mov dword [esp + 0x28], eax
lea ebx, [esp + 0x28]
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 1
push dword [esp + 0x34]
push dword [ebp + 0x1c]
call fcn.0043855c
push dword [esp + 0x34]
mov ebp, eax
push dword [esp + 0x34]
push ebp
call fcn.00438acf
mov esi, eax
add esp, 0x18
mov eax, dword [esp + 0x38]
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test esi, esi
je 0x43817d
push ebp
call fcn.00438428
lea eax, [esp + 0x14]
xor ebp, ebp
push eax
push ebp
push dword [esp + 0x3c]
call fcn.0043834f
push dword [esp + 0x20]
mov esi, eax
push esi
push str.Set_key:__s____s_n
call fcn.0040138c
push ebp
push ebp
push ebp
push 0xffffffffffffffff
push esi
call fcn.0044bdbd
add esp, 0x30
xor ecx, ecx
mov ebp, eax
lea eax, [esp + 0x14]
push ecx
push eax
push ecx
push 0x20006
push ecx
push ecx
push ecx
push ebp
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4380b6
lea ecx, [esi + 1]
push ecx
push str.gregistrybackend:_opening_key__s_failed
push eax
call fcn.004377ee
add esp, 0xc
cmp dword [esp + 0x24], 1
je 0x438099
cmp dword [esp + 0x24], 0xb
jne 0x4380a3
push dword [esp + 0x28]
call fcn.00441dce
pop ecx
push ebp
call fcn.00441dce
push esi
call fcn.00441dce
pop ecx
pop ecx
jmp 0x43817d
push ebp
call fcn.00441dce
xor ebp, ebp
push ebp
push ebp
push ebp
push 0xffffffffffffffff
push dword [esp + 0x24]
call fcn.0044bdbd
mov ecx, dword [esp + 0x38]
add esp, 0x18
mov dword [esp + 0x18], eax
movsx ecx, byte [ecx]
cmp ecx, 0x74
jg 0x4380f5
je 0x43812a
cmp ecx, 0x62
je 0x43812a
cmp ecx, 0x69
je 0x43812a
cmp ecx, 0x6e
je 0x43812a
cmp ecx, 0x71
jmp 0x438102
sub ecx, 0x75
je 0x43812a
sub ecx, 3
je 0x43812a
sub ecx, 1
je 0x43812a
push 0
push 0
push 0
push 0xffffffffffffffff
push ebx
call fcn.0044bdbd
mov ebp, eax
push ebp
mov ebx, ebp
call fcn.004bb0d4
add esp, 0x18
lea edi, [eax*2 + 2]
mov eax, dword [esp + 0x18]
push edi
push ebx
push dword [esp + 0x2c]
push 0
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x43815b
push dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
push esi
push dword [ecx + 0x10]
push str.gregistrybackend:_setting_value__s_s_s_failed._n
push eax
call fcn.004377ee
add esp, 0x14
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.00441dce
push dword [esp + 0x1c]
call fcn.00441dce
push ebp
call fcn.00441dce
add esp, 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret