Function at 0x41a5ef
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000c
call fcn.00457ac0
mov ecx, dword [0x466b78]
push ebx
push esi
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x45af3c
call fcn.0040187e
cmp dword [ebp + 0xc], ebx
je 0x41a870
cmp dword [ebp + 8], ebx
je 0x41a870
cmp dword [ebp + 8], 0xfffffffe
je 0x41a870
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push 0x4595d8
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41a870
mov eax, dword [ebp + 8]
dec eax
je 0x41a80d
dec eax
je 0x41a7d5
dec eax
je 0x41a718
dec eax
je 0x41a6f5
sub eax, 3
jne 0x41a867
push 0xfffe
push dword [ebp + 0x18]
lea eax, [ebp - 0x1000c]
push eax
call fcn.004392af
lea eax, [ebp - 0x1000c]
push eax
call fcn.00457520
add esp, 0x10
cmp eax, ebx
mov byte [ebp + eax - 0x1000b], bl
jbe 0x41a6c1
cmp byte [ebp + eax - 0x1000d], 0xa
jne 0x41a6c1
dec eax
mov byte [ebp + eax - 0x1000c], bl
cmp byte [ebp - 0x1000c], bl
lea ecx, [ebp - 0x1000c]
je 0x41a6db
cmp byte [ecx], 0xa
jne 0x41a6d6
mov byte [ecx], bl
inc ecx
cmp byte [ecx], bl
jne 0x41a6cf
mov ecx, eax
add eax, 2
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
lea eax, [ebp - 0x1000c]
push eax
push 7
jmp 0x41a842
mov eax, dword [ebp + 0x18]
cmp byte [eax], bl
je 0x41a708
push eax
call fcn.00401f32
pop ecx
mov dword [ebp - 8], eax
jmp 0x41a70b
mov dword [ebp - 8], ebx
push 4
lea eax, [ebp - 8]
push eax
push 4
jmp 0x41a842
push dword [ebp + 0x18]
call fcn.00457520
pop ecx
mov dword [ebp + 8], eax
push 2
cdq
pop ecx
idiv ecx
test edx, edx
jne 0x41a867
xor edi, edi
xor esi, esi
cmp dword [ebp + 8], ebx
jle 0x41a794
cmp edi, 0xffff
jae 0x41a794
push 0x10
xor ecx, ecx
pop edx
mov eax, dword [ebp + 0x18]
mov al, byte [esi + eax]
cmp al, 0x30
jl 0x41a75e
cmp al, 0x39
jg 0x41a75e
movsx eax, al
sub eax, 0x30
jmp 0x41a77c
cmp al, 0x41
jl 0x41a76e
cmp al, 0x46
jg 0x41a76e
movsx eax, al
sub eax, 0x37
jmp 0x41a77c
cmp al, 0x61
jl 0x41a7c4
cmp al, 0x66
jg 0x41a7c4
movsx eax, al
sub eax, 0x57
imul eax, edx
add ecx, eax
inc esi
sub edx, 0xf
jns 0x41a748
mov byte [ebp + edi - 0x1000c], cl
inc edi
cmp esi, dword [ebp + 8]
jl 0x41a73b
push edi
lea eax, [ebp - 0x1000c]
push eax
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41a7c4
mov ecx, dword [0x466b78]
push 1
push ebx
push 0xffffffffffffffff
push 0x459724
call fcn.0040187e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x41a872
cmp byte [0x467399], bl
je 0x41a7fc
push 0xffff
push dword [ebp + 0x18]
lea eax, [ebp - 0x1000c]
push eax
call fcn.004392af
add esp, 0xc
lea esi, [ebp - 0x1000c]
jmp 0x41a7ff
mov esi, dword [ebp + 0x18]
push esi
call fcn.00457520
pop ecx
inc eax
push eax
push esi
push 2
jmp 0x41a842
cmp byte [0x467399], bl
je 0x41a834
push 0xffff
push dword [ebp + 0x18]
lea eax, [ebp - 0x1000c]
push eax
call fcn.004392af
add esp, 0xc
lea esi, [ebp - 0x1000c]
jmp 0x41a837
mov esi, dword [ebp + 0x18]
push esi
call fcn.00457520
pop ecx
inc eax
push eax
push esi
push edi
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41a867
mov ecx, dword [0x466b78]
push edi
push ebx
push 0xffffffffffffffff
push 0x459724
call fcn.0040187e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14