Function at 0x40eccc
Capabilities:
Print debug messages
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd0
mov ebp, edx
mov dword [esp], eax
mov eax, pe_nt_image_headers32
call fcn.00408b1c
mov edi, eax
mov eax, 0x200
call fcn.00408b1c
mov esi, eax
mov eax, 0x80
call fcn.00408b1c
mov ebx, eax
call fcn.00408f38
test al, al
je 0x40ed29
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x10]
push eax
push 0x40f030
push edi
call sub.ntdll.dll_swprintf
add esp, 0x1c
jmp 0x40ed4b
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 0x10]
push eax
push 0x40f090
push edi
call sub.ntdll.dll_swprintf
add esp, 0x1c
push 0x40f0f0
push esi
call sub.ntdll.dll_wcscpy
add esp, 8
push edi
push esi
call sub.ntdll.dll_wcscat
add esp, 8
push esi
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0
push 0
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
mov ecx, 0x40
call fcn.00407d20
mov byte [esp + 0x14], 0
lea eax, [esp + 0x18]
push eax
push 0x20019
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_NtOpenKey
test eax, eax
jne 0x40edb0
mov eax, dword [esp + 4]
push eax
call sub.ntdll.dll_NtClose
mov byte [esp + 0x14], 1
push 0
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
push 0x2001f
lea eax, [esp + 0x1c]
push eax
call sub.ntdll.dll_NtCreateKey
test eax, eax
jne 0x40f012
push 0x40f170
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
call fcn.00408f38
test al, al
je 0x40edf6
mov dword [esp + 0x10], 0xa0
jmp 0x40edfe
mov dword [esp + 0x10], 0xe0
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_NtSetValueKey
push 0x40f18c
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
xor eax, eax
mov dword [esp + 0x10], eax
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_NtSetValueKey
cmp byte [esp + 0x14], 0
jne 0x40f008
push 0x40f1a4
call sub.ntdll.dll_DbgPrint
pop ecx
push 0x40f1c4
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0x40f1d0
push ebx
call sub.ntdll.dll_wcscpy
add esp, 8
push ebx
call sub.ntdll.dll_wcslen
pop ecx
add eax, eax
push eax
push ebx
push 1
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_NtSetValueKey
push 0x40f1e0
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0x40f1f4
push ebx
call sub.ntdll.dll_wcscpy
add esp, 8
push ebx
call sub.ntdll.dll_wcslen
pop ecx
add eax, eax
push eax
push ebx
push 1
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_NtSetValueKey
push 0x40f244
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0x40f25c
push ebx
call sub.ntdll.dll_wcscpy
add esp, 8
push ebx
call sub.ntdll.dll_wcslen
pop ecx
add eax, eax
push eax
push ebx
push 1
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_NtSetValueKey
push 0x40f27c
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0x40f28c
push ebx
call sub.ntdll.dll_wcscpy
add esp, 8
push ebx
call sub.ntdll.dll_wcslen
pop ecx
add eax, eax
push eax
push ebx
push 1
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_NtSetValueKey
push 0x40f2e4
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0x40f2ec
push ebx
call sub.ntdll.dll_wcscpy
add esp, 8
push ebx
call sub.ntdll.dll_wcslen
pop ecx
add eax, eax
push eax
push ebx
push 1
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_NtSetValueKey
push 0x40f300
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0x40f310
push ebx
call sub.ntdll.dll_wcscpy
add esp, 8
push ebx
call sub.ntdll.dll_wcslen
pop ecx
add eax, eax
push eax
push ebx
push 1
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_NtSetValueKey
push 0x40f320
lea eax, [esp + 0xc]
push eax
call sub.ntdll.dll_RtlInitUnicodeString
push 0x80
push ebx
call sub.ntdll.dll_RtlZeroMemory
push 0x40f338
push ebx
call sub.ntdll.dll_wcscpy
add esp, 8
push ebx
call sub.ntdll.dll_wcslen
pop ecx
add eax, eax
add eax, 4
push eax
push ebx
push 7
push 0
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.ntdll.dll_NtSetValueKey
mov eax, dword [esp + 4]
push eax
call sub.ntdll.dll_NtClose
mov eax, edi
call fcn.00408b30
mov eax, esi
call fcn.00408b30
mov eax, ebx
call fcn.00408b30
add esp, 0x30
pop ebp
pop edi
pop esi
pop ebx
ret