Function at 0x40ee70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44fd97
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x469644]
xor eax, esp
mov dword [esp + 0x428], eax
push ebx
push esi
push edi
mov eax, dword [0x469644]
xor eax, esp
push eax
lea eax, [esp + 0x440]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
call fcn.0041c4e4
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40eed7
push 0x80004005
call fcn.00401470
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x18], eax
mov dword [esp + 0x448], ebx
call fcn.0041c4e4
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40ef08
push 0x80004005
call fcn.00401470
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push ebx
mov byte [esp + 0x454], 2
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push str.SoftwareCLIENTCHARGE
push SysReAllocStringLen
mov dword [esp + 0x30], 0x400
mov dword [esp + 0x28], ebx
call esi
cmp eax, ebx
jne 0x40efcd
mov edi, dword [esp + 0x14]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x14]
push ecx
push 0x2001f
push ebx
push str.SoftwareCLIENTCHARGE
push SysReAllocStringLen
mov dword [esp + 0x28], ebx
call esi
cmp eax, ebx
jne 0x40efa3
xor eax, eax
cmp edi, ebx
je 0x40ef8d
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], ebx
cmp eax, ebx
je 0x40f0c5
mov edi, edx
push ebx
push ebx
push 0x45a784
call fcn.00420bc4
call fcn.0041c4e4
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40f098
push 0x80004005
call fcn.00401470
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SoftwareCLIENTCHARGE
push SysReAllocStringLen
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x40f00b
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], ebx
mov edi, ecx
jmp 0x40ef61
push ebx
push ebx
push 0x45a770
call fcn.00420bc4
call fcn.0041c4e4
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40f031
push 0x80004005
call fcn.00401470
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov esi, dword [esp + 0x28]
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x448], bl
lea eax, [edi - 0x10]
or edx, 0xffffffff
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f066
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x448], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f091
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
jmp 0x40f236
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
mov esi, dword [esp + 0x28]
add eax, 0x10
mov dword [esi], eax
cmp edi, ebx
je 0x40f0b5
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x448], bl
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
jmp 0x40f04d
lea ecx, [esp + 0x20]
push ecx
lea edi, [esp + 0x20]
lea esi, [esp + 0x38]
call fcn.0040f4c0
cmp dword [esp + 0x1c], ebx
jbe 0x40f123
mov edx, esi
push edx
lea ecx, [esp + 0x20]
call fcn.004015d0
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44c], 3
call fcn.004025c0
mov byte [esp + 0x448], 2
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f123
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
cmp dword [ecx - 0xc], ebx
jne 0x40f1a4
lea edx, [esp + 0x1c]
push edx
call fcn.0040f260
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x44c], 4
call fcn.004025c0
mov byte [esp + 0x448], 2
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f170
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov esi, dword [esp + 0x18]
xor eax, eax
cmp esi, ebx
setne al
cmp eax, ebx
jne 0x40f189
push 0x80004005
call fcn.00401470
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
mov esi, dword [esp + 0x1c]
push 1
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x40f1a8
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x40f1bb
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [esp + 0x20], edi
jmp 0x40f1bf
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
add esi, 0xfffffff0
push esi
mov dword [esp + 0x28], ebx
call fcn.00402660
mov ecx, dword [esp + 0x2c]
add eax, 0x10
add esp, 4
mov dword [ecx], eax
cmp edi, ebx
je 0x40f1e7
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x448], bl
mov eax, dword [esp + 0x2c]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40f20e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x448], 0xffffffff
lea ecx, [esi + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40f232
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
call edx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x428]
xor ecx, esp
call fcn.004366ef
mov esp, ebp
pop ebp
ret 4