Function at 0x405848
Capabilities:
Set registry value

Disassembly:
push ebp
push ebx
push edi
mov edx, 0x11
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x405850
call fcn.00489fe0
mov edx, dword [esp + 0x58]
lea ecx, [esp]
call fcn.00440000
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 4]
call fcn.00440000
mov edx, dword [esp + 0x60]
lea ecx, [esp + 8]
call fcn.00440000
mov dword [esp + 0x10], 0x20006
cmp dword [esp + 0x68], 0
je 0x4058a5
mov ebx, dword [esp + 0x10]
or ebx, 0x100
mov dword [esp + 0x10], ebx
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.00487720
call fcn.0048a040
mov edx, 0x546960
call fcn.00440330
mov ecx, eax
call fcn.00440340
je 0x40590b
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push dword [esp + 8]
call fcn.00487790
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.004877c0
lea eax, [esp + 4]
push eax
call fcn.00489f10
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push 1
push dword [esp + 0xc]
call fcn.004877c0
call fcn.0048a040
mov edx, 0x546960
call fcn.00440330
mov ecx, eax
call fcn.00440340
je 0x405971
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
push dword [esp + 8]
call fcn.00487790
mov ebx, eax
dec ebx
push ebx
push dword [esp + 0xc]
call fcn.00487720
lea eax, [esp + 4]
push eax
call fcn.00489f10
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x4059ee
mov ebx, dword [esp + 0x64]
cmp ebx, 3
je 0x405997
push 0x560bdc
push 0x24
push dword [esp + 0x74]
call fcn.00488d30
jmp 0x4059ee
mov ebp, dword [esp + 0x6c]
mov dword [ebp], 0
mov ebp, dword [esp + 0x6c]
mov dword [ebp + 8], 0
mov ebp, dword [esp + 0x6c]
mov edx, 0x544028
lea ecx, [ebp + 0xc]
call fcn.00440008
mov ebp, dword [esp + 0x6c]
mov dword [ebp + 0x10], 0
mov ebp, dword [esp + 0x6c]
lea eax, [ebp + 0x14]
mov dword [eax + 4], 0
mov dword [eax], 0
mov ebp, dword [esp + 0x6c]
mov edx, 0x544028
lea ecx, [ebp + 0x20]
call fcn.00440008
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x1c]
push 0
xor eax, eax
push eax
push 0
push dword [esp + 0x1c]
push dword [esp + 0x74]
call sub.ADVAPI32.dll_RegCreateKeyExW
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x405a6e
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x405a57
push dword [esp + 0xc]
mov ebp, dword [esp + 0x70]
pop dword [ebp + 8]
push edx
call fcn.00489e70
pop edx
push eax
push dword [esp + 0x10]
call fcn.004069fc
mov ebp, dword [esp + 0x70]
lea eax, [ebp + 0xc]
push eax
call fcn.00489f10
cmp dword [esp + 0x14], 0
je 0x405a67
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
jmp 0x405e56
push dword [esp + 0x64]
mov ebx, 3
cmp ebx, dword [esp]
jne 0x405b79
mov ebx, dword [esp + 0x70]
and ebx, ebx
jne 0x405abf
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x405aac
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xfffffffd
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_Required_Ret.RegValue_parameter_not_found_
lea ecx, [ebp + 0xc]
call fcn.00440008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x405e56
mov ebp, dword [esp + 0x70]
mov eax, dword [ebp + 4]
cdq
push edx
push eax
pop dword [esp + 0x24]
pop dword [esp + 0x24]
mov ebp, dword [esp + 0x70]
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x1c], eax
mov ebx, dword [esp + 0x1c]
and ebx, ebx
jne 0x405b1b
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x405b08
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xfffffffe
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_No_Pointer_to_BINARY_defined_
lea ecx, [ebp + 0xc]
call fcn.00440008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x405e56
push dword [esp + 0x24]
push dword [esp + 0x24]
pop ebx
pop edi
cmp ebx, 0
jne 0x405b2f
cmp edi, 0
je 0x405b33
xor eax, eax
jmp 0x405b38
mov eax, 1
or eax, eax
je 0x405b50
push dword [esp + 0x1c]
call fcn.00488d40
cdq
push edx
push eax
pop dword [esp + 0x24]
pop dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push eax
push dword [esp + 0x20]
push 3
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x405e08
mov ebx, 4
cmp ebx, dword [esp]
jne 0x405bba
push dword [esp + 0xc]
call fcn.00487840
mov dword [esp + 0x3c], eax
push 4
lea eax, [esp + 0x40]
push eax
push 4
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x405e08
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x405c01
push dword [esp + 0xc]
call fcn.00487840
push edx
push eax
pop dword [esp + 0x44]
pop dword [esp + 0x44]
push 8
lea eax, [esp + 0x44]
push eax
push 0xb
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x405e08
mov ebx, 2
cmp ebx, dword [esp]
je 0x405c15
mov ebx, 1
cmp ebx, dword [esp]
jne 0x405c48
push dword [esp + 0xc]
call fcn.00487980
mov ebx, eax
add ebx, 2
push ebx
mov eax, dword [esp + 0x10]
push eax
push dword [esp + 0x70]
push 0
push dword [esp + 0x18]
push dword [esp + 0x2c]
call sub.ADVAPI32.dll_RegSetValueExW
mov dword [esp + 0x10], eax
jmp 0x405e08
mov ebx, 7
cmp ebx, dword [esp]
jne 0x405e08
mov eax, 0x544628
push eax
push dword [esp + 0x10]
call fcn.004879b0
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0
jmp 0x405c73
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x30]
jl 0x405ce1
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
mov eax, 0x544628
push eax
mov ebx, dword [esp + 0x3c]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.00487a40
lea eax, [esp + 0x38]
push eax
call fcn.00489f10
push dword [esp + 0x24]
push dword [esp + 0x24]
push 0x19
push dword [esp + 0x40]
call fcn.00487b70
cdq
add dword [esp], eax
adc dword [esp + 4], edx
add dword [esp], 2
adc dword [esp + 4], 0
pop dword [esp + 0x24]
pop dword [esp + 0x24]
inc dword [esp + 0x30]
jno 0x405c73
push dword [esp + 0x24]
push dword [esp + 0x24]
pop ebx
pop edi
cmp ebx, 0
jne 0x405cf9
cmp edi, 0
jne 0x405cf9
xor eax, eax
jmp 0x405cfe
mov eax, 1
or eax, eax
je 0x405e08
mov eax, dword [esp + 0x20]
push eax
call fcn.00488da0
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0
je 0x405dd4
mov dword [esp + 0x30], 0
jmp 0x405d29
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x30]
jl 0x405d9f
push edx
call fcn.00489e70
pop edx
push eax
push edx
call fcn.00489e70
pop edx
push eax
mov eax, 0x544628
push eax
mov ebx, dword [esp + 0x3c]
inc ebx
push ebx
push dword [esp + 0x1c]
call fcn.00487a40
lea eax, [esp + 0x38]
push eax
call fcn.00489f10
push 0x19
push 0xffffffff
push dword [esp + 0x3c]
mov ebx, dword [esp + 0x28]
add ebx, dword [esp + 0x44]
push ebx
call fcn.00488dc0
mov ebx, dword [esp + 0x38]
push 0x19
push dword [esp + 0x38]
call fcn.00487b70
add ebx, eax
add ebx, 2
mov dword [esp + 0x38], ebx
inc dword [esp + 0x30]
jno 0x405d29
sub esp, 4
mov eax, dword [esp + 0x24]
push eax
push dword [esp + 0x24]
push dword [esp + 0x74]
push 0
push dword [esp + 0x1c]
push dword [esp + 0x30]
call dword [0x6eb3a0]
add esp, 4
mov dword [esp + 0x10], eax
push dword [esp + 0x1c]
call fcn.00488f10
jmp 0x405e08
mov ebx, dword [esp + 0x70]
and ebx, ebx
je 0x405df8
mov ebp, dword [esp + 0x70]
mov dword [ebp + 8], 0xffffffff
mov ebp, dword [esp + 0x70]
mov edx, str.Error:_Cant_allocate_memory
lea ecx, [ebp + 0xc]
call fcn.00440008
push dword [esp + 0x18]
call sub.ADVAPI32.dll_RegCloseKey
xor eax, eax
add esp, 4
jmp 0x405e56
pop eax
push dword [esp + 0x14]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [esp + 0xc], 0
je 0x405e4e
mov ebx, dword [esp + 0x6c]
and ebx, ebx
je 0x405e4a
push dword [esp + 0xc]
mov ebp, dword [esp + 0x70]
pop dword [ebp + 8]
push edx
call fcn.00489e70
pop edx
push eax
push dword [esp + 0x10]
call fcn.004069fc
mov ebp, dword [esp + 0x70]
lea eax, [ebp + 0xc]
push eax
call fcn.00489f10
xor eax, eax
jmp 0x405e56
mov eax, dword [esp + 0x28]
jmp 0x405e56
push dword [esp + 0x30]
call fcn.0048a070
push dword [esp]
call fcn.0048a070
push dword [esp + 8]
call fcn.0048a070
push dword [esp + 4]
call fcn.0048a070
add esp, 0x44
pop edi
pop ebx
pop ebp
ret 0x1c