Function at 0x416b70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x7fe
mov esi, ecx
push eax
lea ecx, [ebp - 0x802]
push ecx
mov word [ebp - 0x804], ax
call fcn.00423160
mov dx, word [esi]
and dx, 0xf
add dx, dx
add dx, dx
movzx edi, dx
lea eax, [edi + 8]
add esp, 0xc
cmp dword [ebp + 8], eax
jge 0x416c4d
lea ecx, [ebp - 0x808]
push ecx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x416c2b
push str.9999
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0x808]
add eax, eax
push eax
push str.9999
push 1
push 0
push str.SlDeep
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x416c2b
mov eax, dword [ebp - 0x808]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x808]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
cmp byte [edi + esi], 0
je 0x416ce3
lea edx, [ebp - 0x808]
push edx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x416cc1
push str.9999
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
mov eax, dword [ebp - 0x808]
push str.9999
push 1
push 0
push str.SlDeep
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x416cc1
mov ecx, dword [ebp - 0x808]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x808]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp word [edi + esi + 4], ax
je 0x416d24
lea eax, [ebp - 0x808]
push eax
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x416c2b
lea esi, [ebp - 0x808]
mov edi, str.9999
call fcn.00416b30
jmp 0x416c38
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [edi + esi + 8]
lea edx, [ebp - 0x804]
push eax
push 0x43f9f4
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x416d82
lea esi, [ebp - 0x808]
lea edi, [ebp - 0x804]
call fcn.00416b30
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x808]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0041fcee
mov esp, ebp
pop ebp
ret