Function at 0x402690
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x308
lea eax, [esp]
push ebx
mov dword [esp + 4], 0x80000000
push esi
push edi
push ebp
push eax
push 0x40a064
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40292c
mov eax, dword [0x41d2fc]
mov ebx, dword [esp + 0x31c]
shl eax, 4
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [eax + ebx + 0xc]
lea ebp, [eax + ebx]
push esi
call edi
mov ecx, dword [esp + 0x10]
push eax
push esi
mov eax, dword [ebp]
push 1
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov esi, dword [esp + 0x320]
cmp byte [esi], 0
je 0x40279e
lea eax, [esp + 0x14]
lea ecx, [esp + 0x118]
mov edx, dword [esp + 0x10]
push eax
mov dword [esp + 0x18], 0x100
push ecx
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x402770
lea eax, [esp + 0x218]
push str.Save
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x218]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x118]
push eax
call edi
lea ecx, [esp + 0x218]
push eax
lea eax, [esp + 0x11c]
mov edx, dword [esp + 0x14]
push eax
push 1
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov eax, dword [0x41d2fc]
shl eax, 4
mov ebp, dword [eax + ebx]
push ebp
call edi
mov ecx, dword [esp + 0x10]
push eax
push ebp
push 1
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
push esi
call edi
lea esi, [eax + esi + 1]
cmp byte [esi], 0
jne 0x402701
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x10]
mov eax, dword [0x41d2fc]
shl eax, 4
push ecx
mov ecx, dword [eax + ebx]
push ecx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40292c
mov ebp, dword [esp + 0x324]
lea eax, [esp + 0x18]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x18]
push eax
call edi
mov cl, byte [esp + eax + 0x17]
cmp cl, 0x5c
je 0x402802
lea eax, [esp + 0x18]
push 0x40a04c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [0x41d2fc]
lea edx, [esp + 0x18]
shl eax, 4
mov ecx, dword [eax + ebx + 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x18]
push ecx
call edi
lea ecx, [esp + 0x18]
push eax
mov edx, dword [esp + 0x14]
push ecx
push 1
push str.defaultIcon
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
lea ecx, [esp + 0x18]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x18]
push ecx
call edi
mov cl, byte [esp + eax + 0x17]
cmp cl, 0x5c
je 0x402865
lea eax, [esp + 0x18]
push 0x40a04c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [0x41d2fc]
lea edx, [esp + 0x18]
shl eax, 4
mov ecx, dword [eax + ebx + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x18]
push ecx
call edi
lea ecx, [esp + 0x18]
push eax
mov edx, dword [esp + 0x14]
push ecx
push 1
push str.Shellopencommand
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
lea ecx, [esp + 0x18]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x18]
push ecx
call edi
mov cl, byte [esp + eax + 0x17]
cmp cl, 0x5c
je 0x4028c8
lea eax, [esp + 0x18]
push 0x40a04c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [0x41d2fc]
lea edx, [esp + 0x18]
shl eax, 4
mov ecx, dword [eax + ebx + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [0x41d2fc]
lea edx, [esp + 0x98]
shl eax, 4
mov ecx, dword [eax + ebx + 0xc]
push ecx
push str.Shell_scommand
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x24]
add esp, 0xc
push ecx
call edi
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x9c]
push ecx
mov eax, dword [esp + 0x18]
push 1
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov ecx, dword [esp + 0x10]
push ecx
call esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x308
ret