Function at 0x45f7b0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x20c
xor edx, edx
push ebp
push esi
push edi
mov edi, dword [esp + 0x21c]
mov cl, byte [edi]
cmp cl, 0x5c
je 0x45f7de
lea esi, [esp + 0x18]
mov eax, edi
sub esi, edi
mov byte [esi + eax], cl
mov cl, byte [eax + 1]
inc edx
inc eax
cmp cl, 0x5c
jne 0x45f7d1
mov byte [esp + edx + 0x18], 0
inc edx
add edx, edi
xor ecx, ecx
mov al, byte [edx]
test al, al
je 0x45f7fd
inc edx
mov byte [esp + ecx + 0x118], al
inc ecx
mov al, byte [edx]
test al, al
jne 0x45f7ee
mov byte [esp + ecx + 0x118], 0
mov dword [esp + 0x10], 0xffffffff
mov esi, str.HKEY_CURRENT_USER
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x45f83a
test cl, cl
je 0x45f836
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x45f83a
add eax, 2
add esi, 2
test cl, cl
jne 0x45f816
xor eax, eax
jmp 0x45f83f
sbb eax, eax
sbb eax, 0xffffffff
mov ebp, dword [esp + 0x224]
test eax, eax
jne 0x45f8c5
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x57d044
lea edx, [esp + 0x130]
push 0
push edx
push closesocket
mov dword [esp + 0x34], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x45fc25
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x10]
push ebp
push 1
push eax
mov eax, dword [esp + 0x230]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x45f8c5
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x20c
ret
mov esi, str.HKEY_CLASSES_ROOT
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x45f8f2
test cl, cl
je 0x45f8ee
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x45f8f2
add eax, 2
add esi, 2
test cl, cl
jne 0x45f8ce
xor eax, eax
jmp 0x45f8f7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x45f976
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x57d044
lea edx, [esp + 0x130]
push 0
push edx
push closesocket
mov dword [esp + 0x34], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x45fc25
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x10]
push ebp
push 1
push eax
mov eax, dword [esp + 0x230]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x45f976
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x20c
ret
mov esi, str.HKEY_LOCAL_MACHINE
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x45f9a3
test cl, cl
je 0x45f99f
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x45f9a3
add eax, 2
add esi, 2
test cl, cl
jne 0x45f97f
xor eax, eax
jmp 0x45f9a8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x45fa27
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x57d044
lea edx, [esp + 0x130]
push 0
push edx
push closesocket
mov dword [esp + 0x34], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x45fc25
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x10]
push ebp
push 1
push eax
mov eax, dword [esp + 0x230]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x45fa27
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x20c
ret
mov esi, str.HKEY_LOCAL_MACHINE
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x45fa54
test cl, cl
je 0x45fa50
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x45fa54
add eax, 2
add esi, 2
test cl, cl
jne 0x45fa30
xor eax, eax
jmp 0x45fa59
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x45fad8
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x57d044
lea edx, [esp + 0x130]
push 0
push edx
push closesocket
mov dword [esp + 0x34], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x45fc25
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x10]
push ebp
push 1
push eax
mov eax, dword [esp + 0x230]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x45fad8
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x20c
ret
mov esi, str.HKEY_USERS
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x45fb05
test cl, cl
je 0x45fb01
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x45fb05
add eax, 2
add esi, 2
test cl, cl
jne 0x45fae1
xor eax, eax
jmp 0x45fb0a
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x45fb89
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x57d044
lea edx, [esp + 0x130]
push 0
push edx
push reloc.WS2_32.dll_closesocket
mov dword [esp + 0x34], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x45fc25
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x10]
push ebp
push 1
push eax
mov eax, dword [esp + 0x230]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x45fb89
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x20c
ret
mov esi, str.HKEY_CURRENT_CONFIG
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x45fbb6
test cl, cl
je 0x45fbb2
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x45fbb6
add eax, 2
add esi, 2
test cl, cl
jne 0x45fb92
xor eax, eax
jmp 0x45fbbb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x45fc32
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0x57d044
lea edx, [esp + 0x130]
push 0
push edx
push getsockopt
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x45fc25
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x10]
push ebp
push esi
push eax
mov eax, dword [esp + 0x230]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x45fc36
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
or eax, 0xffffffff
pop ebp
add esp, 0x20c
ret
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x20c
ret