Function at 0x42cf10
Capabilities:
Set registry value

Disassembly:
sub esp, 0x1f0
push ebx
push ebp
mov ebp, ecx
push esi
lea ecx, [esp + 0x2c]
push edi
lea edx, [esp + 0x10]
push ecx
push edx
push 0
lea eax, [ebp + 0xcc]
push 0xf003f
push 0
push eax
lea eax, [ebp + 4]
push 0
push eax
push 0x80000002
mov dword [esp + 0x38], ebp
lea ebx, [ebp + 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x42cf83
mov ecx, dword [esp + 0x204]
push 0x10010
add ebp, 0x284
push 0x4763e0
push ebp
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f0
ret 8
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x18]
push str.Windows_drive
push edx
call esi
mov ecx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
push ebx
push 4
lea eax, [esp + 0x24]
push 0
push eax
push ecx
call edi
test eax, eax
je 0x42cfc8
push 0x10010
add ebp, 0x25c
push 0x4763e0
push ebp
jmp 0x42d33d
lea ecx, [esp + 0x18]
push str.Windows_directory
push ecx
call esi
lea ebp, [ebx + 0x21c]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
lea edx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push ebp
push 1
push 0
push edx
push eax
call edi
test eax, eax
je 0x42d035
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x204]
push 0x10010
add ecx, 0x25c
push 0x4763e0
push ecx
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f0
ret 8
lea ecx, [esp + 0x18]
push str.Source_drive
push ecx
call esi
mov ecx, dword [esp + 0x10]
lea edx, [ebx + 4]
push 4
push edx
push 4
lea eax, [esp + 0x24]
push 0
push eax
push ecx
call edi
test eax, eax
je 0x42d098
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x204]
push 0x10010
add edx, 0x25c
push 0x4763e0
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f0
ret 8
lea edx, [esp + 0x18]
push str.Target_drive
push edx
call esi
mov ecx, dword [esp + 0x10]
lea eax, [ebx + 8]
push 4
mov dword [esp + 0x30], eax
push eax
push 4
lea eax, [esp + 0x24]
push 0
push eax
push ecx
call edi
test eax, eax
je 0x42d0ff
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x204]
push 0x10010
add edx, 0x25c
push 0x4763e0
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f0
ret 8
lea edx, [esp + 0x18]
push str.Target_directory
push edx
call esi
lea ebp, [ebx + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x10]
inc eax
push eax
push ebp
push 1
lea eax, [esp + 0x24]
push 0
push eax
push ecx
call edi
test eax, eax
je 0x42d169
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x204]
push 0x10010
add edx, 0x25c
push 0x4763e0
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f0
ret 8
lea edx, [esp + 0x18]
push str.Source_directory
push edx
call esi
lea eax, [ebx + 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x10]
inc eax
push eax
lea eax, [ebx + 0x320]
push eax
push 1
lea eax, [esp + 0x24]
push 0
push eax
push ecx
call edi
test eax, eax
je 0x42d1dc
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x204]
push 0x10010
add edx, 0x25c
push 0x4763e0
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f0
ret 8
lea edx, [esp + 0x18]
push str.Installation
push edx
call esi
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x208]
add ebx, 0xc
push 4
push ebx
push 4
lea ecx, [esp + 0x24]
push 0
push ecx
push edx
mov dword [ebx], eax
call edi
test eax, eax
je 0x42d247
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x204]
push 0x10010
add eax, 0x25c
push 0x4763e0
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f0
ret 8
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x34]
push str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths
push ecx
call esi
lea edx, [esp + 0x34]
push 0x474f8c
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x34]
lea ebx, [eax + 0x1f8]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x30]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0xf003f
lea eax, [ecx + 0xcc]
push 0
push eax
lea edx, [esp + 0x4c]
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x42d2e9
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x204]
push 0x10010
add eax, 0x284
push 0x4763e0
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f0
ret 8
mov edx, dword [esp + 0x2c]
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push ebp
mov eax, dword [edx]
lea ecx, [esp + 0x104]
push eax
push 0x476408
push ecx
call ebx
mov eax, dword [esp + 0x24]
add esp, 0x14
lea edx, [esp + 0xfc]
push 0x104
push edx
push 1
push 0
push 0
push eax
call edi
test eax, eax
je 0x42d365
mov ecx, dword [esp + 0x14]
push 0x10010
add ecx, 0x25c
push 0x4763e0
push ecx
mov edx, dword [esp + 0x210]
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f0
ret 8
lea ecx, [esp + 0x18]
push str.Path
push ecx
call esi
mov edx, dword [esp + 0x2c]
push ebp
lea ecx, [esp + 0x100]
mov eax, dword [edx]
push eax
push str._c:_s_
push ecx
call ebx
mov ecx, dword [esp + 0x20]
add esp, 0x10
lea edx, [esp + 0xfc]
lea eax, [esp + 0x18]
push 0x104
push edx
push 1
push 0
push eax
push ecx
call edi
test eax, eax
je 0x42d3e9
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x204]
push 0x10010
add edx, 0x25c
push 0x4763e0
push edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1f0
ret 8
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1f0
ret 8