Function at 0x461140
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10010
call fcn.00488480
push esi
push edi
push 1
push 0
push 0xffffffffffffffff
mov edi, ecx
mov ecx, dword [0x4a13a4]
push 0x4916f4
mov esi, edx
call fcn.004668b0
test edi, edi
je 0x4613be
test esi, esi
je 0x4613be
cmp esi, 0xfffffffe
je 0x4613be
mov edx, dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x20006
push 0
push 0x49588a
push 0
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4613be
lea eax, [esi - 1]
cmp eax, 6
ja case.0x4611be.5
jmp dword [eax*4 + 0x4613cc]
mov eax, ebx
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4611d0
sub eax, edx
inc eax
push eax
push ebx
push 1
mov eax, dword [ebp + 0xc]
mov ecx, dword [esp + 0x14]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x461208
mov ecx, dword [0x4a13a4]
push 1
push eax
push 0xffffffffffffffff
push 0x4900b0
call fcn.004668b0
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x461225
sub eax, edx
inc eax
push eax
push ebx
push 2
jmp 0x4611de
push 0xfffd
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.0047a8e0
lea eax, [esp + 0x24]
add esp, 0xc
mov byte [esp + 0x10015], 0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x461257
sub eax, edx
mov byte [esp + eax + 0x19], cl
je 0x461272
cmp byte [esp + eax + 0x17], 0xa
jne 0x461272
dec eax
mov byte [esp + eax + 0x18], cl
cmp byte [esp + 0x18], 0
lea ecx, [esp + 0x18]
je 0x46128e
lea ecx, [ecx]
cmp byte [ecx], 0xa
jne 0x461288
mov byte [ecx], 0
inc ecx
cmp byte [ecx], 0
jne 0x461280
test eax, eax
je 0x461297
add eax, 2
jmp 0x461299
xor eax, eax
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x1c]
push ecx
push 7
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4612cb
mov ecx, dword [0x4a13a4]
push 1
push eax
push 0xffffffffffffffff
push 0x4900b0
call fcn.004668b0
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
cmp byte [ebx], 0
je 0x461301
mov esi, ebx
call fcn.00411cd0
push 4
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], eax
push 4
jmp 0x4611de
push 4
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], 0
push 4
jmp 0x4611de
mov eax, ebx
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x461320
sub eax, edx
mov ecx, eax
and ecx, 0x80000001
mov dword [esp + 0x10], eax
jns 0x46133c
dec ecx
or ecx, 0xfffffffe
inc ecx
jne 0x461208
xor edi, edi
xor esi, esi
test eax, eax
jle 0x4613a6
cmp edi, 0xffff
jae 0x4613a6
xor edx, edx
lea ecx, [edx + 0x10]
mov al, byte [esi + ebx]
cmp al, 0x30
jl 0x46136a
cmp al, 0x39
jg 0x46136a
movsx eax, al
sub eax, 0x30
jmp 0x461390
cmp al, 0x41
jl 0x46137a
cmp al, 0x46
jg 0x46137a
movsx eax, al
sub eax, 0x37
jmp 0x461390
cmp al, 0x61
jl 0x4612cb
cmp al, 0x66
jg 0x4612cb
movsx eax, al
sub eax, 0x57
imul eax, ecx
add edx, eax
inc esi
sub ecx, 0xf
jns 0x461357
mov byte [esp + edi + 0x18], dl
inc edi
cmp esi, dword [esp + 0x10]
jl 0x46134a
push edi
lea edx, [esp + 0x1c]
push edx
push 3
jmp 0x4611de
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8