Function at 0x40bf60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5064c8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x565680]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
or esi, 0xffffffff
cmp dword [0x566ba0], 0
mov dword [ebp - 4], 1
je 0x40c0de
cmp dword [0x566ba4], 0
je 0x40c0de
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1c]
push 0x566cec
push eax
call fcn.00402a20
add esp, 0xc
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.004026b0
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40bfee
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x5651b8]
mov ecx, 0x5651b8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [0x566ba4]
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 8]
push eax
mov byte [ebp - 4], 3
call fcn.0041f8f0
push dword [ebp - 0x14]
lea ecx, [ebp + 8]
call fcn.004027b0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x1c]
push 0x566cec
push eax
call fcn.00402a20
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 4
call fcn.004026b0
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c067
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x5651b8]
mov ecx, 0x5651b8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov ecx, dword [0x566ba4]
push 0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0xc]
push eax
mov byte [ebp - 4], 5
call fcn.0041f8f0
push dword [ebp - 0x18]
lea ecx, [ebp + 0xc]
call fcn.004027b0
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov byte [ebp - 4], 3
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c0be
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c0de
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x5651b8]
xor ebx, ebx
cmp byte [0x566b9c], bl
mov ecx, 0x5651b8
sete bl
add ebx, 0x80000001
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
cmp byte [ebp + 0x14], 0
mov byte [ebp - 4], 6
je 0x40c16f
cmp byte [0x56002c], 0
jne 0x40c16f
mov eax, dword [0x566ce4]
cmp dword [eax - 0xc], 0
jne 0x40c127
mov ebx, SysReAllocStringLen
jmp 0x40c16f
push 0x519f08
lea eax, [ebp - 0x1c]
push 0x566ce4
push eax
mov ebx, SysStringLen
call fcn.00402ae0
add esp, 0xc
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 7
call fcn.004026b0
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov byte [ebp - 4], 6
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c16f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov eax, dword [0x5651b8]
mov ecx, 0x5651b8
mov byte [ebp - 4], 8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov ecx, dword [0x566ac0]
mov byte [ebp - 4], 9
lea edx, [ecx + 2]
lea eax, [ecx + 1]
imul edx, eax
imul edx, ecx
and edx, reloc.OLEAUT32.dll_VariantInit
jns 0x40c1be
dec edx
or edx, 0xfffffff8
inc edx
cmp edx, 5
jne 0x40c1cb
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov eax, dword [0x5651b8]
mov ecx, 0x5651b8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov edi, str.Software_
shr edi, 0x10
mov byte [ebp - 4], 0xa
mov eax, str.Software_
test edi, edi
jne 0x40c218
movzx eax, ax
push edi
push eax
call fcn.00402f50
add esp, 8
test eax, eax
je 0x40c225
mov edx, str.Software_
movzx ecx, dx
push ecx
push eax
lea ecx, [ebp - 0x14]
call fcn.004073a0
jmp 0x40c225
push str.Software_
lea ecx, [ebp - 0x14]
call fcn.004027b0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0xb
call fcn.00402a20
push 0x566ce8
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0xc
call fcn.00402a20
push 0x519f08
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0xd
call fcn.00402ae0
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0xe
call fcn.00402a20
add esp, 0x30
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0xf
call fcn.004026b0
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xe
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c2a2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xd
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c2c2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xc
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c2e2
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
mov byte [ebp - 4], 0xb
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c302
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov byte [ebp - 4], 9
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c322
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [0x5651b8]
mov ecx, 0x5651b8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0x10
test edi, edi
jne 0x40c360
mov eax, str.Software_
movzx edi, ax
push 0
push edi
call fcn.00402f50
add esp, 8
test eax, eax
je 0x40c36d
push edi
push eax
lea ecx, [ebp - 0x14]
call fcn.004073a0
jmp 0x40c36d
push str.Software_
lea ecx, [ebp - 0x14]
call fcn.004027b0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
mov byte [ebp - 4], 0x11
call fcn.00402a20
push 0x566ce8
push eax
lea eax, [ebp - 0x24]
push eax
mov byte [ebp - 4], 0x12
call fcn.00402a20
push 0x519f08
push eax
lea eax, [ebp - 0x28]
push eax
mov byte [ebp - 4], 0x13
call fcn.00402ae0
lea ecx, [ebp + 8]
push ecx
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 0x14
call fcn.00402a20
add esp, 0x30
lea ecx, [ebp - 0x38]
push 0
push 0
push 0x20006
push 0
push 0
push dword [eax]
push ebx
call fcn.0040a620
mov edx, dword [ebp - 0x2c]
test eax, eax
setne bl
add edx, 0xfffffff0
mov ecx, esi
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c3f6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x28]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x13
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c416
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x12
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c436
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
mov byte [ebp - 4], 0x11
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c456
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
mov byte [ebp - 4], 9
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c476
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40c4a8
mov ecx, dword [0x566ac0]
mov eax, ecx
imul eax, ecx
cdq
mov edi, 0xe
idiv edi
mov edi, dword [ebp - 0x38]
cmp edx, 6
jne 0x40c4ff
inc ecx
mov dword [0x566ac0], ecx
mov byte [ebp - 0xd], 0
jmp 0x40c522
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp - 0x38]
push 4
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 4
push 0
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x40c505
mov ecx, dword [0x566ac0]
lea eax, [ecx + 1]
imul eax, ecx
cdq
mov ecx, 0x13
idiv ecx
cmp edx, 0x11
jne 0x40c4ec
call fcn.004e5d44
mov dword [0x566ac0], eax
test edi, edi
je 0x40c4f8
push edi
call ebx
xor edi, edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], 0
mov byte [ebp - 0xd], 0
jmp 0x40c522
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x40c517
push edi
call ebx
xor edi, edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], 0
mov byte [ebp - 0xd], 1
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
mov byte [ebp - 4], 8
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c542
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x40c549
push edi
call ebx
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c569
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp + 8]
add edx, 0xfffffff0
mov byte [ebp - 4], 0
lea eax, [edx + 0xc]
mov ecx, esi
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40c589
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp + 0xc]
add edi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], esi
dec esi
test esi, esi
jg 0x40c5aa
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, byte [ebp - 0xd]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret