Function at 0x409450
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
lea esp, [esp]
push 0x18a
call fcn.00414f9a
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
test edi, edi
je 0x409460
push 0x6f
call fcn.004051a0
mov eax, dword [0x42f218]
mov esi, dword [eax + 0x1bc]
add esp, 4
cmp dword [0x42f4b4], 0
jne 0x4094b9
call fcn.0040a550
test eax, eax
je 0x4094af
dec eax
cmp eax, 1
ja 0x4094b9
mov dword [0x42f4b4], 0x80000002
jmp 0x4094b9
mov dword [0x42f4b4], 0x80000001
mov edx, dword [0x42f4b4]
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push esi
xor bl, bl
push edx
mov byte [edi], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x40950a
lea ecx, [ebp - 8]
push ecx
push edi
push 0
push 0
push 0
push eax
mov dword [ebp - 8], 0x18a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4094fc
mov bl, 1
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x40950d
mov byte [edi], 0
call fcn.0040ac70
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409515
sub eax, edx
lea esi, [eax + 0x86]
push esi
call fcn.00414f9a
mov ebx, eax
add esp, 4
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x409524
push 0x2a
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0xa8]
add esp, 4
push eax
call fcn.0040ac70
push eax
push str.__s___s____1____
push ebx
call fcn.0041512c
add esp, 0x10
mov ecx, ebx
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x409584
test dl, dl
je 0x409580
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x409584
add eax, 2
add ecx, 2
test dl, dl
jne 0x409564
xor eax, eax
jmp 0x409589
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40a0e4
call fcn.0040b320
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4095a0
sub eax, edx
lea esi, [eax + 0x80]
nop
push esi
call fcn.00414f9a
mov ebx, eax
add esp, 4
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x4095b0
call fcn.0040ac70
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4095d0
sub eax, edx
lea edi, [eax + 0x80]
nop
push edi
call fcn.00414f9a
mov esi, eax
add esp, 4
test esi, esi
je 0x4095e0
push 0x71
call fcn.004051a0
mov ecx, dword [0x42f218]
mov edi, dword [ecx + 0x1c4]
call fcn.0040b320
push eax
push edi
push ebx
call fcn.0041512c
push 0x69
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x1a4]
mov edx, esi
add esp, 0x14
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x409630
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409640
sub eax, edx
cmp dword [0x42f4b4], 0
mov edi, eax
jne 0x409679
call fcn.0040a550
test eax, eax
je 0x40966f
dec eax
cmp eax, 1
ja 0x409679
mov dword [0x42f4b4], 0x80000002
jmp 0x409679
mov dword [0x42f4b4], 0x80000001
mov ecx, dword [0x42f4b4]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 8]
test eax, eax
je 0x4096ba
push edi
push esi
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x71
call fcn.004051a0
mov eax, dword [0x42f218]
mov edi, dword [eax + 0x1c4]
call fcn.0040b320
push eax
push edi
push ebx
call fcn.0041512c
push 0x6b
call fcn.004051a0
mov ecx, dword [0x42f218]
mov eax, dword [ecx + 0x1ac]
mov edx, esi
add esp, 0x14
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4096f3
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409702
sub eax, edx
push 0x6a
mov edi, eax
call fcn.004051a0
mov edx, dword [0x42f218]
mov ebx, dword [edx + 0x1a8]
add esp, 4
cmp dword [0x42f4b4], 0
jne 0x409751
call fcn.0040a550
test eax, eax
je 0x409747
dec eax
cmp eax, 1
ja 0x409751
mov dword [0x42f4b4], 0x80000002
jmp 0x409751
mov dword [0x42f4b4], 0x80000001
mov ecx, dword [ebp - 4]
mov edx, dword [0x42f4b4]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 8]
test eax, eax
je 0x409794
push edi
push esi
push 1
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x72
call fcn.004051a0
mov ecx, dword [0x42f218]
mov edi, dword [ecx + 0x1c8]
call fcn.0040b320
mov edx, dword [ebp - 4]
push eax
push edi
push edx
call fcn.0041512c
mov ax, word [0x42a6f8]
mov word [esi], ax
mov cl, byte [0x42a6fa]
mov eax, esi
add esp, 0x10
mov byte [esi + 2], cl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4097d1
sub eax, edx
cmp dword [0x42f4b4], 0
mov edi, eax
jne 0x40980a
call fcn.0040a550
test eax, eax
je 0x409800
dec eax
cmp eax, 1
ja 0x40980a
mov dword [0x42f4b4], 0x80000002
jmp 0x40980a
mov dword [0x42f4b4], 0x80000001
mov eax, dword [ebp - 4]
mov ecx, dword [0x42f4b4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push eax
push ecx
call ebx
mov eax, dword [ebp - 8]
test eax, eax
je 0x409850
push edi
push esi
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x73
call fcn.004051a0
mov eax, dword [0x42f218]
mov edi, dword [eax + 0x1cc]
call fcn.0040b320
mov ecx, dword [ebp - 4]
push eax
push edi
push ecx
call fcn.0041512c
add esp, 0x10
call fcn.0040a550
test eax, eax
jne 0x409896
push 0x7e
call fcn.004051a0
mov edx, dword [0x42f218]
mov edi, dword [edx + 0x1f8]
add esp, 4
jmp 0x40989b
mov edi, 0x4275bc
push 0x2a
call fcn.004051a0
mov eax, dword [0x42f218]
mov eax, dword [eax + 0xa8]
add esp, 4
push eax
push edi
call fcn.0040ac70
push eax
push str.__s___s__s____1____
push esi
call fcn.0041512c
mov eax, esi
add esp, 0x14
lea edx, [eax + 1]
jmp 0x4098d0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4098d0
sub eax, edx
cmp dword [0x42f4b4], 0
mov edi, eax
jne 0x409909
call fcn.0040a550
test eax, eax
je 0x4098ff
dec eax
cmp eax, 1
ja 0x409909
mov dword [0x42f4b4], 0x80000002
jmp 0x409909
mov dword [0x42f4b4], 0x80000001
mov edx, dword [ebp - 4]
mov eax, dword [0x42f4b4]
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push edx
push eax
call ebx
mov eax, dword [ebp - 8]
test eax, eax
je 0x409948
push edi
push esi
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x73
call fcn.004051a0
mov edx, dword [0x42f218]
mov edi, dword [edx + 0x1cc]
call fcn.0040b320
push eax
mov eax, dword [ebp - 4]
push edi
push eax
call fcn.0041512c
mov ecx, dword [str.__1___]
mov dword [esi], ecx
mov edx, dword [0x42a718]
mov eax, esi
mov dword [esi + 4], edx
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409984
sub eax, edx
push 0x6d
mov edi, eax
call fcn.004051a0
mov eax, dword [0x42f218]
mov ebx, dword [eax + 0x1b4]
add esp, 4
cmp dword [0x42f4b4], 0
jne 0x4099d2
call fcn.0040a550
test eax, eax
je 0x4099c8
dec eax
cmp eax, 1
ja 0x4099d2
mov dword [0x42f4b4], 0x80000002
jmp 0x4099d2
mov dword [0x42f4b4], 0x80000001
mov edx, dword [ebp - 4]
mov eax, dword [0x42f4b4]
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 8]
test eax, eax
je 0x409a14
push edi
push esi
push 1
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x74
call fcn.004051a0
mov edx, dword [0x42f218]
mov edi, dword [edx + 0x1d0]
call fcn.0040b320
mov ebx, dword [ebp - 4]
push eax
push edi
push ebx
call fcn.0041512c
mov eax, dword [str.__1___]
mov dword [esi], eax
mov ecx, dword [0x42a718]
mov eax, esi
add esp, 0x10
mov dword [esi + 4], ecx
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409a50
sub eax, edx
cmp dword [0x42f4b4], 0
mov edi, eax
jne 0x409a89
call fcn.0040a550
test eax, eax
je 0x409a7f
dec eax
cmp eax, 1
ja 0x409a89
mov dword [0x42f4b4], 0x80000002
jmp 0x409a89
mov dword [0x42f4b4], 0x80000001
mov eax, dword [0x42f4b4]
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 8]
test eax, eax
je 0x409ac9
push edi
push esi
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x74
call fcn.004051a0
mov edx, dword [0x42f218]
mov edi, dword [edx + 0x1d0]
call fcn.0040b320
push eax
push edi
push ebx
call fcn.0041512c
mov eax, dword [str.__1___]
mov dword [esi], eax
mov ecx, dword [0x42a718]
mov eax, esi
add esp, 0x10
mov dword [esi + 4], ecx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409b01
sub eax, edx
push 0x6d
mov edi, eax
call fcn.004051a0
mov edx, dword [0x42f218]
mov ebx, dword [edx + 0x1b4]
add esp, 4
cmp dword [0x42f4b4], 0
jne 0x409b50
call fcn.0040a550
test eax, eax
je 0x409b46
dec eax
cmp eax, 1
ja 0x409b50
mov dword [0x42f4b4], 0x80000002
jmp 0x409b50
mov dword [0x42f4b4], 0x80000001
mov ecx, dword [ebp - 4]
mov edx, dword [0x42f4b4]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 8]
test eax, eax
je 0x409b93
push edi
push esi
push 1
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0040b320
push eax
push 0x42a71c
push esi
call fcn.0041512c
mov eax, esi
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409bb0
sub eax, edx
push 0x6c
mov ebx, eax
call fcn.004051a0
mov ecx, dword [0x42f218]
mov edi, dword [ecx + 0x1b0]
add esp, 4
cmp dword [0x42f4b4], 0
jne 0x409bff
call fcn.0040a550
test eax, eax
je 0x409bf5
dec eax
cmp eax, 1
ja 0x409bff
mov dword [0x42f4b4], 0x80000002
jmp 0x409bff
mov dword [0x42f4b4], 0x80000001
mov eax, dword [0x42f4b4]
push 0
lea edx, [ebp - 8]
push edx
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 8]
test eax, eax
je 0x409c3f
push ebx
push esi
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x6b
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0x1ac]
mov edx, esi
add esp, 4
sub edx, eax
lea esp, [esp]
mov cl, byte [eax]
mov byte [eax + edx], cl
inc eax
test cl, cl
jne 0x409c60
mov eax, esi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409c70
sub eax, edx
push 0x6a
mov ebx, eax
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x1a8]
push 0x6c
mov dword [ebp - 0xc], ecx
call fcn.004051a0
mov edx, dword [0x42f218]
mov edi, dword [edx + 0x1b0]
add esp, 8
cmp dword [0x42f4b4], 0
jne 0x409cd4
call fcn.0040a550
test eax, eax
je 0x409cca
dec eax
cmp eax, 1
ja 0x409cd4
mov dword [0x42f4b4], 0x80000002
jmp 0x409cd4
mov dword [0x42f4b4], 0x80000001
mov ecx, dword [0x42f4b4]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 8]
test eax, eax
je 0x409d17
mov edx, dword [ebp - 0xc]
push ebx
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cx, word [0x42a6f8]
mov word [esi], cx
mov dl, byte [0x42a6fa]
mov eax, esi
mov byte [esi + 2], dl
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409d30
sub eax, edx
push 0x6e
mov ebx, eax
call fcn.004051a0
mov eax, dword [0x42f218]
mov edi, dword [eax + 0x1b8]
add esp, 4
cmp dword [0x42f4b4], 0
jne 0x409d7e
call fcn.0040a550
test eax, eax
je 0x409d74
dec eax
cmp eax, 1
ja 0x409d7e
mov dword [0x42f4b4], 0x80000002
jmp 0x409d7e
mov dword [0x42f4b4], 0x80000001
mov edx, dword [0x42f4b4]
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 8]
test eax, eax
je 0x409dbf
push ebx
push esi
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0040a550
test eax, eax
jne 0x409de0
push 0x7e
call fcn.004051a0
mov ecx, dword [0x42f218]
mov edi, dword [ecx + 0x1f8]
add esp, 4
jmp 0x409de5
mov edi, 0x4275bc
push 0x2a
call fcn.004051a0
mov edx, dword [0x42f218]
mov eax, dword [edx + 0xa8]
add esp, 4
push eax
push edi
call fcn.0040ac70
push eax
push str.__s___s__s____1____
push esi
call fcn.0041512c
mov eax, esi
add esp, 0x14
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409e16
sub eax, edx
push 0x6f
mov ebx, eax
call fcn.004051a0
mov eax, dword [0x42f218]
mov edi, dword [eax + 0x1bc]
add esp, 4
cmp dword [0x42f4b4], 0
jne 0x409e64
call fcn.0040a550
test eax, eax
je 0x409e5a
dec eax
cmp eax, 1
ja 0x409e64
mov dword [0x42f4b4], 0x80000002
jmp 0x409e64
mov dword [0x42f4b4], 0x80000001
mov edx, dword [0x42f4b4]
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 8]
test eax, eax
je 0x409ea5
push ebx
push esi
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [str.__1___]
mov dword [esi], ecx
mov edx, dword [0x42a718]
mov eax, esi
mov dword [esi + 4], edx
lea edx, [eax + 1]
jmp 0x409ec0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409ec0
sub eax, edx
push 0x6d
mov ebx, eax
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x1b4]
push 0x6f
mov dword [ebp - 0xc], ecx
call fcn.004051a0
mov edx, dword [0x42f218]
mov edi, dword [edx + 0x1bc]
add esp, 8
cmp dword [0x42f4b4], 0
jne 0x409f24
call fcn.0040a550
test eax, eax
je 0x409f1a
dec eax
cmp eax, 1
ja 0x409f24
mov dword [0x42f4b4], 0x80000002
jmp 0x409f24
mov dword [0x42f4b4], 0x80000001
mov ecx, dword [0x42f4b4]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 8]
test eax, eax
je 0x409f67
mov edx, dword [ebp - 0xc]
push ebx
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [str.__1___]
mov dword [esi], ecx
mov edx, dword [0x42a718]
mov eax, esi
mov dword [esi + 4], edx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x409f80
sub eax, edx
push 0x70
mov ebx, eax
call fcn.004051a0
mov eax, dword [0x42f218]
mov edi, dword [eax + 0x1c0]
add esp, 4
cmp dword [0x42f4b4], 0
jne 0x409fce
call fcn.0040a550
test eax, eax
je 0x409fc4
dec eax
cmp eax, 1
ja 0x409fce
mov dword [0x42f4b4], 0x80000002
jmp 0x409fce
mov dword [0x42f4b4], 0x80000001
mov edx, dword [0x42f4b4]
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 8]
test eax, eax
je 0x40a00f
push ebx
push esi
push 1
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [str.__1___]
mov dword [esi], ecx
mov edx, dword [0x42a718]
mov eax, esi
mov dword [esi + 4], edx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40a025
sub eax, edx
push 0x6d
mov ebx, eax
call fcn.004051a0
mov eax, dword [0x42f218]
mov ecx, dword [eax + 0x1b4]
push 0x70
mov dword [ebp - 0xc], ecx
call fcn.004051a0
mov edx, dword [0x42f218]
mov edi, dword [edx + 0x1c0]
add esp, 8
cmp dword [0x42f4b4], 0
jne 0x40a089
call fcn.0040a550
test eax, eax
je 0x40a07f
dec eax
cmp eax, 1
ja 0x40a089
mov dword [0x42f4b4], 0x80000002
jmp 0x40a089
mov dword [0x42f4b4], 0x80000001
mov ecx, dword [0x42f4b4]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp - 8]
test eax, eax
je 0x40a0cc
mov edx, dword [ebp - 0xc]
push ebx
push esi
push 1
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
push ecx
call fcn.00414f60
push esi
call fcn.00414f60
mov edi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
add esp, 8
push edi
call fcn.00414f60
push ebx
call fcn.00414f60
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret