Function at 0x9d7670
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb12c90
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x1264
call fcn.00a91950
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x1278], ebx
mov byte [ebp - 0x12c], bl
push 0x103
push ebx
lea eax, [ebp - 0x12b]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x234], bl
push 0x103
push ebx
lea ecx, [ebp - 0x233]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x43c], bl
push 0x207
push ebx
lea edx, [ebp - 0x43b]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x644], bl
push 0x207
push ebx
lea eax, [ebp - 0x643]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x1274], bl
push 0x40f
push ebx
lea ecx, [ebp - 0x1273]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0xa54], bl
push 0x40f
push ebx
lea edx, [ebp - 0xa53]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0xe64], bl
push 0x40f
push ebx
lea eax, [ebp - 0xe63]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x9d7792
cmp byte [edi], bl
je 0x9d7792
cmp dword [ebp + 8], ebx
jne 0x9d779e
mov esi, edi
call fcn.009d7610
test eax, eax
je 0x9d779e
mov dword [ebp - 4], 0xfffffffe
jmp 0x9d79da
push 0x5c
push edi
call fcn.00a7aa50
add esp, 8
lea edx, [ebp - 0x234]
cmp eax, ebx
je 0x9d77c2
lea ecx, [eax + 1]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x9d77b6
jmp 0x9d77ce
mov ecx, edi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x9d77c4
mov ecx, edi
lea edx, [ebp - 0x12c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x9d77d6
lea ecx, [ebp - 0x12c]
call fcn.00958390
push 0x5c
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00a7aa50
add esp, 8
mov esi, eax
mov dword [ebp - 0x127c], esi
cmp esi, ebx
je 0x9d7828
inc esi
mov dword [ebp - 0x127c], esi
lea eax, [ebp - 0x234]
mov ecx, esi
call fcn.0094c330
test eax, eax
jne 0x9d7828
xor esi, esi
mov dword [ebp - 0x127c], esi
lea edx, [ebp - 0x1274]
push edx
lea eax, [ebp - 0x234]
push eax
xor ecx, ecx
call fcn.0097a080
lea ecx, [ebp - 0xe64]
push ecx
lea edx, [ebp - 0x12c]
push edx
xor ecx, ecx
call fcn.0097a080
add esp, 0x10
cmp esi, ebx
je 0x9d786f
cmp byte [esi], bl
je 0x9d786f
lea eax, [ebp - 0xa54]
push eax
push esi
xor ecx, ecx
call fcn.0097a080
add esp, 8
mov eax, dword [ebp + 8]
cmp eax, 2
jne 0x9d78c0
mov esi, edi
call fcn.009d7f70
lea ecx, [ebp - 0x1274]
push ecx
push str.SoftwareMicroworldDeviceControlWhiteListApp
push 0xaac2e4
lea edx, [ebp - 0x43c]
push edx
call fcn.00a78f30
add esp, 0x10
cmp byte [ebp - 0xa54], bl
je 0x9d7910
lea eax, [ebp - 0xa54]
push eax
push str.SoftwareMicroworldDeviceControlWhiteListApp
push 0xaac2e4
lea ecx, [ebp - 0x644]
push ecx
jmp 0x9d7908
cmp eax, ebx
jne 0x9d7792
lea edx, [ebp - 0x1274]
push edx
push str.SoftwareMicroworldDeviceControlBlackListApp
push 0xaac2e4
lea eax, [ebp - 0x43c]
push eax
call fcn.00a78f30
add esp, 0x10
cmp byte [ebp - 0xa54], bl
je 0x9d7910
lea ecx, [ebp - 0xa54]
push ecx
push str.SoftwareMicroworldDeviceControlBlackListApp
push 0xaac2e4
lea edx, [ebp - 0x644]
push edx
call fcn.00a78f30
add esp, 0x10
push ebx
lea eax, [ebp - 0x1278]
push eax
push ebx
push 0xf003f
push ebx
push 0xaa1543
push ebx
lea ecx, [ebp - 0x43c]
push ecx
push 0x80000002
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
call esi
test eax, eax
je 0x9d7968
push ebx
lea edx, [ebp - 0x1278]
push edx
push ebx
push 0xf003f
push ebx
push 0xaa1543
push ebx
lea eax, [ebp - 0x644]
push eax
push 0x80000002
call esi
test eax, eax
jne 0x9d7792
lea eax, [ebp - 0xe64]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x9d7971
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0xe64]
push ecx
push 1
push ebx
push str.Prop4
mov edx, dword [ebp - 0x1278]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x1278]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1278], ebx
mov dword [ebp - 4], 0xfffffffe
mov eax, 1
jmp 0x9d79dc
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret