Function at 0x1001a440
Capabilities:
Delete registry value
Get geographical location
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
test cl, cl
je 0x1001a461
push 1
push 0x24d1
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
jmp 0x1001a725
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push edi
push 1
pop edi
push 0
mov dword [ebp - 0x10], 0x3ae35568
mov dword [ebp - 0x10], 0xa
pop ebx
jmp 0x1001a4da
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001a49c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001a48e
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
setne cl
mov dword [ebp - 0x14], ecx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a4d7
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x24d7
push 0x1735
push 0x95c
push ebx
call esi
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
je 0x1001a47f
mov dword [ebp - 0x14], ebx
jmp 0x1001a4f3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4c], 0x841b3c69
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001a4e5
mov dword [ebp - 0x44], ebx
jmp 0x1001a522
mov dword [ebp - 0x18], 0x43046b6e
mov dword [ebp - 0x14], 0x464f16ef
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x18]
sub eax, 0xb9dd952e
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xffffffe4
jne 0x1001a4fe
mov eax, dword [ebp - 0x44]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a5e8
mov eax, 0x76820624
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x3c], ebx
jmp 0x1001a5a0
mov dword [ebp - 0x14], 0xa986
mov dword [ebp - 0x18], 0x49968cb6
cmp dword [ebp - 0x14], ebx
jne 0x1001a582
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov eax, dword [ebp - 0x14]
jmp 0x1001a584
mov edx, edi
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0x17
jl 0x1001a565
mov dword [ebp - 0x10], ebx
jmp 0x1001a5c9
mov dword [ebp - 0x14], ebx
jmp 0x1001a5be
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1c], 0x512dc6d0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001a5b0
inc dword [ebp - 0x1c]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff7
jle 0x1001a5ab
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x24d7
push 0x1735
push 0x95c
push ebx
call esi
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x18], 0x89afca86
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x14], ebx
jmp 0x1001a610
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x20], 0xaf11
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001a602
mov dword [ebp - 8], ebx
jmp 0x1001a71a
mov dword [ebp - 0xc], 0xe0091df8
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x18], 0x2e6c0b33
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], 0xffffffff
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], 0xf47f28a9
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x20], edi
je 0x1001a6e9
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0x10b42b8f
mov dword [ebp - 0x10], ebx
jmp 0x1001a68f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001a686
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jl 0x1001a6fa
mov dword [ebp - 0x10], ebx
jmp 0x1001a6dd
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a6b8
push 0x386
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a6da
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x24d7
push 0x1735
push 0x95c
push ebx
call esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001a6a1
dec dword [ebp - 0xc]
jns 0x1001a69c
jmp 0x1001a6fa
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a6fa
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x14], ebx
jmp 0x1001a712
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a70f
push ebx
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1001a6ff
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x1001a61d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret