Function at 0x1005c38
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x4018
call fcn.0100af80
mov eax, dword [0x101f7d8]
push ebx
xor edx, edx
cmp dword [ebp + 0xc], edx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0x400c], edx
je 0x1005e03
cmp esi, edx
je 0x1005f08
xor eax, eax
cmp dword [esi + 0x14], 0xffffffff
mov word [ebp - 0x4004], dx
mov ecx, 0x7ff
lea edi, [ebp - 0x4002]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x4010], esi
stosw word es:[edi], ax
mov dword [ebp - 0x4008], edx
je 0x1005f08
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1005ca6
xor edx, edx
xor eax, eax
mov word [ebp - 0x2004], dx
mov ecx, 0x7ff
lea edi, [ebp - 0x2002]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi]
cmp eax, edx
je 0x1005ce4
push dword [esi + 4]
mov dword [ebp - 0x4008], eax
lea eax, [ebp - 0x4004]
push eax
call ebx
push dword [esi + 4]
lea eax, [ebp - 0x2004]
push eax
call ebx
jmp 0x1005d14
lea eax, [ebp - 0x4004]
push eax
lea eax, [ebp - 0x2004]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x10013a8
lea eax, [ebp - 0x2004]
push eax
call edi
push dword [esi + 4]
lea eax, [ebp - 0x2004]
push eax
call edi
xor edi, edi
cmp dword [ebp - 0x4008], edi
je 0x1005ded
test byte [esi + 0x14], 6
je 0x1005d47
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x4008]
call fcn.01005acc
cmp eax, edi
je 0x1005d47
cmp eax, 2
jne 0x1005ded
test byte [esi + 0x14], 8
je 0x1005d77
push dword [esi + 8]
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x4008]
call fcn.01005bd5
cmp eax, edi
je 0x1005ddb
cmp eax, 2
je 0x1005ddb
mov dword [ebp - 0x400c], 0x80040201
jmp 0x1005ddb
lea eax, [ebp - 0x4018]
push eax
lea eax, [ebp - 0x4014]
push eax
push dword [esi + 0x10]
lea eax, [ebp - 0x2004]
push 0x20006
push edi
push edi
push edi
push eax
push dword [ebp - 0x4008]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1005ded
mov eax, dword [esi + 0xc]
cmp eax, edi
je 0x1005dcf
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esi + 0xc]
push 1
push edi
push dword [esi + 8]
push dword [ebp - 0x4014]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x4014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0x18
cmp dword [esi + 0x14], 0xffffffff
jne 0x1005ca4
jmp 0x1005f08
push edi
push dword [ebp - 0x4010]
call fcn.01005c38
mov eax, 0x80040201
jmp 0x1005f0e
cmp esi, edx
je 0x1005f08
xor eax, eax
cmp dword [esi + 0x14], 0xffffffff
mov word [ebp - 0x4004], dx
mov ecx, 0x7ff
lea edi, [ebp - 0x4002]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x4008], edx
je 0x1005f08
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1005e3d
xor edx, edx
xor eax, eax
mov word [ebp - 0x2004], dx
mov ecx, 0x7ff
lea edi, [ebp - 0x2002]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi]
cmp eax, edx
je 0x1005e7b
push dword [esi + 4]
mov dword [ebp - 0x4008], eax
lea eax, [ebp - 0x4004]
push eax
call ebx
push dword [esi + 4]
lea eax, [ebp - 0x2004]
push eax
call ebx
jmp 0x1005eab
lea eax, [ebp - 0x4004]
push eax
lea eax, [ebp - 0x2004]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x10013a8
lea eax, [ebp - 0x2004]
push eax
call edi
push dword [esi + 4]
lea eax, [ebp - 0x2004]
push eax
call edi
cmp dword [ebp - 0x4008], 0
je 0x1005efb
mov eax, dword [esi + 0x14]
test al, 0xb
jne 0x1005ecf
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x4008]
call fcn.01005acc
jmp 0x1005ee8
test al, 8
je 0x1005efb
push dword [esi + 8]
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x4008]
call fcn.01005bd5
test eax, eax
je 0x1005efb
cmp eax, 2
je 0x1005efb
mov dword [ebp - 0x400c], 0x80040201
add esi, 0x18
cmp dword [esi + 0x14], 0xffffffff
jne 0x1005e3b
mov eax, dword [ebp - 0x400c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100abde
leave
ret 8