Function at 0x1c5ccd0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov dword [ebp - 0x34], ecx
mov eax, dword [0x1cf3040]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0
push 0x18
call fcn.01c9515a
add esp, 4
lea edi, [ebp - 0x28]
mov dword [edi], eax
mov dword [edi + 8], 0x8000000c
mov dword [edi + 4], 9
movzx ecx, word [0x1cea8f6]
mov word [eax + 0x10], cx
movups xmm0, xmmword [str.Software_]
movups xmmword [eax], xmm0
mov word [eax + 0x12], 0
mov eax, dword [0x1cf8bf4]
mov eax, dword [eax + 4]
push edi
push 1
push dword [eax + 8]
call fcn.01c35230
add esp, 0xc
movzx eax, byte [edi + 0xb]
mov esi, 4
mov ebx, eax
test al, al
jns 0x1c5cd56
mov esi, 0x7fffffff
and esi, dword [ebp - 0x20]
dec esi
mov ebx, dword [ebp - 0x24]
mov ecx, esi
sub ecx, ebx
cmp ecx, 0xb
jae 0x1c5ce1d
lea edi, [ebx + 0xb]
mov ecx, edi
sub ecx, esi
mov edx, 0x7ffffff6
sub edx, esi
cmp edx, ecx
jb 0x1c5cf46
test al, al
jns 0x1c5cd82
mov eax, dword [ebp - 0x28]
jmp 0x1c5cd85
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov ecx, 0x7ffffff7
cmp esi, 0x3ffffff2
ja 0x1c5cdb3
lea eax, [esi + esi]
cmp edi, eax
cmova eax, edi
mov ecx, 5
cmp eax, 5
jb 0x1c5cdb3
or eax, 3
inc eax
mov ecx, eax
js 0x1c5cf5b
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], ecx
lea eax, [ecx + ecx]
push eax
call fcn.01c9515a
add esp, 4
mov edi, eax
test ebx, ebx
je 0x1c5cddb
lea eax, [ebx + ebx]
push eax
push dword [ebp - 0x30]
push edi
call fcn.01c994a0
add esp, 0xc
movsd xmm0, qword [0x1cdf19e]
movsd qword [edi + ebx*2 + 0xe], xmm0
movups xmm0, xmmword [str.ThirdParty]
movups xmmword [edi + ebx*2], xmm0
cmp esi, 4
je 0x1c5ce04
push dword [ebp - 0x30]
call fcn.01c95155
add esp, 4
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x38]
or eax, 0x80000000
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
lea eax, [edi + eax*2]
jmp 0x1c5ce4c
lea ecx, [ebx + 0xb]
test al, al
jns 0x1c5ce27
mov edi, dword [ebp - 0x28]
movsd xmm0, qword [0x1cdf19e]
movsd qword [edi + ebx*2 + 0xe], xmm0
movups xmm0, xmmword [str.ThirdParty]
movups xmmword [edi + ebx*2], xmm0
js 0x1c5ce5c
mov eax, ecx
and al, 0x7f
mov byte [ebp - 0x1d], al
lea eax, [edi + ecx*2]
mov word [eax], 0
cmp byte [ebp - 0x1d], 0
jns 0x1c5ce61
mov eax, dword [ebp - 0x28]
jmp 0x1c5ce64
mov dword [ebp - 0x24], ecx
jmp 0x1c5ce49
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x1c]
push ecx
push 0x2001f
push eax
push 2
call fcn.01c3fd00
add esp, 0x10
mov ebx, eax
cmp byte [ebp - 0x1d], 0
jns 0x1c5ce8b
push dword [ebp - 0x28]
call fcn.01c95155
add esp, 4
test bl, bl
je 0x1c5cf34
xor eax, eax
lea esi, [ebp - 0x28]
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
lea ecx, [ebp - 0x2c]
mov dword [ecx], eax
push esi
push ecx
push str.StatusCodes
push dword [ebp - 0x1c]
call fcn.01c344f0
add esp, 0x10
test al, al
je 0x1c5cec1
cmp dword [ebp - 0x2c], 3
je 0x1c5cec7
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
push esi
push dword [ebp - 0x34]
call fcn.01c5de40
add esp, 8
mov edi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
cmp byte [0x1cf7de4], 0
je 0x1c5cf50
sub ebx, edi
xor eax, eax
lea esi, [ebp - 0x18]
mov dword [esi + 4], eax
mov dword [esi], eax
push str.StatusCodes
push esi
call sub.ntdll.dll_RtlInitUnicodeString
push ebx
push edi
push 3
xor eax, eax
push eax
push esi
push dword [ebp - 0x34]
call sub.ntdll.dll_NtSetValueKey
mov esi, dword [ebp - 0x1c]
cmp byte [0x1cf7de4], 0
je 0x1c5cf49
push esi
call sub.ntdll.dll_NtClose
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x1c5cf34
mov dword [ebp - 0x24], eax
push eax
call fcn.01c95155
add esp, 4
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01c98173
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
int3
call fcn.01c34370
jmp 0x1c5cf1b
call fcn.01c34370
test al, al
jne 0x1c5cee8
jmp 0x1c5cf0f
int3