Function at 0x1001162a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10027580
push 0x100132f0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x38], eax
push str.RegCreateKeyExA
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2c], eax
push str.RegSetValueExA
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x34], eax
push str.RegDeleteKeyA
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
push str.RegDeleteValueA
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x40], eax
push str.RegOpenKeyExA
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x28], eax
push str.RegCloseKey
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
ja case.default.0x100116e8
mov ecx, dword [ebp - 0x44]
jmp dword [ecx*4 + 0x10011851]
lea edx, [ebp - 0x24]
push edx
lea eax, [ebp - 0x3c]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x2c]
test eax, eax
je case.0x100116e8.1
jmp case.default.0x100116e8
lea eax, [ebp - 0x3c]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x28]
test eax, eax
je 0x10011737
jmp case.default.0x100116e8
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
sub ecx, 1
mov dword [ebp - 0x48], ecx
cmp dword [ebp - 0x48], 6
ja case.0x1001174f.2
mov edx, dword [ebp - 0x48]
jmp dword [edx*4 + 0x10011861]
mov eax, dword [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [ebp - 0x34]
test eax, eax
jne 0x10011784
mov dword [ebp - 0x20], 1
jmp case.0x1001174f.2
push 4
lea edx, [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
call dword [ebp - 0x34]
test eax, eax
jne case.0x1001174f.2
mov dword [ebp - 0x20], 1
jmp case.default.0x100116e8
lea eax, [ebp - 0x3c]
push eax
push 0x2001f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [ebp - 0x28]
test eax, eax
je 0x100117c6
jmp case.default.0x100116e8
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [ebp - 0x1c]
test eax, eax
jne 0x100117dc
mov dword [ebp - 0x20], 1
jmp case.default.0x100116e8
lea edx, [ebp - 0x3c]
push edx
push 0x2001f
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp - 0x28]
test eax, eax
je 0x100117fa
jmp case.default.0x100116e8
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x3c]
push eax
call dword [ebp - 0x40]
test eax, eax
jne case.default.0x100116e8
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], 0xffffffff
call fcn.1001181e
jmp 0x1001182d
cmp dword [ebp - 0x38], 0
je 0x1001183d
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret