Function at 0x1000afa0
Capabilities:
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov dword [ebp - 0x324], ecx
mov dword [ebp - 0x2a4], str.Forth
mov dword [ebp - 4], 0
mov dword [ebp - 0x28c], 0x10017270
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x1f4], 0
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x2ac], 0
mov dword [ebp - 0x2b0], 0
mov dword [ebp - 0x2a8], 0
mov dword [ebp - 0x1ec], 0
mov ecx, dword [ebp - 0x324]
call fcn.1000c300
mov ecx, dword [ebp - 0x324]
call fcn.1000ae00
movzx eax, al
test eax, eax
jne 0x1000b08c
lea ecx, [ebp - 0x2b5]
call fcn.1000f860
movzx ecx, al
test ecx, ecx
je 0x1000b08c
mov edx, dword [ebp - 0x2a4]
push edx
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x2a4]
push ecx
lea edx, [ebp - 0x100]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
push 1
push 0x22
push 1
mov ecx, dword [ebp - 0x324]
call fcn.1000caf0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x324]
mov byte [eax + 0xb], 1
mov byte [ebp - 0x1ed], 0
mov dword [ebp - 0x290], 0
mov ecx, dword [ebp - 0x324]
call fcn.1000e110
movzx ecx, al
test ecx, ecx
je 0x1000b0ed
mov edx, dword [ebp - 0x28c]
push edx
lea eax, [ebp - 0x1e8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x290], 2
mov ecx, dword [ebp - 0x2a4]
push ecx
lea edx, [ebp - 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x1000b12a
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x104], eax
mov ecx, dword [ebp - 0x108]
mov dword [ebp - 0x1f4], ecx
mov ecx, dword [ebp - 0x324]
call fcn.10007b10
movzx edx, al
test edx, edx
jne 0x1000b12a
mov dword [ebp - 0x290], 0x20
cmp dword [ebp - 0x290], 0
jne 0x1000b193
mov eax, dword [ebp - 0x324]
movzx ecx, byte [eax + 0x430]
test ecx, ecx
jne 0x1000b193
xor edx, edx
mov word [ebp - 0x2cc], dx
xor eax, eax
mov dword [ebp - 0x2ca], eax
mov dword [ebp - 0x2c6], eax
mov dword [ebp - 0x2c2], eax
mov word [ebp - 0x2be], ax
mov ecx, dword [ebp - 0x2a4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 4]
lea eax, [edx + eax + 1]
mov dword [ebp - 4], eax
mov dword [ebp - 0x2bc], 0x10
mov dword [ebp - 0x290], 0x21
cmp dword [ebp - 0x290], 0
je 0x1000b1a9
cmp dword [ebp - 0x290], 0x21
jne 0x1000b255
mov ecx, dword [ebp - 0x324]
mov edx, dword [ecx + 0x124]
mov dword [ebp - 0x300], edx
push 0x1001a340
mov ecx, dword [ebp - 0x324]
add ecx, 0x128
call fcn.10001980
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x324]
add eax, 0x20
mov dword [ebp - 0x2f8], eax
mov dword [ebp - 0x2f0], 0
mov dword [ebp - 0x2f4], 4
mov ecx, dword [ebp - 0x2f4]
push ecx
lea edx, [ebp - 0x300]
push edx
push 4
mov eax, dword [ebp - 0x2fc]
push eax
mov ecx, dword [ebp - 0x2f8]
push ecx
mov edx, dword [ebp - 0x2f8]
mov eax, dword [edx + 0x100]
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [ebp - 0x2f0], eax
mov ecx, dword [ebp - 0x324]
mov edx, dword [ecx + 0x18e4]
push edx
mov ecx, dword [ebp - 0x324]
call fcn.1000ac70
mov dword [ebp - 0x290], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 0x290], 0
je 0x1000b267
cmp dword [ebp - 0x290], 0x21
jne 0x1000b2ac
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x2a0], eax
lea ecx, [ebp - 0x2a0]
push ecx
lea edx, [ebp - 0x2b4]
push edx
call dword [sym.imp.USER32.dll_EqualRect]
mov ecx, dword [ebp - 0x324]
call fcn.1000b5f0
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x28c]
push eax
lea ecx, [ebp - 0x1e8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
movzx edx, byte [ebp - 0x1ed]
test edx, edx
je 0x1000b2c1
mov dword [ebp - 0x290], 0x1d
push 1
push 1
mov eax, dword [ebp - 0x290]
push eax
push 1
mov ecx, dword [ebp - 0x324]
call fcn.1000caf0
mov ecx, dword [ebp - 0x324]
mov byte [ecx + 0xb], 0
mov edx, dword [ebp - 0x324]
mov eax, dword [edx + 0x19ec]
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x1000b314
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x28c]
push ecx
lea edx, [ebp - 0x1e8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x324]
mov ecx, dword [eax + 0x19ec]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x1ec]
push edx
call dword [sym.imp.GDI32.dll_GetBkMode]
cmp dword [ebp - 0x290], 0
je 0x1000b346
cmp dword [ebp - 0x290], 0x21
jne 0x1000b381
push 0x1001a364
mov ecx, dword [ebp - 0x324]
add ecx, 0x128
call fcn.10001980
push eax
mov eax, dword [ebp - 0x324]
add eax, 0x20
push eax
mov ecx, dword [ebp - 0x324]
call fcn.1000d5b0
mov eax, dword [ebp - 0x324]
add eax, 0x18e8
jmp 0x1000b383
xor eax, eax
mov esp, ebp
pop ebp
ret 8