Function at 0x9591b0
Capabilities:
Delete registry value
Get common file path
Set registry value

Disassembly:
sub esp, 0x744
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x73c], eax
mov eax, dword [esp + 0x74c]
push ebx
push ebp
mov ebp, dword [esp + 0x750]
push esi
push edi
mov edi, ecx
xor ebx, ebx
push 0x103
lea ecx, [esp + 0x25]
push ebx
push ecx
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], eax
mov byte [esp + 0x2c], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea edx, [esp + 0x545]
push ebx
push edx
mov byte [esp + 0x54c], bl
call fcn.00a7ffb0
add esp, 0xc
cmp ebp, ebx
je 0x95939b
mov eax, 0xaa154c
mov ecx, ebp
call fcn.0094c330
test eax, eax
je 0x959242
mov eax, 0xaa1ad0
mov ecx, ebp
call fcn.0094c330
test eax, eax
jne 0x95939b
cmp edi, ebx
je 0x95925a
mov eax, str.progressover
mov ecx, edi
call fcn.0094c330
test eax, eax
je 0x95939b
cmp dword [0xbd85f8], ebx
jne 0x95941d
push 0x103
lea eax, [esp + 0x235]
push ebx
push eax
mov byte [esp + 0x23c], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea ecx, [esp + 0x33d]
push ebx
push ecx
mov byte [esp + 0x344], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x103
lea edx, [esp + 0x12d]
push ebx
push edx
mov byte [esp + 0x134], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x208
lea eax, [esp + 0x33c]
push eax
push ebx
mov dword [0xbd85f8], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea ecx, [esp + 0x234]
lea edx, [esp + 0x33c]
call fcn.009580e0
add esp, 4
test eax, eax
je 0x959310
lea ecx, [esp + 0x230]
push ecx
lea edx, [esp + 0x33c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x128]
lea edx, [esp + 0x338]
call fcn.009597a0
xor ecx, ecx
lea edi, [esp + 0x128]
call fcn.0095a6d0
mov eax, edi
push eax
push str._sWIN.INI
push 0xbd8600
call fcn.00a78f30
add esp, 0xc
push 1
push ebx
xor edx, edx
mov ecx, 0xbd8600
call fcn.0095a0f0
add esp, 8
test eax, eax
jne 0x959391
call fcn.00958b00
push 0xbd8600
lea ecx, [esp + 0x544]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
push ebp
lea esi, [esp + 0x544]
call fcn.009584b0
add esp, 4
jmp 0x9595c2
mov edi, dword [esp + 0x1c]
mov byte [0xbd8600], bl
mov esi, dword [esp + 0x18]
mov ebx, ebp
call fcn.00958a90
xor esi, esi
xor edi, edi
xor ebx, ebx
call fcn.00958a90
cmp byte [0xbfc718], bl
jne 0x95945c
push 0x104
push 0xbfc718
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, 0x104
mov ecx, 0xbfc820
call fcn.00958630
mov esi, 0xbfc718
call fcn.00960950
mov esi, 0xbfc820
call fcn.00960950
mov eax, 0xbfc718
mov ecx, esi
call fcn.0094c330
test eax, eax
je 0x95945c
mov ecx, esi
mov dword [0xb4c308], ebx
call fcn.00960910
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.WIN.INI
push esi
call edi
jmp 0x959462
cmp byte [0xbd8600], bl
je 0x95939b
call fcn.00958b00
push 0xbd8600
lea edx, [esp + 0x544]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x18]
push ebp
lea esi, [esp + 0x544]
mov ebx, edi
call fcn.009584b0
add esp, 4
jmp 0x9595c2
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0xb4c308], ebx
jne 0x959480
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
push ebp
mov esi, 0xbfc820
call fcn.009584b0
add esp, 4
test ebp, ebp
je 0x9595c2
call fcn.00963540
test eax, eax
je 0x9595c2
push str.SoftwareMicroWorld
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
push 0x80000002
call ebx
test eax, eax
jne 0x9595c2
mov eax, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
push 0xaa1564
lea ecx, [esp + 0x24]
push ecx
call edi
push str.WIN.INI
lea edx, [esp + 0x24]
push edx
call edi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0x80000002
call ebx
test eax, eax
jne 0x9595c2
mov edx, dword [esp + 0x14]
push edx
call esi
push ebp
call fcn.0095ad70
add esp, 4
push 0xaa1564
lea eax, [esp + 0x24]
push eax
call edi
push ebp
lea ecx, [esp + 0x24]
push ecx
call edi
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x24]
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x9595c2
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jne 0x959568
mov edi, dword [esp + 0x18]
test edi, edi
jne 0x95958f
mov ecx, dword [esp + 0x14]
push ecx
call esi
push 0x80000002
xor eax, eax
lea edi, [esp + 0x24]
call fcn.0095fbe0
jmp 0x9595c2
cmp dword [esp + 0x18], 0
jne 0x95958b
push ebx
call fcn.0095ad70
mov edx, dword [esp + 0x18]
add esp, 4
push ebx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x14]
push eax
jmp 0x9595c0
mov edi, dword [esp + 0x18]
push ebx
call fcn.0095ad70
add esp, 4
push edi
call fcn.0095ad70
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x14]
inc eax
push eax
push edi
push 1
push 0
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
push edx
call esi
mov ecx, dword [esp + 0x74c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0x744
ret