Function at 0x1001c1df
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2130
call fcn.10021160
mov esi, ecx
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x1001ec30
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
lea edi, [ebp - 0x213c]
mov ecx, esi
push edi
call fcn.1001a6c0
test eax, eax
js 0x1001bf03
push 0x100545ea
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1001bdd8
push 0x10054638
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1001bdf4
push 0x100546be
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1001be0b
push 0x100546cc
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ecx, 0x80020009
test eax, eax
jne 0x1001c005
mov bl, 1
mov dword [ebp - 0x28], 0
mov al, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x24], 0
mov al, 1
mov dword [ebp - 0x30], eax
jmp 0x1001be2c
mov bl, 1
mov dword [ebp - 0x28], 0
mov al, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0
mov al, 1
mov dword [ebp - 0x24], eax
jmp 0x1001be25
mov al, 1
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x34], 0
jmp 0x1001be1e
mov al, 1
mov dword [ebp - 0x20], eax
xor ebx, ebx
mov dword [ebp - 0x28], 0
mov al, 1
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov eax, dword [esi]
jmp 0x1001be41
add ecx, 0xfffffff7
cmp ecx, 1
ja 0x1001be55
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [esi], eax
movzx ecx, word [eax]
cmp ecx, 0xd
jb 0x1001be30
cmp cx, 0x20
jae 0x1001be53
cmp cx, 0xd
je 0x1001be38
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
push edi
call fcn.1001a6c0
test eax, eax
js 0x1001bf03
test bl, bl
je 0x1001be98
cmp byte [ebp - 0x24], 0
je 0x1001bf0a
mov edi, esi
lea esi, [ebp - 0x213c]
push esi
call fcn.10033e2b
add esp, 4
add eax, eax
add eax, 2
push eax
push esi
mov esi, edi
push 1
jmp 0x1001bed9
cmp byte [ebp - 0x20], 0
je 0x1001bf8f
cmp byte [ebp - 0x34], 0
je 0x1001bfed
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x213c]
push eax
push 0
push 0
push ecx
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
test eax, eax
js 0x1001bf03
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x13c]
push 4
push eax
push 4
push 0
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test ebx, ebx
je 0x1001bfed
push ebx
call fcn.1001c2a0
add esp, 4
mov ecx, eax
jmp 0x1001c005
mov ecx, eax
jmp 0x1001c005
cmp byte [ebp - 0x30], 0
je 0x1001bfed
lea eax, [ebp - 0x213c]
push eax
call fcn.10033e2b
add esp, 4
mov ebx, eax
mov ecx, 0x80004005
test bl, 1
jne 0x1001c005
mov dword [ebp - 0x2c], esi
mov eax, ebx
shr eax, 0x1f
add eax, ebx
sar eax, 1
mov dword [ebp - 0x13c], 0
cmp eax, 0x101
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], eax
jb 0x1001c0ef
mov dword [ebp - 0x10], 4
lea ecx, [ebp - 0x13c]
push eax
call fcn.1001a200
mov ecx, dword [ebp - 0x13c]
test ecx, ecx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
jne 0x1001c0fb
mov dword [ebp - 0x20], 0
xor ebx, ebx
jmp 0x1001c19e
cmp byte [ebp - 0x28], 0
je 0x1001bfed
push edi
call fcn.10033e2b
add esp, 4
add eax, 2
mov dword [ebp - 0x13c], 0
add eax, eax
mov dword [ebp - 0x2c], esi
jb 0x1001c1ce
cmp eax, 0x101
jb 0x1001c01d
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x13c]
push eax
call fcn.1001a200
mov ebx, dword [ebp - 0x13c]
test ebx, ebx
mov esi, dword [ebp - 0x2c]
lea edi, [ebp - 0x213c]
jne 0x1001c029
mov ebx, 0xe
jmp 0x1001c0cd
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
push dword [ebp + 0x10]
call fcn.1001a6c0
mov ecx, eax
sar ecx, 0x1f
and ecx, eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
add esp, 0x2130
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea ebx, [ebp - 0x138]
mov dword [ebp - 0x13c], ebx
cmp word [ebp - 0x213c], 0
jne 0x1001c09f
mov dword [ebx], 0
mov esi, dword [ebp - 0x13c]
test esi, esi
je 0x1001c0c5
xor edi, edi
mov ebx, esi
nop dword [eax + eax]
push ebx
call fcn.10033e2b
add esp, 4
lea ebx, [ebx + eax*2]
add ebx, 2
lea edi, [edi + eax*2]
add edi, 2
test eax, eax
jne 0x1001c050
push edi
push esi
push 7
push 0
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
jmp 0x1001c0ca
mov word [ebx], cx
add edi, 2
add ebx, 2
cmp word [edi], 0
je 0x1001c033
push edi
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [edi]
cmp cx, 0x5c
jne 0x1001c090
cmp word [eax], 0x30
jne 0x1001c090
mov word [ebx], 0
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov edi, eax
jmp 0x1001c096
mov ebx, 0xd
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x138]
cmp dword [ebp - 0x13c], eax
je 0x1001beeb
lea ecx, [ebp - 0x13c]
call fcn.1001c370
jmp 0x1001beeb
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x13c], ecx
push eax
push 0
push ecx
call fcn.10026920
add esp, 0xc
test ebx, ebx
jle 0x1001c17c
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x1001c148
lea edi, [ecx - 0x30]
add ecx, 0xd0
cmp edi, 0xa
cmovae ecx, eax
mov ebx, ecx
movzx ebx, bl
mov ecx, edx
not cl
and cl, 4
shl ebx, cl
mov ecx, dword [ebp - 0x13c]
mov edi, esi
shr edi, 1
or byte [ecx + edi], bl
add esi, 1
add edx, 4
cmp dword [ebp - 0x20], esi
je 0x1001c17c
movzx ecx, word [ebp + esi*2 - 0x213c]
cmp ecx, 0x41
jb 0x1001c113
xor ebx, ebx
cmp cx, 0x61
jae 0x1001c16e
cmp cx, 0x47
jae 0x1001c124
movzx ebx, cx
add ebx, 0xc9
jmp 0x1001c124
cmp cx, 0x67
jae 0x1001c124
add ecx, 0xa9
jmp 0x1001c122
mov al, 1
mov dword [ebp - 0x20], eax
push dword [ebp - 0x24]
push dword [ebp - 0x13c]
push 3
push 0
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
lea eax, [ebp - 0x138]
cmp dword [ebp - 0x13c], eax
mov esi, dword [ebp - 0x2c]
je 0x1001c1ba
lea ecx, [ebp - 0x13c]
call fcn.1001c370
cmp byte [ebp - 0x20], 0
mov ecx, 0x80004005
jne 0x1001beeb
jmp 0x1001c005
mov dword [ebp - 0x10], 1
push 0x80070216
call fcn.10015ab0
add ebp, 0xc
mov ecx, dword [ebp - 0x28]
jmp 0x1001bf73