Function at 0x100932f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x4018
call fcn.010066f8
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x400c], ebx
cmp dword [ebp + 0xc], ebx
je 0x1009542
cmp esi, ebx
je 0x1009686
xor eax, eax
push 0x1ffe
mov word [ebp - 0x4004], ax
lea eax, [ebp - 0x4002]
push ebx
push eax
mov dword [ebp - 0x4010], esi
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [esi + 0x14], 0xffffffff
mov dword [ebp - 0x4008], ebx
je 0x1009686
mov edi, 0x1000
xor eax, eax
push 0x1ffe
mov word [ebp - 0x2004], ax
lea eax, [ebp - 0x2002]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi]
add esp, 0xc
cmp eax, ebx
je 0x1009401
push dword [esi + 4]
mov dword [ebp - 0x4008], eax
push edi
lea eax, [ebp - 0x4004]
push eax
call fcn.0100603f
cmp eax, ebx
jl 0x100968c
push dword [esi + 4]
lea eax, [ebp - 0x2004]
push edi
push eax
call fcn.0100603f
cmp eax, ebx
mov dword [ebp - 0x400c], eax
jge 0x1009455
jmp 0x100968c
lea eax, [ebp - 0x4004]
push eax
push edi
lea eax, [ebp - 0x2004]
push eax
call fcn.0100603f
cmp eax, ebx
jl 0x100968c
push 0x1002884
push edi
lea eax, [ebp - 0x2004]
push eax
call fcn.01005351
cmp eax, ebx
jl 0x100968c
push dword [esi + 4]
lea eax, [ebp - 0x2004]
push edi
push eax
call fcn.01005351
cmp eax, ebx
mov dword [ebp - 0x400c], eax
jl 0x1009686
cmp dword [ebp - 0x4008], ebx
je 0x100952c
test byte [esi + 0x14], 6
je 0x1009486
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x4008]
call fcn.010091c4
cmp eax, ebx
je 0x1009486
cmp eax, 2
jne 0x100952c
test byte [esi + 0x14], 8
je 0x10094b6
push dword [esi + 8]
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x4008]
call fcn.010092cc
cmp eax, ebx
je 0x100951a
cmp eax, 2
je 0x100951a
mov dword [ebp - 0x400c], 0x80040201
jmp 0x100951a
lea eax, [ebp - 0x4018]
push eax
lea eax, [ebp - 0x4014]
push eax
push dword [esi + 0x10]
lea eax, [ebp - 0x2004]
push 0x20006
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x4008]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100952c
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x100950e
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push dword [esi + 0xc]
push 1
push ebx
push dword [esi + 8]
push dword [ebp - 0x4014]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x4014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0x18
cmp dword [esi + 0x14], 0xffffffff
je 0x1009686
jmp 0x10093a0
push ebx
push dword [ebp - 0x4010]
call fcn.0100932f
mov eax, 0x80040201
jmp 0x100968c
cmp esi, ebx
je 0x1009686
xor eax, eax
push 0x1ffe
mov word [ebp - 0x4004], ax
lea eax, [ebp - 0x4002]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [esi + 0x14], 0xffffffff
mov dword [ebp - 0x4008], ebx
je 0x1009686
mov edi, 0x1000
xor eax, eax
push 0x1ffe
mov word [ebp - 0x2004], ax
lea eax, [ebp - 0x2002]
push ebx
push eax
call sub.msvcrt.dll_memset
mov eax, dword [esi]
add esp, 0xc
cmp eax, ebx
je 0x10095de
push dword [esi + 4]
mov dword [ebp - 0x4008], eax
push edi
lea eax, [ebp - 0x4004]
push eax
call fcn.0100603f
cmp eax, ebx
jl 0x100968c
push dword [esi + 4]
lea eax, [ebp - 0x2004]
push edi
push eax
call fcn.0100603f
cmp eax, ebx
mov dword [ebp - 0x400c], eax
jge 0x100962a
jmp 0x100968c
lea eax, [ebp - 0x4004]
push eax
push edi
lea eax, [ebp - 0x2004]
push eax
call fcn.0100603f
cmp eax, ebx
jl 0x100968c
push 0x1002884
push edi
lea eax, [ebp - 0x2004]
push eax
call fcn.01005351
cmp eax, ebx
jl 0x100968c
push dword [esi + 4]
lea eax, [ebp - 0x2004]
push edi
push eax
call fcn.01005351
cmp eax, ebx
mov dword [ebp - 0x400c], eax
jl 0x1009686
cmp dword [ebp - 0x4008], ebx
je 0x1009679
mov eax, dword [esi + 0x14]
test al, 0xb
jne 0x100964d
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x4008]
call fcn.010091c4
jmp 0x1009666
test al, 8
je 0x1009679
push dword [esi + 8]
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x4008]
call fcn.010092cc
cmp eax, ebx
je 0x1009679
cmp eax, 2
je 0x1009679
mov dword [ebp - 0x400c], 0x80040201
add esi, 0x18
cmp dword [esi + 0x14], 0xffffffff
jne 0x100957d
mov eax, dword [ebp - 0x400c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01007f0f
leave
ret 8