Function at 0x10001b87
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa64
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xa34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xa5c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xa48], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xa60], eax
mov eax, dword [ebp + 0x20]
push ebx
push esi
mov dword [ebp - 0xa64], eax
mov eax, dword [ebp + 0x24]
push edi
mov dword [ebp - 0xa50], eax
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x620], ax
xor edi, edi
lea eax, [ebp - 0x61e]
mov ebx, ecx
push edi
push eax
mov dword [ebp - 0xa38], ebx
call fcn.10035820
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0xa30], ax
lea eax, [ebp - 0xa2e]
push edi
push eax
call fcn.10035820
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push edi
push eax
call fcn.10035820
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x826]
push edi
push eax
call fcn.10035820
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.10035820
add esp, 0xc
lea esi, [ebx + 0x228]
push 0x1005351c
mov ecx, esi
call fcn.10002941
push dword [ebp - 0xa50]
mov ecx, esi
call fcn.100026af
push 0x10053644
lea ecx, [ebx + 0x20c]
call fcn.10002941
push 4
lea eax, [ebp - 0xa54]
push eax
push 4
push str.ServicesPipeTimeout
push str.SYSTEMCurrentControlSetControl
mov dword [ebp - 0xa54], 0xea60
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [ebp - 0xa44]
push 3
xor edx, edx
pop ecx
div ecx
mov ecx, eax
shr ecx, 1
mov dword [ebp - 0xa3c], eax
cmp eax, edi
jne 0x10001cf4
mov dword [ebp - 0xa3c], 0xf789
cmp ecx, edi
jne 0x10001cfd
mov ecx, 0x8790
cmp eax, edi
jne 0x10001d06
mov eax, 0x7987988
shr eax, 2
mov dword [ebp - 0xa40], eax
mov eax, dword [ebp - 0xa3c]
push 7
xor edx, edx
pop ebx
div ebx
mov esi, ecx
or esi, 7
add dword [ebp - 0xa40], esi
add eax, dword [ebp - 0xa40]
add eax, ecx
jne 0x10001d33
mov eax, ecx
movzx ecx, word [ebp - 0xa3c]
sub esi, ecx
add esi, eax
shl esi, 2
push esi
call fcn.100022ea
pop ecx
call fcn.1001fc54
push dword [ebp - 0xa50]
push dword [ebp - 0xa64]
push dword [ebp - 0xa60]
push dword [ebp - 0xa48]
push dword [ebp - 0xa34]
push dword [ebp - 0xa44]
call sym.EXEngine.dll_Ordinal_33
push 4
call sym.EXEngine.dll_Ordinal_8
mov esi, 0x104
push esi
lea eax, [ebp - 0x620]
push eax
push dword [0x1005f270]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push dword [ebp - 0xa48]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0xa30]
push eax
call ebx
push edi
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x10001dd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x620]
push eax
push esi
lea eax, [ebp - 0x418]
push eax
call fcn.10003561
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [ebp - 0xa34]
lea eax, [ebp - 0x418]
push eax
call ebx
lea eax, [ebp - 0x620]
push eax
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.10003561
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
cmp dword [0x1005f274], edi
je 0x10001e3f
push dword [ebp - 0xa58]
jmp 0x10001e45
push dword [ebp - 0xa5c]
push eax
call ebx
push edi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x10001e79
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0xa38]
mov dword [ecx + 0x248], eax
push esi
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push dword [ebp - 0xa34]
lea eax, [ebp - 0x828]
push eax
call ebx
push edi
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10001ec5
call esi
call esi
mov ecx, dword [ebp - 0xa38]
mov dword [ecx + 0x24c], eax
lea eax, [ebp - 0xa4c]
push eax
push 0x1005049c
mov dword [ebp - 0xa4c], edi
call sym.EXEngine.dll_Ordinal_5
mov eax, dword [ebp - 0xa4c]
cmp eax, edi
je 0x10001f0d
mov ecx, dword [eax]
push edi
push dword [ebp - 0xa34]
push dword [ebp - 0xa44]
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x10001f0d
call esi
call esi
mov ecx, dword [ebp - 0xa38]
mov dword [ecx + 0x250], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10032bd7
leave
ret 0x20