Function at 0x10017260
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100885d0
mov eax, dword fs:[0]
push eax
sub esp, 0x394
mov eax, dword [0x100c9018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea edx, [ebp - 0x3a]
call fcn.10016eb0
test eax, eax
jne 0x100172a0
xor ecx, ecx
jmp 0x100173f0
mov eax, dword [0x100b5024]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x40], eax
mov ax, word [0x100b5028]
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x39c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [ebp - 0x40]
push eax
push SysReAllocString
call edi
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x394], ecx
test eax, eax
jne 0x100173f0
push 7
push str.Weasel
push 1
push eax
push eax
push dword [ebp - 0x39c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb esi, esi
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x398]
inc esi
and esi, dword [ebp - 0x394]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.InprocServer32
push dword [ebp - 0x39c]
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
test eax, eax
cmove ecx, esi
mov dword [ebp - 0x394], ecx
test ecx, ecx
je 0x100173e2
push 0x104
lea eax, [ebp - 0x188]
push eax
push dword [0x100ce5b0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x3a0], eax
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017380
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x188]
push eax
push 1
push 0
push 0
push dword [ebp - 0x398]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0xa
push str.Apartment
push 1
neg eax
push 0
sbb esi, esi
push str.ThreadingModel
push dword [ebp - 0x398]
inc esi
and esi, dword [ebp - 0x394]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x398]
xor ecx, ecx
test eax, eax
cmove ecx, esi
mov dword [ebp - 0x394], ecx
call edi
push dword [ebp - 0x39c]
call edi
mov ecx, dword [ebp - 0x394]
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
test ecx, ecx
je 0x1001755a
push 0x104
lea eax, [ebp - 0x390]
push eax
push dword [0x100ce5b0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, eax
mov dword [ebp - 0x394], 0
lea eax, [ebp - 0x394]
push eax
push 0x100b80c4
push 0x17
push 0
push 0x1008e600
call esi
test eax, eax
jns 0x10017449
mov dword [ebp - 4], 0
jmp 0x100174d4
mov eax, dword [ebp - 0x394]
lea edx, [ebp - 0x390]
push 0
push 1
push 0
mov ecx, dword [eax]
push 0
push 0
push edi
push edx
push 3
push 0x100b80a8
push 0x100b4ff4
push 0x404
push 0x100b4fe4
push eax
call dword [ecx + 0x20]
test eax, eax
jns 0x1001748a
mov dword [ebp - 4], 1
jmp 0x100174d4
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x394]
test eax, eax
je 0x100174a1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x394]
mov dword [ebp - 4], 0xffffffff
push eax
push 0x1008e580
push 1
push 0
push 0x1008e5f0
mov dword [ebp - 0x394], 0
call esi
test eax, eax
je 0x100174ed
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x394]
test eax, eax
je 0x100174e4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
jmp 0x1001755a
mov edi, 1
mov esi, 0x100ce608
nop word [eax + eax]
mov eax, dword [ebp - 0x394]
push 0x100b4fe4
push esi
push 0x100b4fe4
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
xor ecx, ecx
test eax, eax
cmove ecx, edi
add esi, 0x10
mov edi, ecx
cmp esi, 0x100ce708
jne 0x10017500
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x394]
test eax, eax
je 0x10017542
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x10017554
xor eax, eax
jmp 0x100176b1
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [ebp - 0x394]
mov dword [ebp - 0x394], 0
push eax
push 0x100b80c4
push 0x17
push 0
push 0x1008e600
call esi
test eax, eax
jns 0x10017588
mov dword [ebp - 4], 5
jmp 0x100175ac
mov eax, dword [ebp - 0x394]
push 0
push 0x100b4ff4
push 0x404
mov ecx, dword [eax]
push 0x100b4fe4
push eax
call dword [ecx + 0x24]
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x394]
test eax, eax
je 0x100175bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x394]
mov dword [ebp - 4], 0xffffffff
push eax
push 0x1008e580
push 1
push 0
push 0x1008e5f0
mov dword [ebp - 0x394], 0
call esi
test eax, eax
jns 0x100175f1
mov dword [ebp - 4], 7
jmp 0x10017629
mov esi, 0x100ce608
nop word [eax + eax]
mov eax, dword [ebp - 0x394]
push 0x100b4fe4
push esi
push 0x100b4fe4
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
add esi, 0x10
cmp esi, 0x100ce708
jne 0x10017600
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x394]
test eax, eax
je 0x10017639
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edx, [ebp - 0x3a]
mov dword [ebp - 4], 0xffffffff
call fcn.10016eb0
test eax, eax
je 0x100176ac
mov eax, dword [0x100b5024]
lea edx, [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov ecx, SysReAllocString
mov ax, word [0x100b5028]
mov word [ebp - 0x3c], ax
call fcn.10016f10
lea edx, [ebp - 0x6a]
call fcn.10016eb0
test eax, eax
je 0x100176ac
movups xmm0, xmmword [str.SoftwareMicrosftCTFTIP_]
mov ax, word [0x100b5054]
lea edx, [ebp - 0x84]
mov ecx, SysReAllocString
mov word [ebp - 0x6c], ax
movups xmmword [ebp - 0x84], xmm0
movq xmm0, qword [0x100b504c]
movq qword [ebp - 0x74], xmm0
call fcn.10016f10
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005b43f
mov esp, ebp
pop ebp
ret