Function at 0x9c7860
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4e4
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x4e0], eax
push ebx
push esi
push edi
mov ecx, 0xe
mov esi, str.CLSID8cec58ae_07a1_11d9_b15e_000d56bfe6eeLocalServer32
lea edi, [esp + 0x160]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xe
mov esi, str.TypeLib8cec5860_07a1_11d9_b15e_000d56bfe6ee1.00win32
lea edi, [esp + 0x124]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0xe
mov esi, str.TypeLib8cec5860_07a1_11d9_b15e_000d56bfe6ee1.00win64
lea edi, [esp + 0x19c]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
push 0x103
movsw word es:[edi], word [esi]
lea eax, [esp + 0x1dd]
push ebx
push eax
movsb byte es:[edi], byte [esi]
mov byte [esp + 0x1e4], bl
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [esp + 0x1d8]
call fcn.009790d0
cmp byte [esp + 0x1d8], bl
je 0x9c8100
mov eax, dword [ebp + 8]
cmp eax, 1
jne 0x9c7cf8
push ebx
lea eax, [esp + 0x18]
lea edi, [esp + 0x1c]
lea ecx, [esp + 0x164]
mov edx, 0x80000000
mov byte [esp + 0x1c], bl
mov dword [esp + 0x18], 0x104
call fcn.0094c020
push ebx
mov ecx, edi
push str.helppane.exe
push ecx
call fcn.0095c8c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 0xc
cmp eax, 0xffffffff
je 0x9c7a4c
lea edx, [esp + 0x1d8]
push edx
lea eax, [esp + 0x164]
push eax
lea ecx, [esp + 0x2e8]
push str.SUBINACL__keyreg__HKEY_CLASSES_ROOT_s___setowner_s
push ecx
call fcn.00a78f30
add esp, 0x10
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 1
lea edx, [esp + 0x2f8]
push edx
push ebx
call fcn.0095db20
test eax, eax
jne 0x9c79c8
lea eax, [esp + 0x1d8]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x168]
push edx
lea eax, [esp + 0x2ec]
push str.SUBINACL__keyreg__HKEY_CLASSES_ROOT_s___setowner_s__grant_sf
push eax
call fcn.00a78f30
add esp, 0x14
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 1
lea ecx, [esp + 0x2f8]
push ecx
push ebx
call fcn.0095db20
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x164]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x9c7a4c
push str..ex_
lea ecx, [esp + 0x1c]
push 0xad8680
push ecx
call fcn.0095e130
add esp, 0xc
push ebx
lea edx, [esp + 0x1c]
push str.SystemRoot
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
lea eax, [esp + 0x18]
push eax
je 0x9c7a29
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 2
jmp 0x9c7a38
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [esp + 0x18]
lea edi, [esp + 0x1c]
lea ecx, [esp + 0x128]
mov edx, 0x80000000
mov byte [esp + 0x1c], bl
mov dword [esp + 0x18], 0x104
call fcn.0094c020
push ebx
mov ecx, edi
push str.helppane.exe
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9c7b8f
lea edx, [esp + 0x1d8]
push edx
lea eax, [esp + 0x128]
push eax
lea ecx, [esp + 0x2e8]
push str.SUBINACL__keyreg__HKEY_CLASSES_ROOT_s___setowner_s
push ecx
call fcn.00a78f30
add esp, 0x10
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 1
lea edx, [esp + 0x2f8]
push edx
push ebx
call fcn.0095db20
test eax, eax
jne 0x9c7b0b
lea eax, [esp + 0x1d8]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x12c]
push edx
lea eax, [esp + 0x2ec]
push str.SUBINACL__keyreg__HKEY_CLASSES_ROOT_s___setowner_s__grant_sf
push eax
call fcn.00a78f30
add esp, 0x14
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 1
lea ecx, [esp + 0x2f8]
push ecx
push ebx
call fcn.0095db20
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x128]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x9c7b8f
push str..ex_
lea ecx, [esp + 0x1c]
push 0xad8680
push ecx
call fcn.0095e130
add esp, 0xc
push ebx
lea edx, [esp + 0x1c]
push str.SystemRoot
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
lea eax, [esp + 0x18]
push eax
je 0x9c7b6c
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 2
jmp 0x9c7b7b
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00968110
test eax, eax
je 0x9c8100
push ebx
lea eax, [esp + 0x18]
lea edi, [esp + 0x1c]
lea ecx, [esp + 0x1a0]
mov edx, 0x80000000
mov byte [esp + 0x1c], bl
mov dword [esp + 0x18], 0x104
call fcn.0094c020
push ebx
mov ecx, edi
push str.helppane.exe
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9c8100
lea edx, [esp + 0x1d8]
push edx
lea eax, [esp + 0x1a0]
push eax
lea ecx, [esp + 0x2e8]
push str.SUBINACL__keyreg__HKEY_CLASSES_ROOT_s___setowner_s
push ecx
call fcn.00a78f30
add esp, 0x10
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 1
lea edx, [esp + 0x2f8]
push edx
push ebx
call fcn.0095db20
test eax, eax
jne 0x9c7c5b
lea eax, [esp + 0x1d8]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x1a4]
push edx
lea eax, [esp + 0x2ec]
push str.SUBINACL__keyreg__HKEY_CLASSES_ROOT_s___setowner_s__grant_sf
push eax
call fcn.00a78f30
add esp, 0x14
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 1
lea ecx, [esp + 0x2f8]
push ecx
push ebx
call fcn.0095db20
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1a0]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x9c8100
push str..ex_
lea ecx, [esp + 0x1c]
push 0xad8680
push ecx
call fcn.0095e130
add esp, 0xc
push ebx
lea edx, [esp + 0x1c]
push str.SystemRoot
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
lea eax, [esp + 0x18]
push eax
je 0x9c7cc0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 2
jmp 0x9c7ccf
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x4e0]
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
cmp eax, ebx
jne 0x9c8100
push ebx
lea eax, [esp + 0x18]
lea edi, [esp + 0x1c]
lea ecx, [esp + 0x164]
mov edx, 0x80000000
mov byte [esp + 0x1c], bl
mov dword [esp + 0x18], 0x104
call fcn.0094c020
push ebx
mov ecx, edi
push str.helppane.ex_
push ecx
call fcn.0095c8c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 0xc
cmp eax, 0xffffffff
je 0x9c7e55
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x164]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x9c7dc2
push 0xad8680
mov ecx, edi
push str..ex_
push ecx
call fcn.0095e130
add esp, 0xc
push ebx
mov edx, edi
push str.SystemRoot
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
mov eax, edi
push eax
je 0x9c7d9f
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov ecx, edi
push ecx
push 2
jmp 0x9c7dae
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push 1
mov edx, dword [esp + 0x1c]
push ebx
push ebx
push edx
call esi
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x1d8]
push ecx
mov edx, ecx
push edx
lea eax, [esp + 0x168]
push eax
lea ecx, [esp + 0x2ec]
push str.SUBINACL__keyreg__HKEY_CLASSES_ROOT_s___setowner_s__grant_sr
push ecx
call fcn.00a78f30
add esp, 0x14
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 1
lea edx, [esp + 0x2f8]
push edx
push ebx
call fcn.0095db20
call fcn.00968d70
test eax, eax
je 0x9c7e21
lea eax, [esp + 0x160]
push eax
push str.SUBINACL__keyreg__HKEY_CLASSES_ROOT_s___setowner_NT_SERVICETrustedInstaller_
lea ecx, [esp + 0x2e8]
push ecx
jmp 0x9c7e36
lea edx, [esp + 0x160]
push edx
push str.SUBINACL__keyreg__HKEY_CLASSES_ROOT_s___setownerAdministrators
lea eax, [esp + 0x2e8]
push eax
call fcn.00a78f30
add esp, 0xc
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 1
lea ecx, [esp + 0x2f8]
push ecx
push ebx
call fcn.0095db20
push ebx
lea eax, [esp + 0x18]
lea edi, [esp + 0x1c]
lea ecx, [esp + 0x128]
mov edx, 0x80000000
mov byte [esp + 0x1c], bl
mov dword [esp + 0x18], 0x104
call fcn.0094c020
push ebx
mov edx, edi
push str.helppane.ex_
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9c7fa4
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x128]
push ecx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x9c7f11
push 0xad8680
mov edx, edi
push str..ex_
push edx
call fcn.0095e130
add esp, 0xc
push ebx
mov eax, edi
push str.SystemRoot
push eax
call fcn.0095c8c0
add esp, 0xc
mov ecx, edi
push ecx
cmp eax, 0xffffffff
je 0x9c7eee
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov edx, edi
push edx
push 2
jmp 0x9c7efd
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea edx, [esp + 0x1c]
push edx
push 1
mov eax, dword [esp + 0x1c]
push ebx
push ebx
push eax
call esi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x1d8]
push edx
mov eax, edx
push eax
lea ecx, [esp + 0x12c]
push ecx
lea edx, [esp + 0x2ec]
push str.SUBINACL__keyreg__HKEY_CLASSES_ROOT_s___setowner_s__grant_sr
push edx
call fcn.00a78f30
add esp, 0x14
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 1
lea eax, [esp + 0x2f8]
push eax
push ebx
call fcn.0095db20
call fcn.00968d70
test eax, eax
je 0x9c7f70
lea ecx, [esp + 0x124]
push ecx
push str.SUBINACL__keyreg__HKEY_CLASSES_ROOT_s___setowner_NT_SERVICETrustedInstaller_
lea edx, [esp + 0x2e8]
push edx
jmp 0x9c7f85
lea eax, [esp + 0x124]
push eax
push str.SUBINACL__keyreg__HKEY_CLASSES_ROOT_s___setownerAdministrators
lea ecx, [esp + 0x2e8]
push ecx
call fcn.00a78f30
add esp, 0xc
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 1
lea edx, [esp + 0x2f8]
push edx
push ebx
call fcn.0095db20
call fcn.00968110
test eax, eax
je 0x9c8100
push ebx
lea eax, [esp + 0x18]
lea edi, [esp + 0x1c]
lea ecx, [esp + 0x1a0]
mov edx, 0x80000000
mov byte [esp + 0x1c], bl
mov dword [esp + 0x18], 0x104
call fcn.0094c020
push ebx
mov eax, edi
push str.helppane.ex_
push eax
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x9c8100
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x1a0]
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x9c806d
push 0xad8680
mov eax, edi
push str..ex_
push eax
call fcn.0095e130
add esp, 0xc
push ebx
mov ecx, edi
push str.SystemRoot
push ecx
call fcn.0095c8c0
add esp, 0xc
mov edx, edi
push edx
cmp eax, 0xffffffff
je 0x9c804a
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov eax, edi
push eax
push 2
jmp 0x9c8059
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
mov ecx, dword [esp + 0x1c]
push ebx
push ebx
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x1d8]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x1a4]
push edx
lea eax, [esp + 0x2ec]
push str.SUBINACL__keyreg__HKEY_CLASSES_ROOT_s___setowner_s__grant_sr
push eax
call fcn.00a78f30
add esp, 0x14
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 1
lea ecx, [esp + 0x2f8]
push ecx
push ebx
call fcn.0095db20
call fcn.00968d70
test eax, eax
je 0x9c80cc
lea edx, [esp + 0x19c]
push edx
push str.SUBINACL__keyreg__HKEY_CLASSES_ROOT_s___setowner_NT_SERVICETrustedInstaller_
lea eax, [esp + 0x2e8]
push eax
jmp 0x9c80e1
lea ecx, [esp + 0x19c]
push ecx
push str.SUBINACL__keyreg__HKEY_CLASSES_ROOT_s___setownerAdministrators
lea edx, [esp + 0x2e8]
push edx
call fcn.00a78f30
add esp, 0xc
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push 2
push 1
lea eax, [esp + 0x2f8]
push eax
push ebx
call fcn.0095db20
mov ecx, dword [esp + 0x4ec]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret