Function at 0x10001b7a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa58
mov eax, dword [0x1005ce10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xa38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xa34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xa50], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xa4c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xa44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xa48], eax
mov eax, dword [ebp + 0x20]
push esi
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp + 0x24]
push edi
mov dword [ebp - 0xa40], eax
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x620], ax
xor edi, edi
lea eax, [ebp - 0x61e]
push edi
push eax
call fcn.10035680
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x826]
push edi
push eax
call fcn.10035680
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push edi
push eax
call fcn.10035680
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0xa30], ax
lea eax, [ebp - 0xa2e]
push edi
push eax
call fcn.10035680
add esp, 0xc
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.10035680
add esp, 0xc
lea esi, [ebx + 0x228]
push 0x1005351c
mov ecx, esi
call fcn.100028fc
push dword [ebp - 0xa40]
mov ecx, esi
call fcn.1000266a
push 0x10053644
lea ecx, [ebx + 0x20c]
call fcn.100028fc
push 4
lea eax, [ebp - 0xa54]
push eax
push 4
push str.ServicesPipeTimeout
push str.SYSTEMCurrentControlSetControl
push 0x80000002
mov dword [ebp - 0xa54], 0xea60
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [ebp - 0xa38]
xor edx, edx
push 3
pop ecx
div ecx
mov ecx, eax
shr ecx, 1
mov edx, eax
cmp eax, edi
jne 0x10001cd5
mov eax, 0xf789
cmp ecx, edi
jne 0x10001cde
mov ecx, 0x8790
cmp edx, edi
jne 0x10001ce7
mov edx, 0x7987988
mov esi, eax
shr esi, 1
shr edx, 3
or esi, ecx
sub edx, esi
lea edx, [edx + eax - 0x17]
cmp edx, edi
jne 0x10001cfc
mov edx, ecx
sub ecx, eax
and ecx, 0xfff
sub edx, ecx
add edx, eax
lea eax, [edx*8 - 0xb8]
push eax
call fcn.100022af
pop ecx
call fcn.1001fb04
push dword [ebp - 0xa40]
push dword [ebp - 0xa58]
push dword [ebp - 0xa48]
push dword [ebp - 0xa44]
push dword [ebp - 0xa34]
push dword [ebp - 0xa38]
call sym.EXEngine.dll_Ordinal_33
push 4
call sym.EXEngine.dll_Ordinal_8
mov esi, 0x104
push esi
lea eax, [ebp - 0x620]
push eax
push dword [0x1005f270]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push dword [ebp - 0xa44]
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x10001da4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x620]
push eax
push esi
lea eax, [ebp - 0x418]
push eax
call fcn.1000351b
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push dword [ebp - 0xa34]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x620]
push eax
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.1000351b
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
cmp dword [0x1005f274], edi
je 0x10001e0f
push dword [ebp - 0xa4c]
jmp 0x10001e15
push dword [ebp - 0xa50]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x10001e47
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x248], eax
push esi
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push dword [ebp - 0xa34]
lea eax, [ebp - 0xa30]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push edi
lea eax, [ebp - 0xa30]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x10001e91
call esi
call esi
mov dword [ebx + 0x24c], eax
lea eax, [ebp - 0xa3c]
push eax
push 0x1005049c
mov dword [ebp - 0xa3c], edi
call sym.EXEngine.dll_Ordinal_5
mov eax, dword [ebp - 0xa3c]
cmp eax, edi
je 0x10001ed3
mov ecx, dword [eax]
push edi
push dword [ebp - 0xa34]
push dword [ebp - 0xa38]
push eax
call dword [ecx + 0xc]
test eax, eax
je 0x10001ed3
call esi
call esi
mov dword [ebx + 0x250], eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.10032a69
leave
ret 0x20