Function at 0x10008131
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5b8
push ebx
push esi
push edi
push 8
pop ecx
mov esi, str.SoftwareMozillaMozilla_FireFox_
lea edi, [ebp - 0x54]
push 0x15
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop ecx
mov esi, str.pref__keyword.URL____http:__name.cnnic.cn_cn.dll_pidfirefoxcharsetutf8name____r_n
lea edi, [ebp - 0xac]
push 0x7f
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x5b7]
mov byte [ebp - 0x5b8], bl
push 0x2001f
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x54]
lea ecx, [ebp - 4]
push eax
push 0x80000002
mov dword [ebp - 0x10], 0x200
mov dword [ebp - 4], ebx
call fcn.10002402
test eax, eax
jne 0x100082ed
mov esi, str.Install_directory
lea edi, [ebp - 0x30]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x40
lea edi, [ebp - 0x3b7]
pop ecx
mov byte [ebp - 0x3b8], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x2b3]
mov byte [ebp - 0x2b4], bl
mov edx, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
lea ecx, [ebp - 4]
push eax
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x3b8]
push eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0xc], edx
push dword [ebp - 4]
mov dword [ebp - 8], edx
call fcn.10008e61
test eax, eax
jne 0x100082ed
push 0x40
lea edi, [ebp - 0x1af]
pop ecx
mov byte [ebp - 0x1b0], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x2b4]
push eax
lea eax, [ebp - 0x1b0]
push eax
call fcn.1000a900
lea eax, [ebp - 0x1b0]
push str.defaultsprefFireFox.js
push eax
call fcn.1000a900
lea eax, [ebp - 0x10]
mov esi, str.keyword.URL
push eax
lea edi, [ebp - 0x1c]
lea eax, [ebp - 0x5b8]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x1b0]
push eax
movsd dword es:[edi], dword [esi]
call fcn.1000a268
add esp, 0x24
test eax, eax
je 0x100082ed
lea eax, [ebp - 0xc]
mov dword [ebp - 8], ebx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SOFTWARECNNICCdnClientInstallInfo
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
jne 0x100082de
lea eax, [ebp - 0x5b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, dword [ebp - 8]
inc eax
push eax
lea eax, [ebp - 0x5b8]
push eax
push 1
push ebx
push str.KeywordBak
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100082d7
cmp edi, ebx
jmp 0x100082d9
cmp edi, ebx
je 0x100082de
push edi
call esi
cmp dword [ebp - 4], ebx
je 0x100082e8
push dword [ebp - 4]
call esi
push 1
pop eax
jmp 0x100082fd
cmp dword [ebp - 4], ebx
je 0x100082fb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret