Function at 0x1003cda4
Capabilities:
Set registry value

Disassembly:
sub esp, 0x358
mov eax, dword [0x102bff3c]
xor eax, esp
mov dword [esp + 0x354], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 8]
push ebp
push esi
push edi
push eax
mov ebp, 0xf013f
xor edi, edi
push ebp
push edi
push 0x1023b054
push connect
mov dword [esp + 0x2c], edi
call ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [esp + 0x14], edi
jne 0x1003ce14
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push eax
push edi
push ebp
push edi
push edi
push edi
push 0x1023b07c
push connect
call esi
cmp dword [esp + 0x14], edi
jne 0x1003ce14
xor al, al
jmp 0x1003d000
cmp dword [esp + 0x18], 1
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x1003cff8
push 0x100
lea eax, [esp + 0x268]
push edi
push eax
call fcn.101d1720
push 0x102d7bc0
lea eax, [esp + 0x274]
push 0x80
push eax
call fcn.101df899
lea ecx, [esp + 0x27c]
add esp, 0x18
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x1003ce5c
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x268]
push eax
push 1
push edi
push 0x1023b0a4
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], edi
push eax
push 0xf013f
push edi
push 0x1023b0a8
push dword [esp + 0x24]
call ebx
mov edi, dword [esp + 0x10]
test edi, edi
jne 0x1003cecb
xor ecx, ecx
lea eax, [esp + 0x10]
push ecx
push eax
push ecx
push 0xf013f
push ecx
push ecx
push ecx
push str.DefaultIcon
push dword [esp + 0x34]
call esi
mov edi, dword [esp + 0x10]
push 0x248
lea eax, [esp + 0x20]
push 0
push eax
call fcn.101d1720
add esp, 0xc
test edi, edi
je 0x1003cf49
push 0x102d7dc8
lea eax, [esp + 0x20]
push 0x124
push eax
call fcn.101df899
push str.DTUltra.exe_0
lea eax, [esp + 0x2c]
push 0x124
push eax
call fcn.101df824
lea ecx, [esp + 0x34]
add esp, 0x18
lea edx, [ecx + 2]
xor edi, edi
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x1003cf17
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x20]
push eax
push 1
push edi
push 0x1023b0f4
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x10]
call ebp
jmp 0x1003cf4b
xor edi, edi
lea eax, [esp + 0x10]
push eax
push 0xf013f
push edi
push 0x1023b0f8
push dword [esp + 0x24]
call ebx
cmp dword [esp + 0x10], 0
jne 0x1003cf89
push edi
lea eax, [esp + 0x14]
push eax
push edi
push 0xf013f
push edi
push edi
push edi
push str.shellopencommand
push dword [esp + 0x34]
call esi
cmp dword [esp + 0x10], 0
je 0x1003cff8
push 0x1023b148
mov ebx, 0x124
lea eax, [esp + 0x20]
push ebx
push eax
call fcn.101df899
push 0x102d7dc8
lea eax, [esp + 0x2c]
push ebx
push eax
call fcn.101df824
push 0x1023b14c
lea eax, [esp + 0x38]
push ebx
push eax
call fcn.101df824
lea ecx, [esp + 0x40]
add esp, 0x24
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x1003cfc8
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [esp + 0x20]
push eax
push 1
push edi
push 0x1023b188
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 0x10]
call ebp
push dword [esp + 0x14]
call ebp
mov al, 1
mov ecx, dword [esp + 0x364]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.101b70aa
add esp, 0x358
ret