Function at 0x10056d6b
Capabilities:
Set registry value

Disassembly:
push 0x260
mov eax, 0x100f0fbb
call fcn.10082248
mov dword [ebp - 0x268], ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
xor ebx, ebx
push 0x208
push ebx
push eax
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x25c], ebx
call fcn.100a25c0
add esp, 0xc
mov dword [ebp - 0x238], ebx
xor eax, eax
mov dword [ebp - 0x234], 7
lea ecx, [ebp - 0x248]
mov word [ebp - 0x248], ax
push 0x100fc528
call fcn.10022050
push str.ec03713d_b871_5145_b355_eeb7d2e384b4
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], ebx
call fcn.1003768b
push 0x100fc57c
lea ecx, [ebp - 0x248]
call fcn.1003768b
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x254]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push esi
call edi
test eax, eax
jne 0x100571bb
push ebx
lea eax, [ebp - 0x24c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x100fc6d0
push dword [ebp - 0x254]
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x100571aa
push ebx
lea eax, [ebp - 0x250]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x100f5958
push dword [ebp - 0x24c]
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1005706c
xor ecx, ecx
lea eax, [ebp - 0x258]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push str.win32
push dword [ebp - 0x250]
call edi
test eax, eax
jne 0x10056f80
mov eax, dword [ebp - 0x268]
xor ecx, ecx
add eax, 0x18
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x230]
push eax
call fcn.1003744e
push str.zipuscfg.dll
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.1003768b
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10056f20
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x260]
jne 0x10056f38
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
xor eax, eax
push eax
push 0x100f55e0
push dword [ebp - 0x258]
call ebx
push dword [ebp - 0x258]
call esi
xor eax, eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], al
call fcn.10001ee0
xor ecx, ecx
lea eax, [ebp - 0x25c]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push str.win64
push dword [ebp - 0x250]
call edi
test eax, eax
jne 0x1005705b
mov eax, dword [ebp - 0x268]
xor ecx, ecx
add eax, 0x18
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x230]
push eax
call fcn.1003744e
push str.zipuscfg64.dll
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.1003768b
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10056ffb
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x260]
jne 0x10057013
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
xor eax, eax
push eax
push 0x100f55e0
push dword [ebp - 0x25c]
call ebx
push dword [ebp - 0x25c]
call esi
xor eax, eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], al
call fcn.10001ee0
cmp dword [ebp - 0x250], 0
je 0x1005706c
push dword [ebp - 0x250]
call esi
xor ecx, ecx
lea eax, [ebp - 0x264]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push str.FLAGS
push dword [ebp - 0x24c]
call edi
test eax, eax
jne 0x100570db
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], 0x30
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x260]
jne 0x100570a3
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
xor eax, eax
push eax
push 0x100f55e0
push dword [ebp - 0x264]
call ebx
push dword [ebp - 0x264]
call esi
xor ecx, ecx
lea eax, [ebp - 0x26c]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push str.HELPDIR
push dword [ebp - 0x24c]
call edi
test eax, eax
jne 0x10057199
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x268]
add eax, 0x18
push eax
call fcn.1003744e
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10057140
lea ecx, [ebp - 0x218]
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x1005715a
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
xor eax, eax
push eax
push 0x100f55e0
push dword [ebp - 0x26c]
call ebx
push dword [ebp - 0x26c]
call esi
lea ecx, [ebp - 0x230]
call fcn.10001ee0
cmp dword [ebp - 0x24c], 0
je 0x100571aa
push dword [ebp - 0x24c]
call esi
cmp dword [ebp - 0x254], 0
je 0x100571bb
push dword [ebp - 0x254]
call esi
lea ecx, [ebp - 0x248]
call fcn.10001ee0
mov al, 1
call fcn.100821f2
ret 4