Function at 0xfff20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x2f
push 0
push 0
dec ecx
jne 0xfff28
push ecx
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x1003cc
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.00025a70
lea eax, [ebp - 0x28]
call fcn.00025a70
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 4]
call fcn.000145ac
lea eax, [ebp - 0x2c]
call fcn.00028ac4
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
mov edx, 0x1003e4
call fcn.00013ff4
lea eax, [ebp - 0x20]
mov edx, dword [0xf5394]
call fcn.00015964
push esi
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x15]
lea eax, [ebp - 0x20]
call fcn.000ffa50
mov ebx, eax
cmp byte [ebp - 0x15], 0
jne 0x100008
mov eax, dword [ebp - 0x20]
call fcn.0001579c
mov edi, eax
push 0x100404
mov eax, edi
cdq
push edx
push eax
lea eax, [ebp - 0x34]
call fcn.00027444
push dword [ebp - 0x34]
push 0x100428
lea edx, [ebp - 0x38]
mov eax, ebx
call fcn.00027478
push dword [ebp - 0x38]
lea eax, [ebp - 0x30]
mov edx, 4
call fcn.00014068
mov eax, dword [ebp - 0x30]
mov edx, esi
call fcn.000f593c
test edi, edi
jle 0x100368
cmp edi, 0x2800
jge 0x100368
mov ecx, esi
mov eax, dword [ebp - 0x20]
mov edx, edi
call fcn.000f552c
jmp 0x100368
mov eax, dword [ebp - 0x20]
call fcn.0001579c
cmp eax, 0x158
jle 0x10032f
mov eax, dword [ebp - 0x20]
mov bl, byte [eax + 0x158]
test bl, bl
jb 0x100051
cmp bl, 3
ja 0x100051
xor eax, eax
mov al, bl
mov ecx, dword [eax*4 + 0x2506cc]
lea eax, [ebp - 0x3c]
mov edx, 0x100434
call fcn.00013ff4
mov eax, dword [ebp - 0x3c]
mov edx, esi
call fcn.000f54a4
jmp 0x100086
lea edx, [ebp - 0x144]
mov eax, ebx
call fcn.00029738
lea edx, [ebp - 0x144]
lea eax, [ebp - 0x44]
call fcn.00013f4c
mov ecx, dword [ebp - 0x44]
lea eax, [ebp - 0x40]
mov edx, 0x100454
call fcn.00013ff4
mov eax, dword [ebp - 0x40]
mov edx, esi
call fcn.000f593c
cmp bl, 1
je 0x100368
mov eax, dword [ebp - 0x20]
mov byte [eax + 0x158], 1
lea eax, [ebp - 0x24]
call fcn.00029ddc
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, 0x100474
call fcn.00013ff4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
cmp dword [ebp - 0x1c], 0
je 0x1001a3
mov eax, dword [ebp - 0x20]
call fcn.0001579c
push eax
mov eax, dword [ebp - 0x20]
push eax
push 3
push 0
push 0x1004b4
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
je 0x100142
lea edx, [ebp - 0x14c]
mov eax, ebx
call fcn.00027478
mov ecx, dword [ebp - 0x14c]
lea eax, [ebp - 0x148]
mov edx, 0x1004dc
call fcn.00013ff4
mov eax, dword [ebp - 0x148]
mov edx, esi
call fcn.000f59c4
mov eax, dword [ebp - 0x24]
call fcn.00013fa8
inc eax
push eax
mov eax, dword [ebp - 0x24]
call fcn.0001416c
push eax
push 1
push 0
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
test ebx, ebx
je 0x1001d3
lea edx, [ebp - 0x154]
mov eax, ebx
call fcn.00027478
mov ecx, dword [ebp - 0x154]
lea eax, [ebp - 0x150]
mov edx, 0x1004fc
call fcn.00013ff4
mov eax, dword [ebp - 0x150]
mov edx, esi
call fcn.000f59c4
jmp 0x1001d3
lea edx, [ebp - 0x15c]
mov eax, ebx
call fcn.00027478
mov ecx, dword [ebp - 0x15c]
lea eax, [ebp - 0x158]
mov edx, 0x10051c
call fcn.00013ff4
mov eax, dword [ebp - 0x158]
mov edx, esi
call fcn.000f59c4
cmp dword [ebp - 0x1c], 0
je 0x1001e2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, 0x10053c
call fcn.00013ff4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
cmp dword [ebp - 0x1c], 0
je 0x1002e9
mov eax, dword [ebp - 0x20]
call fcn.0001579c
push eax
mov eax, dword [ebp - 0x20]
push eax
push 3
push 0
push 0x1004b4
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
test ebx, ebx
je 0x100288
lea edx, [ebp - 0x164]
mov eax, ebx
call fcn.00027478
mov ecx, dword [ebp - 0x164]
lea eax, [ebp - 0x160]
mov edx, 0x100578
call fcn.00013ff4
mov eax, dword [ebp - 0x160]
mov edx, esi
call fcn.000f59c4
mov eax, dword [ebp - 0x24]
call fcn.00013fa8
inc eax
push eax
mov eax, dword [ebp - 0x24]
call fcn.0001416c
push eax
push 1
push 0
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
test ebx, ebx
je 0x100319
lea edx, [ebp - 0x16c]
mov eax, ebx
call fcn.00027478
mov ecx, dword [ebp - 0x16c]
lea eax, [ebp - 0x168]
mov edx, 0x100598
call fcn.00013ff4
mov eax, dword [ebp - 0x168]
mov edx, esi
call fcn.000f59c4
jmp 0x100319
lea edx, [ebp - 0x174]
mov eax, ebx
call fcn.00027478
mov ecx, dword [ebp - 0x174]
lea eax, [ebp - 0x170]
mov edx, 0x1005b8
call fcn.00013ff4
mov eax, dword [ebp - 0x170]
mov edx, esi
call fcn.000f59c4
cmp dword [ebp - 0x1c], 0
je 0x100328
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x100368
mov eax, dword [ebp - 0x20]
call fcn.0001579c
cdq
push edx
push eax
lea eax, [ebp - 0x17c]
call fcn.00027444
mov ecx, dword [ebp - 0x17c]
lea eax, [ebp - 0x178]
mov edx, 0x1005d8
call fcn.00013ff4
mov eax, dword [ebp - 0x178]
mov edx, esi
call fcn.000f593c
lea eax, [ebp - 0x20]
mov edx, dword [0xf5394]
call fcn.00015964
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1003d3
lea eax, [ebp - 0x17c]
mov edx, 0xe
call fcn.00013d3c
lea eax, [ebp - 0x44]
mov edx, 9
call fcn.00013d3c
lea eax, [ebp - 0x20]
mov edx, dword [0xf5394]
call fcn.00015964
lea eax, [ebp - 0x14]
call fcn.00013d18
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 4]
call fcn.000143f0
ret