Function at 0x10001b09
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
and dword [ebp - 0x28], 0
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x14], 6
mov esi, 0x104
push esi
call fcn.10003957
push esi
push 0
push eax
mov dword [ebp - 0x2c], eax
call fcn.10003870
push esi
call fcn.10003957
push esi
push 0
push eax
mov dword [ebp - 0x18], eax
call fcn.10003870
push esi
call fcn.10003957
push esi
push 0
push eax
mov dword [ebp - 0x10], eax
call fcn.10003870
push esi
call fcn.10003957
push esi
push 0
push eax
mov dword [ebp - 4], eax
call fcn.10003870
add esp, 0x40
push esi
call fcn.10003957
push esi
push 0
push eax
mov dword [ebp - 0x24], eax
call fcn.10003870
add esp, 0x10
push 3
push dword [ebp + 0x10]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
call sub.msi.dll_MsiRecordReadStream
cmp eax, 0x64
mov dword [ebp - 0x34], eax
jge 0x10001f2d
cmp eax, 1
je 0x10001bc2
cmp dword [ebp + 0x18], 0
je 0x10001f0d
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x2c]
push 1
push dword [ebp + 0x10]
call sub.msi.dll_MsiRecordSetInteger
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x18]
push 4
push dword [ebp + 0x10]
call sub.msi.dll_MsiRecordSetInteger
push 5
push dword [ebp + 0x10]
call sub.msi.dll_MsiRecordReadStream
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x10]
push 6
push dword [ebp + 0x10]
call sub.msi.dll_MsiRecordSetInteger
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x24]
push 8
push dword [ebp + 0x10]
call sub.msi.dll_MsiRecordSetInteger
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
push 7
push dword [ebp + 0x10]
call sub.msi.dll_MsiRecordSetInteger
cmp eax, 0xea
jne 0x10001c51
push dword [ebp - 4]
call fcn.1000386b
mov eax, dword [ebp - 0x20]
inc eax
push eax
call fcn.10003957
pop ecx
pop ecx
lea ecx, [ebp - 0x20]
push ecx
push eax
push 7
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
call sub.msi.dll_MsiRecordSetInteger
mov eax, dword [ebp - 0x34]
xor ecx, ecx
sub eax, ecx
je 0x10001c7e
dec eax
je 0x10001c75
dec eax
je 0x10001c6c
dec eax
jne 0x10001c75
mov dword [ebp - 8], MsiConfigureFeatureFromDescriptorA
jmp 0x10001c85
mov dword [ebp - 8], MsiConfigureFeatureFromDescriptorA
jmp 0x10001c85
mov dword [ebp - 8], 0x80000001
jmp 0x10001c85
mov dword [ebp - 8], 0x80000000
cmp dword [ebp - 0x30], 1
jb 0x10001ca2
push dword [ebp - 0x24]
push dword [ebp + 0x14]
call fcn.100037a0
test eax, eax
pop ecx
pop ecx
je 0x10001f0d
xor ecx, ecx
push ecx
lea eax, [ebp - 0xc]
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push dword [ebp - 0x18]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10001f0d
cmp dword [ebp - 0x14], 4
je 0x10001d7d
cmp dword [ebp - 0x14], 5
je 0x10001d7d
push dword [ebp - 4]
call edi
mov dword [ebp - 0x44], eax
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 8], eax
call fcn.10003957
push dword [ebp - 8]
mov dword [ebp - 0x28], eax
push 0
push eax
call fcn.10003870
push dword [ebp - 8]
call fcn.10003957
push dword [ebp - 8]
mov dword [ebp - 0x24], eax
push 0
push eax
call fcn.10003870
add esp, 0x20
push dword [ebp - 8]
push dword [ebp - 0x28]
push dword [ebp - 0x44]
push dword [ebp - 4]
push 0
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ecx, ecx
push ecx
push ecx
push dword [ebp - 8]
push dword [ebp - 0x24]
push eax
push dword [ebp - 0x28]
push ecx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push dword [ebp - 0x24]
call edi
inc eax
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x28]
call fcn.1000386b
pop ecx
jmp 0x10001db3
push dword [ebp - 4]
call fcn.100041a5
pop ecx
push dword [ebp - 4]
mov dword [ebp - 0x48], eax
call edi
push 4
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 1
jne 0x10001f0d
push esi
call fcn.10003957
mov dword [esp], str.AC76BA86
push dword [ebp + 0x14]
mov dword [ebp - 8], eax
call fcn.100037a0
test eax, eax
pop ecx
pop ecx
je 0x10001e03
push str.7AD7
push dword [ebp + 0x14]
call fcn.100037a0
test eax, eax
pop ecx
pop ecx
jne 0x10001e03
push str.SoftwareAdobeAdobe_Acrobat8.0InstallerMigrate
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.7AD7
push dword [ebp + 0x14]
call fcn.100037a0
test eax, eax
pop ecx
pop ecx
je 0x10001e24
push str.SoftwareAdobeAcrobat_Reader8.0InstallerMigrate
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.AC76D478
push dword [ebp + 0x14]
call fcn.100037a0
test eax, eax
pop ecx
pop ecx
je 0x10001e45
push str.SoftwareAdobeAcrobat_Distiller8.0InstallerMigrate
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.E5E6E687
push dword [ebp + 0x14]
call fcn.100037a0
test eax, eax
pop ecx
pop ecx
je 0x10001e66
push str.SoftwareAdobeAcrobat_Elements8.0InstallerMigrate
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1000e1d8
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push dword [ebp - 0x2c]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
push eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
push 0xf003f
push eax
push eax
push eax
push dword [ebp - 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10001f04
push dword [ebp - 0x18]
call edi
inc eax
push eax
push dword [ebp - 0x18]
push 1
push 0
push 0x1000e4b6
push dword [ebp - 0x1c]
call ebx
push dword [ebp - 0x10]
call edi
inc eax
push eax
push dword [ebp - 0x10]
push 1
push 0
push str.name
push dword [ebp - 0x1c]
call ebx
push dword [ebp - 4]
call edi
inc eax
push eax
push dword [ebp - 4]
push 1
push 0
push 0x1000e578
push dword [ebp - 0x1c]
call ebx
mov eax, dword [ebp - 0x14]
push 4
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x4c]
push eax
push 4
push 0
push str.type
push dword [ebp - 0x1c]
call ebx
push dword [ebp - 8]
call fcn.1000386b
pop ecx
push dword [ebp + 0x10]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call sub.msi.dll_MsiDatabaseIsTablePersistentA
push dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
call fcn.1000386b
pop ecx
cmp dword [ebp - 0x14], 0
je 0x10001b2e
mov eax, dword [ebp - 0x28]
pop edi
pop esi
pop ebx
leave
ret