Function at 0x1001d490
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x2130
call fcn.100228d0
mov esi, ecx
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x100203a0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
lea edi, [ebp - 0x213c]
mov ecx, esi
push edi
call fcn.1001be30
test eax, eax
js 0x1001d673
push 0x1005510e
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1001d548
push 0x1005515c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1001d564
push 0x100551e2
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1001d57b
push 0x100551f0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov ecx, 0x80020009
test eax, eax
jne 0x1001d775
mov bl, 1
mov dword [ebp - 0x28], 0
mov al, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x24], 0
mov al, 1
mov dword [ebp - 0x30], eax
jmp 0x1001d59c
mov bl, 1
mov dword [ebp - 0x28], 0
mov al, 1
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], 0
mov al, 1
mov dword [ebp - 0x24], eax
jmp 0x1001d595
mov al, 1
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x34], 0
jmp 0x1001d58e
mov al, 1
mov dword [ebp - 0x20], eax
xor ebx, ebx
mov dword [ebp - 0x28], 0
mov al, 1
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov eax, dword [esi]
jmp 0x1001d5b1
add ecx, 0xfffffff7
cmp ecx, 1
ja 0x1001d5c5
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov dword [esi], eax
movzx ecx, word [eax]
cmp ecx, 0xd
jb 0x1001d5a0
cmp cx, 0x20
jae 0x1001d5c3
cmp cx, 0xd
je 0x1001d5a8
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
push edi
call fcn.1001be30
test eax, eax
js 0x1001d673
test bl, bl
je 0x1001d608
cmp byte [ebp - 0x24], 0
je 0x1001d67a
mov edi, esi
lea esi, [ebp - 0x213c]
push esi
call fcn.10035098
add esp, 4
add eax, eax
add eax, 2
push eax
push esi
mov esi, edi
push 1
jmp 0x1001d649
cmp byte [ebp - 0x20], 0
je 0x1001d6ff
cmp byte [ebp - 0x34], 0
je 0x1001d75d
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x213c]
push eax
push 0
push 0
push ecx
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
test eax, eax
js 0x1001d673
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x13c]
push 4
push eax
push 4
push 0
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test ebx, ebx
je 0x1001d75d
push ebx
call fcn.1001da10
add esp, 4
mov ecx, eax
jmp 0x1001d775
mov ecx, eax
jmp 0x1001d775
cmp byte [ebp - 0x30], 0
je 0x1001d75d
lea eax, [ebp - 0x213c]
push eax
call fcn.10035098
add esp, 4
mov ebx, eax
mov ecx, 0x80004005
test bl, 1
jne 0x1001d775
mov dword [ebp - 0x2c], esi
mov eax, ebx
shr eax, 0x1f
add eax, ebx
sar eax, 1
mov dword [ebp - 0x13c], 0
cmp eax, 0x101
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], eax
jb 0x1001d85f
mov dword [ebp - 0x10], 4
lea ecx, [ebp - 0x13c]
push eax
call fcn.1001b970
mov ecx, dword [ebp - 0x13c]
test ecx, ecx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
jne 0x1001d86b
mov dword [ebp - 0x20], 0
xor ebx, ebx
jmp 0x1001d90e
cmp byte [ebp - 0x28], 0
je 0x1001d75d
push edi
call fcn.10035098
add esp, 4
add eax, 2
mov dword [ebp - 0x13c], 0
add eax, eax
mov dword [ebp - 0x2c], esi
jb 0x1001d93e
cmp eax, 0x101
jb 0x1001d78d
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0x13c]
push eax
call fcn.1001b970
mov ebx, dword [ebp - 0x13c]
test ebx, ebx
mov esi, dword [ebp - 0x2c]
lea edi, [ebp - 0x213c]
jne 0x1001d799
mov ebx, 0xe
jmp 0x1001d83d
mov dword [ebp - 0x10], 0xffffffff
mov ecx, esi
push dword [ebp + 0x10]
call fcn.1001be30
mov ecx, eax
sar ecx, 0x1f
and ecx, eax
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, ecx
add esp, 0x2130
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
lea ebx, [ebp - 0x138]
mov dword [ebp - 0x13c], ebx
cmp word [ebp - 0x213c], 0
jne 0x1001d80f
mov dword [ebx], 0
mov esi, dword [ebp - 0x13c]
test esi, esi
je 0x1001d835
xor edi, edi
mov ebx, esi
nop dword [eax + eax]
push ebx
call fcn.10035098
add esp, 4
lea ebx, [ebx + eax*2]
add ebx, 2
lea edi, [edi + eax*2]
add edi, 2
test eax, eax
jne 0x1001d7c0
push edi
push esi
push 7
push 0
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
jmp 0x1001d83a
mov word [ebx], cx
add edi, 2
add ebx, 2
cmp word [edi], 0
je 0x1001d7a3
push edi
call dword [sym.imp.USER32.dll_CharNextW]
movzx ecx, word [edi]
cmp cx, 0x5c
jne 0x1001d800
cmp word [eax], 0x30
jne 0x1001d800
mov word [ebx], 0
push eax
call dword [sym.imp.USER32.dll_CharNextW]
mov edi, eax
jmp 0x1001d806
mov ebx, 0xd
mov esi, dword [ebp - 0x2c]
lea eax, [ebp - 0x138]
cmp dword [ebp - 0x13c], eax
je 0x1001d65b
lea ecx, [ebp - 0x13c]
call fcn.1001dae0
jmp 0x1001d65b
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x13c], ecx
push eax
push 0
push ecx
call fcn.10028070
add esp, 0xc
test ebx, ebx
jle 0x1001d8ec
xor eax, eax
xor edx, edx
xor esi, esi
jmp 0x1001d8b8
lea edi, [ecx - 0x30]
add ecx, 0xd0
cmp edi, 0xa
cmovae ecx, eax
mov ebx, ecx
movzx ebx, bl
mov ecx, edx
not cl
and cl, 4
shl ebx, cl
mov ecx, dword [ebp - 0x13c]
mov edi, esi
shr edi, 1
or byte [ecx + edi], bl
add esi, 1
add edx, 4
cmp dword [ebp - 0x20], esi
je 0x1001d8ec
movzx ecx, word [ebp + esi*2 - 0x213c]
cmp ecx, 0x41
jb 0x1001d883
xor ebx, ebx
cmp cx, 0x61
jae 0x1001d8de
cmp cx, 0x47
jae 0x1001d894
movzx ebx, cx
add ebx, 0xc9
jmp 0x1001d894
cmp cx, 0x67
jae 0x1001d894
add ecx, 0xa9
jmp 0x1001d892
mov al, 1
mov dword [ebp - 0x20], eax
push dword [ebp - 0x24]
push dword [ebp - 0x13c]
push 3
push 0
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
lea eax, [ebp - 0x138]
cmp dword [ebp - 0x13c], eax
mov esi, dword [ebp - 0x2c]
je 0x1001d92a
lea ecx, [ebp - 0x13c]
call fcn.1001dae0
cmp byte [ebp - 0x20], 0
mov ecx, 0x80004005
jne 0x1001d65b
jmp 0x1001d775
mov dword [ebp - 0x10], 1
push 0x80070216
call fcn.10017220
add ebp, 0xc
mov ecx, dword [ebp - 0x28]
jmp 0x1001d6e3