Function at 0x10031c5d
Capabilities:
Set registry value

Disassembly:
mov eax, 0x10061199
call fcn.1005fb28
sub esp, 0xe4
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x60], edx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x58], ecx
cmp byte [ebp + 0x30], bl
je 0x10032185
xor eax, eax
cmp byte [ebp + 0x20], al
je 0x10031d60
mov edi, dword [ebp + 0x14]
inc eax
mov dword [edi], ebx
cmp dword [edi], eax
jg 0x10032335
push 3
mov ecx, 0xcefbde28
pop esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 0x819570a5
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0x733e34b6
mov dword [ebp - 0x1c], 0xb8ae505b
mov dword [ebp - 0x1c], 0xd3ecf04
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x90], ecx
mov dword [ebp - 0x8c], ecx
lea ecx, [ebp - 0x48]
push esi
call fcn.100138f8
push 1
push 0x531
push 1
lea eax, [ebp - 0x88]
mov dword [ebp - 4], ebx
push eax
push 0x6b4d
xor dl, dl
lea ecx, [ebp - 0x48]
call fcn.10031a08
mov ecx, dword [ebp + 0x10]
mov dl, 1
push 1
push 0x7767
push 0x5e55
call fcn.100315e3
or dword [ebp - 4], 0xffffffff
add esp, 0x20
cmp dword [ebp - 0x48], 0
je 0x10031d49
push dword [ebp - 0x48]
call fcn.10047697
pop ecx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x40], ebx
inc dword [edi]
xor eax, eax
inc eax
mov ecx, 0xcefbde28
cmp dword [edi], eax
jle 0x10031ca5
jmp 0x10032335
mov dword [ebp - 0x70], 7
mov dword [ebp - 0x74], ebx
mov word [ebp - 0x84], ax
mov dword [ebp - 4], 1
push 2
pop ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0x67b8
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0x9d88
push 3
mov dword [ebp - 0x24], 0xe213
mov dword [ebp - 0x14], ebx
pop esi
jmp 0x10031db6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa4], 0xdb50
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10031da5
mov dword [ebp - 0x14], ebx
jmp 0x10031dd1
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc0], 0x8bac04ee
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10031dc0
mov dword [ebp - 0x14], ebx
jmp 0x10031dec
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xb0], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10031ddb
mov eax, dword [ebp - 0xa0]
xor edx, edx
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
inc dword [ebp - 0x20]
cmp eax, edx
jne 0x10031e1f
xor eax, eax
inc eax
jmp 0x10031e21
mov eax, ebx
push ecx
mov dword [ebp - 0x24], eax
mov edx, 0x6a5c
push 0x4e07
lea eax, [ebp + 0x28]
push eax
push ecx
push ebx
lea ecx, [ebp - 0x84]
call fcn.100311c7
mov eax, dword [0x1418b37c]
add esp, 0x14
test al, 1
jne 0x10031e6d
or eax, 1
mov dword [0x1418b37c], eax
push 0xedba
mov byte [ebp - 4], 2
call fcn.100289b7
pop ecx
mov word [0x1418b364], ax
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0x548
cmp dword [ebp - 0x18], 0x92e
jle 0x10031ecc
mov edi, ebx
mov esi, ebx
lea eax, [esi + edi]
cdq
lea ecx, [ebp - 0xd8]
push edx
push eax
call fcn.10001ade
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10031e9c
mov eax, dword [eax]
push eax
call fcn.1004752f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xd8]
call fcn.10013e9b
inc esi
cmp esi, 0xb63
jl 0x10031e81
inc edi
cmp edi, 0x22e7
jl 0x10031e7f
call dword [sym.imp.USER32.dll_WaitMessage]
push 3
pop esi
cmp dword [ebp - 0x18], 0x435
jge 0x10031ee0
push str.gvrkgd_jjlvx_octdwvibj_jemv_pcrlbu_kmps_bmqkxdg_gnhwqu_zkxer
call fcn.1004752f
pop ecx
xor ecx, ecx
inc ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x2c], 0x8c45cdbe
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x64], 0xffffffff
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x18], ebx
jmp 0x10031f10
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb8], 0xe46552de
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10031eff
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ecx
push eax
push ebx
lea eax, [ebp - 0x6c]
mov edx, 0x299c
push eax
push 0x17d5
push 0xa2
push ecx
lea eax, [ebp - 0x64]
push 0x2849
push eax
lea ecx, [ebp - 0x5c]
call fcn.10031b93
mov eax, dword [0x1418b37c]
add esp, 0x20
test al, 2
jne 0x10031f70
or eax, 2
mov dword [0x1418b37c], eax
push 0x7f96
mov byte [ebp - 4], 5
call fcn.100289b7
pop ecx
mov word [0x1418c708], ax
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x10032132
mov eax, 0xac70
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x10031fa9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x54], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10031f9b
mov dword [ebp - 0x54], 0xffffffe4
jmp 0x100320db
mov dword [ebp - 0x14], 0xb1658084
mov dword [ebp - 0x24], 0xd089
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x100320cf
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x3c], ebx
je 0x10032016
cmp dword [ebp - 0x24], ebx
je 0x10032013
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x2d5f
setg al
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jne 0x10032013
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x3c]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x3c], 1
ja 0x10032033
cmp dword [ebp - 0x3c], ebx
jne 0x10032033
mov edi, ebx
jmp 0x10032036
xor edi, edi
inc edi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x3c]
mov eax, dword [ebp - 0x14]
cmp edi, eax
sete cl
xor eax, eax
cmp ecx, edx
setne al
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x10032095
mov dword [ebp - 0x24], ebx
jmp 0x1003208e
mov dword [ebp - 0x18], ebx
jmp 0x10032086
lea eax, [ebp - 0x28]
push eax
push ecx
mov cl, 1
call fcn.10030304
pop ecx
pop ecx
mov dword [ebp - 0x20], ebx
jmp 0x1003207d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x3c], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10032073
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10032060
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1003205b
jmp 0x100320cc
push 1
push 1
lea eax, [ebp + 0x33]
mov byte [ebp + 0x33], bl
push eax
push 0x4c19
push 0x6c18
mov edx, 0x5ec6
xor cl, cl
call fcn.10030d0a
push 1
push 0x6345
xor dl, dl
mov ecx, 0x434b
call fcn.1003035c
add esp, 0x1c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10031fd7
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], 1
jl 0x10031fba
call fcn.100302d7
push 0x34
pop ecx
xor edx, edx
div ecx
push 0x3beb
push 1
push 1
push 0x3fee
push ebx
push 0x5f7b
lea eax, [ebp - 0x84]
mov dword [ebp - 0x68], edx
push 0x1418c708
push eax
mov edx, 0x1418b364
lea ecx, [ebp - 0x68]
call fcn.100304ee
add esp, 0x20
mov eax, 0xac70
dec dword [ebp - 0x1c]
jne 0x10031f83
push 0x2db1
push 0x14ab
push 0x689b
push 1
push ebx
push 0x6814
push ebx
mov edx, 0x6af7
mov ecx, 0x5171
call fcn.10031245
mov ecx, dword [ebp + 0x1c]
lea eax, [ebp - 0x84]
add esp, 0x1c
cmp ecx, eax
je 0x10032172
push 0xffffffffffffffff
push ebx
push eax
call fcn.10013edf
push ebx
push 1
lea ecx, [ebp - 0x84]
call fcn.1001400f
jmp 0x10032335
mov dword [ebp - 0x1c], 0x751b
cmp dword [ebp - 0x1c], 0x7626
jle 0x100321e7
push ebx
push 0x2b1
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0xf0]
push edx
push eax
call fcn.10001ade
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100321c0
mov eax, dword [eax]
push eax
call fcn.1004752f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xf0]
call fcn.10013e9b
inc edi
cmp edi, 0x1b86
jl 0x100321a5
inc esi
cmp esi, 0x10d0
jl 0x100321a3
cmp dword [ebp - 0x1c], 0x7220
jge 0x100321fb
push str.ndrmezh_qlgyjwsw_effajgws_mudtdpoxj_oeojolk_bteou_xhfvpy_vhh_vilydm_xdj_ixmmob_lumkcyxri_jgklqeva_uhlqechn
call fcn.1004752f
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x34], 0
je 0x1003224b
mov edi, dword [ebp + 0x2c]
cmp dword [edi], ebx
jbe 0x10032335
push 0x1a
pop esi
call fcn.100302d7
push 0x34
xor edx, edx
pop ecx
div ecx
mov eax, edx
cmp eax, esi
jge 0x1003222d
mov ecx, dword [ebp + 0xc]
movsx edx, byte [ecx]
jmp 0x10032236
cdq
idiv esi
mov eax, dword [ebp + 0x24]
movsx eax, byte [eax]
mov ecx, dword [ebp + 0x18]
add edx, eax
push edx
call fcn.10028aa5
inc ebx
cmp ebx, dword [edi]
jb 0x10032213
jmp 0x10032335
mov dword [ebp - 0x18], 0x5a8d
cmp dword [ebp - 0x18], 0x5adf
jle 0x100322ce
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov edi, ebx
mov dword [ebp - 0x2c], ebx
mov eax, esi
mov dword [ebp + 0x30], ebx
cdq
idiv edi
mov ecx, edx
mov dword [ebp - 0x1c], ecx
mov esi, ebx
mov edi, 0x2cb5
mov ebx, dword [ebp + 0x30]
mov eax, esi
or eax, ecx
mov ecx, 0x1007d058
cdq
push edx
push eax
call fcn.100136b0
mov ecx, dword [ebp - 0x1c]
add esi, ebx
dec edi
jne 0x1003227c
inc ebx
push 0
mov dword [ebp + 0x30], ebx
cmp ebx, 0x29a
pop ebx
jl 0x10032272
mov edi, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x28]
inc edi
mov dword [ebp - 0x2c], edi
cmp edi, 0x64e2
jl 0x10032265
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x53d3
jl 0x10032260
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], 8
cmp dword [ebp - 0x18], 0x5858
jge 0x100322ed
mov edx, str.fgoufefll_mkio_nidywnm_gfyyhyh_woa_ijjmhrk_blefyxtf_qdwr
mov ecx, 0x1007d058
call fcn.100160b3
mov eax, dword [ebp - 0x60]
or dword [ebp - 4], 0xffffffff
push 0x1a
pop esi
cmp dword [eax], esi
jge 0x1003231f
mov ecx, dword [ebp - 0x58]
movzx edx, word [ecx]
add edx, dword [eax]
jmp 0x1003232c
mov eax, dword [eax]
cdq
idiv esi
mov eax, dword [ebp + 8]
movzx eax, word [eax]
add edx, eax
mov ecx, dword [ebp + 0x38]
push edx
call fcn.10028a2a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret