Function at 0x100596c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 8], 0
push ebx
push esi
mov esi, dword [sym.imp.msvcrt.dll_malloc]
push edi
mov ebx, ecx
mov edi, 0x1000
push edi
mov dword [ebp - 0x1c], ebx
call esi
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
jne 0x100599e
mov esi, 0x8007000e
jmp 0x1005b77
push eax
mov ecx, ebx
call fcn.01004d5c
test eax, eax
jge 0x10059b1
mov esi, eax
jmp 0x1005b6d
lea eax, [ebp - 2]
push eax
push dword [ebp - 0x10]
call fcn.01004c14
test eax, eax
jne 0x10059cb
mov esi, 0x80020009
jmp 0x1005b6d
push edi
call esi
mov edi, eax
test edi, edi
pop ecx
mov dword [ebp - 0xc], edi
jne 0x10059e2
mov esi, 0x8007000e
jmp 0x1005b6d
mov ecx, ebx
call fcn.01004d3a
push edi
mov ecx, ebx
call fcn.01004d5c
test eax, eax
jge 0x10059fc
mov esi, eax
jmp 0x1005b65
movzx eax, word [ebp - 2]
sub eax, 8
je 0x1005b44
sub eax, 9
je 0x1005a88
dec eax
dec eax
jne 0x1005b50
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea ebx, [esi + esi]
cmp ebx, 0x400
ja 0x1005a46
push ebx
call fcn.010047c8
test al, al
je 0x1005a46
mov eax, ebx
add eax, 3
and eax, 0xfffffffc
call fcn.01007230
mov eax, esp
jmp 0x1005a4f
push ebx
lea ecx, [ebp - 8]
call fcn.010055e7
xor ebx, ebx
push ebx
push esi
push edi
push eax
call fcn.01004821
cmp eax, ebx
jne 0x1005a68
mov esi, 0x8007000e
jmp 0x1005b65
lea ecx, [ebp - 0x14]
push ecx
push ebx
push ebx
push eax
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push dword [ebp - 0x14]
call fcn.010049f8
jmp 0x1005b50
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test al, 1
mov dword [ebp - 4], eax
je 0x1005aa0
mov esi, 0x80004005
jmp 0x1005b65
cdq
sub eax, edx
mov esi, eax
sar esi, 1
cmp esi, 0x400
mov dword [ebp - 0x18], esi
ja 0x1005acd
push esi
call fcn.010047c8
test al, al
je 0x1005acd
mov eax, esi
add eax, 3
and eax, 0xfffffffc
call fcn.01007230
mov ebx, esp
jmp 0x1005ad8
push esi
lea ecx, [ebp - 8]
call fcn.010055e7
mov ebx, eax
test ebx, ebx
je 0x1005a96
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
xor edi, edi
cmp dword [ebp - 4], edi
jle 0x1005b2a
mov eax, edi
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ebx]
mov eax, dword [ebp - 0xc]
movsx eax, byte [edi + eax]
push eax
call fcn.01004c95
mov ecx, edi
and ecx, 1
shl ecx, 2
mov edx, ecx
push 4
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc edi
cmp edi, dword [ebp - 4]
jl 0x1005af7
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push esi
push ebx
push 3
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [ebp - 0xc]
jmp 0x1005b50
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push edi
call fcn.01004a12
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x1c]
call fcn.01004d5c
test eax, eax
jl 0x10059f5
xor esi, esi
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
lea ecx, [ebp - 8]
call fcn.0100535e
mov eax, esi
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
leave
ret 0xc