Function at 0x1005780d
Capabilities:
Set registry value

Disassembly:
push 0x260
mov eax, 0x100f0fbb
call fcn.10082248
mov dword [ebp - 0x268], ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
xor ebx, ebx
push 0x208
push ebx
push eax
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x258], ebx
mov dword [ebp - 0x25c], ebx
call fcn.100a25c0
add esp, 0xc
mov dword [ebp - 0x238], ebx
xor eax, eax
mov dword [ebp - 0x234], 7
lea ecx, [ebp - 0x248]
mov word [ebp - 0x248], ax
push 0x100fc528
call fcn.10022050
push str.19b26d91_a25d_5339_8040_07c1e23bb3fc
lea ecx, [ebp - 0x248]
mov dword [ebp - 4], ebx
call fcn.1003768b
push 0x100fc57c
lea ecx, [ebp - 0x248]
call fcn.1003768b
cmp dword [ebp - 0x234], 8
lea ecx, [ebp - 0x254]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x248]
cmovae eax, dword [ebp - 0x248]
push ebx
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
push esi
call edi
test eax, eax
jne 0x10057c4d
push ebx
lea eax, [ebp - 0x24c]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x100fc6d0
push dword [ebp - 0x254]
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10057c3c
push ebx
lea eax, [ebp - 0x250]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x100f5958
push dword [ebp - 0x24c]
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x10057b02
xor ecx, ecx
lea eax, [ebp - 0x258]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push str.win32
push dword [ebp - 0x250]
call edi
test eax, eax
jne 0x10057a1c
push dword [ebp - 0x268]
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
call fcn.1003744e
push str.zipShell.dll
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 1
call fcn.1003768b
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x100579bc
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x260]
jne 0x100579d4
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
xor eax, eax
push eax
push 0x100f55e0
push dword [ebp - 0x258]
call ebx
push dword [ebp - 0x258]
call esi
xor eax, eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], al
call fcn.10001ee0
xor ecx, ecx
lea eax, [ebp - 0x25c]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push str.win64
push dword [ebp - 0x250]
call edi
test eax, eax
jne 0x10057af1
push dword [ebp - 0x268]
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
call fcn.1003744e
push str.zipShell64.dll
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.1003768b
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10057a91
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x260]
jne 0x10057aa9
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
xor eax, eax
push eax
push 0x100f55e0
push dword [ebp - 0x25c]
call ebx
push dword [ebp - 0x25c]
call esi
xor eax, eax
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], al
call fcn.10001ee0
cmp dword [ebp - 0x250], 0
je 0x10057b02
push dword [ebp - 0x250]
call esi
xor ecx, ecx
lea eax, [ebp - 0x264]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push str.FLAGS
push dword [ebp - 0x24c]
call edi
test eax, eax
jne 0x10057b71
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x218], 0x30
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x260]
jne 0x10057b39
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
xor eax, eax
push eax
push 0x100f55e0
push dword [ebp - 0x264]
call ebx
push dword [ebp - 0x264]
call esi
xor ecx, ecx
lea eax, [ebp - 0x26c]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push str.HELPDIR
push dword [ebp - 0x24c]
call edi
test eax, eax
jne 0x10057c2b
push dword [ebp - 0x268]
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x21c], eax
call fcn.1003744e
cmp dword [ebp - 0x21c], 8
lea ecx, [ebp - 0x230]
lea edx, [ebp - 0x218]
cmovae ecx, dword [ebp - 0x230]
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x10057bd2
lea ecx, [ebp - 0x218]
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x10057bec
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
xor eax, eax
push eax
push 0x100f55e0
push dword [ebp - 0x26c]
call ebx
push dword [ebp - 0x26c]
call esi
lea ecx, [ebp - 0x230]
call fcn.10001ee0
cmp dword [ebp - 0x24c], 0
je 0x10057c3c
push dword [ebp - 0x24c]
call esi
cmp dword [ebp - 0x254], 0
je 0x10057c4d
push dword [ebp - 0x254]
call esi
lea ecx, [ebp - 0x248]
call fcn.10001ee0
mov al, 1
call fcn.100821f2
ret 4