Function at 0x10016060
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088370
mov eax, dword fs:[0]
push eax
sub esp, 0x394
mov eax, dword [0x100cb018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea edx, [ebp - 0x3a]
call fcn.10015cb0
test eax, eax
jne 0x100160a0
xor ecx, ecx
jmp 0x100161f0
mov eax, dword [0x100b7958]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x40], eax
mov ax, word [0x100b795c]
mov word [ebp - 0x3c], ax
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x39c]
push eax
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [ebp - 0x40]
push eax
push SysReAllocString
call edi
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 0x394], ecx
test eax, eax
jne 0x100161f0
push 7
push str.Weasel
push 1
push eax
push eax
push dword [ebp - 0x39c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb esi, esi
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x398]
inc esi
and esi, dword [ebp - 0x394]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.InprocServer32
push dword [ebp - 0x39c]
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
test eax, eax
cmove ecx, esi
mov dword [ebp - 0x394], ecx
test ecx, ecx
je 0x100161e2
push 0x104
lea eax, [ebp - 0x188]
push eax
push dword [0x100d0598]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x3a0], eax
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10016180
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x188]
push eax
push 1
push 0
push 0
push dword [ebp - 0x398]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0xa
push str.Apartment
push 1
neg eax
push 0
sbb esi, esi
push str.ThreadingModel
push dword [ebp - 0x398]
inc esi
and esi, dword [ebp - 0x394]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x398]
xor ecx, ecx
test eax, eax
cmove ecx, esi
mov dword [ebp - 0x394], ecx
call edi
push dword [ebp - 0x39c]
call edi
mov ecx, dword [ebp - 0x394]
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
test ecx, ecx
je 0x1001635a
push 0x104
lea eax, [ebp - 0x390]
push eax
push dword [0x100d0598]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, eax
mov dword [ebp - 0x394], 0
lea eax, [ebp - 0x394]
push eax
push 0x100baa0c
push 0x17
push 0
push 0x1008d5c0
call esi
test eax, eax
jns 0x10016249
mov dword [ebp - 4], 0
jmp 0x100162d4
mov eax, dword [ebp - 0x394]
lea edx, [ebp - 0x390]
push 0
push 1
push 0
mov ecx, dword [eax]
push 0
push 0
push edi
push edx
push 3
push 0x100ba9f0
push 0x100b7948
push 0x404
push 0x100b7938
push eax
call dword [ecx + 0x20]
test eax, eax
jns 0x1001628a
mov dword [ebp - 4], 1
jmp 0x100162d4
mov dword [ebp - 4], 2
mov eax, dword [ebp - 0x394]
test eax, eax
je 0x100162a1
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x394]
mov dword [ebp - 4], 0xffffffff
push eax
push 0x1008d540
push 1
push 0
push 0x1008d5b0
mov dword [ebp - 0x394], 0
call esi
test eax, eax
je 0x100162ed
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x394]
test eax, eax
je 0x100162e4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
jmp 0x1001635a
mov edi, 1
mov esi, 0x100d05c0
nop word [eax + eax]
mov eax, dword [ebp - 0x394]
push 0x100b7938
push esi
push 0x100b7938
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
xor ecx, ecx
test eax, eax
cmove ecx, edi
add esi, 0x10
mov edi, ecx
cmp esi, 0x100d06c0
jne 0x10016300
mov dword [ebp - 4], 4
mov eax, dword [ebp - 0x394]
test eax, eax
je 0x10016342
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x10016354
xor eax, eax
jmp 0x100164b1
mov esi, dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [ebp - 0x394]
mov dword [ebp - 0x394], 0
push eax
push 0x100baa0c
push 0x17
push 0
push 0x1008d5c0
call esi
test eax, eax
jns 0x10016388
mov dword [ebp - 4], 5
jmp 0x100163ac
mov eax, dword [ebp - 0x394]
push 0
push 0x100b7948
push 0x404
mov ecx, dword [eax]
push 0x100b7938
push eax
call dword [ecx + 0x24]
mov dword [ebp - 4], 6
mov eax, dword [ebp - 0x394]
test eax, eax
je 0x100163bc
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x394]
mov dword [ebp - 4], 0xffffffff
push eax
push 0x1008d540
push 1
push 0
push 0x1008d5b0
mov dword [ebp - 0x394], 0
call esi
test eax, eax
jns 0x100163f1
mov dword [ebp - 4], 7
jmp 0x10016429
mov esi, 0x100d05c0
nop word [eax + eax]
mov eax, dword [ebp - 0x394]
push 0x100b7938
push esi
push 0x100b7938
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
add esi, 0x10
cmp esi, 0x100d06c0
jne 0x10016400
mov dword [ebp - 4], 8
mov eax, dword [ebp - 0x394]
test eax, eax
je 0x10016439
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edx, [ebp - 0x3a]
mov dword [ebp - 4], 0xffffffff
call fcn.10015cb0
test eax, eax
je 0x100164ac
mov eax, dword [0x100b7958]
lea edx, [ebp - 0x40]
mov dword [ebp - 0x40], eax
mov ecx, SysReAllocString
mov ax, word [0x100b795c]
mov word [ebp - 0x3c], ax
call fcn.10015d10
lea edx, [ebp - 0x6a]
call fcn.10015cb0
test eax, eax
je 0x100164ac
movups xmm0, xmmword [str.SoftwareMicrosftCTFTIP_]
mov ax, word [0x100b7988]
lea edx, [ebp - 0x84]
mov ecx, SysReAllocString
mov word [ebp - 0x6c], ax
movups xmmword [ebp - 0x84], xmm0
movq xmm0, qword [0x100b7980]
movq qword [ebp - 0x74], xmm0
call fcn.10015d10
mov eax, 0x80004005
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10059b70
mov esp, ebp
pop ebp
ret