Function at 0x10009dce
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x112c
call fcn.1001df00
mov eax, dword [0x1002f060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x1118], 0
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ebx, edx
mov dword [ebp - 0x1128], eax
lea eax, [ebp - 0x1008]
mov dword [ebp - 0x1124], esi
mov dword [ebp - 0x1120], ebx
mov dword [ebp - 0x111c], edi
call fcn.1000a590
test eax, eax
js 0x1000a211
lea eax, [ebp - 0x1118]
push eax
lea eax, [ebp - 0x1008]
push eax
call fcn.10009c17
pop ecx
pop ecx
test eax, eax
jne 0x10009e47
mov eax, 0x80020009
jmp 0x1000a211
call fcn.1000abe3
lea eax, [ebp - 0x1008]
mov ecx, esi
call fcn.1000a590
test eax, eax
js 0x1000a211
movzx eax, word [ebp - 0x1118]
sub eax, 8
je 0x1000a1c8
sub eax, 9
je 0x1000a093
dec eax
dec eax
je 0x10009fab
sub eax, 0x3ff5
jne 0x1000a1fa
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
and dword [ebp - 0x1110], 0
add eax, 2
xor ecx, ecx
ja 0x10009ead
cmp eax, 0xffffffff
jbe 0x10009eb7
push 0x80070216
call fcn.10002d8c
cmp eax, 0x100
jbe 0x10009ecd
push eax
lea eax, [ebp - 0x1110]
push eax
call fcn.10009cb6
jmp 0x10009ed9
lea eax, [ebp - 0x110c]
mov dword [ebp - 0x1110], eax
mov edi, dword [ebp - 0x1110]
test edi, edi
je 0x10009f86
cmp byte [ebp - 0x1008], 0
lea esi, [ebp - 0x1008]
je 0x10009f3d
mov ebx, dword [sym.imp.USER32.dll_CharNextA]
push esi
call ebx
mov cl, byte [esi]
cmp cl, 0x5c
jne 0x10009f16
cmp byte [eax], 0x30
jne 0x10009f16
mov byte [edi], 0
push eax
inc edi
call ebx
mov esi, eax
jmp 0x10009f32
mov byte [edi], cl
movzx eax, byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x10009f30
inc edi
inc esi
mov al, byte [esi]
test al, al
je 0x10009f37
mov byte [edi], al
inc edi
inc esi
cmp byte [esi], 0
jne 0x10009efc
mov ebx, dword [ebp - 0x1120]
mov word [edi], 0
mov edi, dword [ebp - 0x1110]
mov dword [ebp - 0x1114], edi
test edi, edi
jne 0x10009f56
push 0xd
jmp 0x10009f88
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add edi, eax
add esi, eax
cmp eax, 1
jne 0x10009f58
push esi
push dword [ebp - 0x1114]
push 7
push 0
push dword [ebp - 0x111c]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
jmp 0x10009f89
push 0xe
pop esi
lea eax, [ebp - 0x110c]
cmp dword [ebp - 0x1110], eax
je 0x1000a1ed
lea eax, [ebp - 0x1110]
call fcn.10009cad
jmp 0x1000a1ed
lea eax, [ebp - 0x1008]
xor edi, edi
push eax
mov dword [ebp - 0x1114], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp - 0x1118]
inc eax
push ecx
mov dword [ebp - 0x1118], eax
call fcn.10009cd9
pop ecx
test eax, eax
js 0x1000a077
mov ebx, dword [ebp - 0x1118]
cmp ebx, 0x400
jg 0x1000a000
push ebx
call fcn.10009d09
pop ecx
test al, al
je 0x1000a000
mov eax, ebx
call fcn.1001d9d0
mov eax, esp
jmp 0x1000a013
mov eax, ebx
lea esi, [ebp - 0x1114]
call fcn.10009d75
mov edi, dword [ebp - 0x1114]
push 3
shr ebx, 1
push ebx
lea ecx, [ebp - 0x1008]
push ecx
mov esi, eax
call fcn.10004be3
test eax, eax
je 0x1000a073
lea ecx, [ebp - 0x1114]
push ecx
push eax
call fcn.1001421f
mov eax, dword [ebp - 0x1114]
pop ecx
pop ecx
push 4
mov dword [ebp - 0x1114], eax
lea eax, [ebp - 0x1114]
push eax
mov eax, dword [ebp - 0x1120]
push 4
push 0
push dword [ebp - 0x111c]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
jmp 0x1000a08a
push edi
mov edi, dword [edi]
call fcn.1001a512
pop ecx
test edi, edi
jne 0x1000a06a
mov eax, 0x8007000e
jmp 0x1000a211
push edi
mov edi, dword [edi]
call fcn.1001a512
pop ecx
test edi, edi
jne 0x1000a081
jmp 0x1000a1ed
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x1114], eax
test al, 1
je 0x1000a0b4
mov eax, 0x80004005
jmp 0x1000a211
cdq
sub eax, edx
mov edi, eax
xor esi, esi
xor eax, eax
sar edi, 1
mov dword [ebp - 0x1110], esi
cmp eax, esi
ja 0x10009ead
cmp edi, 0xffffffff
ja 0x10009ead
cmp edi, 0x100
jbe 0x1000a0ed
push edi
lea eax, [ebp - 0x1110]
push eax
call fcn.10009dab
jmp 0x1000a0f9
lea eax, [ebp - 0x110c]
mov dword [ebp - 0x1110], eax
cmp dword [ebp - 0x1110], esi
jne 0x1000a118
lea eax, [ebp - 0x110c]
test eax, eax
je 0x1000a0aa
lea eax, [ebp - 0x1110]
call fcn.10009da2
jmp 0x1000a0aa
push edi
push esi
push dword [ebp - 0x1110]
call fcn.1001a2a0
add esp, 0xc
cmp dword [ebp - 0x1114], esi
jle 0x1000a191
mov cl, byte [ebp + esi - 0x1008]
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x1110]
cmp cl, 0x30
jl 0x1000a16f
cmp cl, 0x39
jle 0x1000a16a
cmp cl, 0x40
jle 0x1000a16f
cmp cl, 0x46
jle 0x1000a165
lea edx, [ecx - 0x61]
cmp dl, 5
ja 0x1000a16f
lea edx, [ecx - 0x57]
jmp 0x1000a171
lea edx, [ecx - 0x37]
jmp 0x1000a171
lea edx, [ecx - 0x30]
jmp 0x1000a171
xor dl, dl
mov ebx, esi
and ebx, 1
shl ebx, 2
push 4
pop ecx
sub ecx, ebx
shl dl, cl
or byte [eax], dl
inc esi
cmp esi, dword [ebp - 0x1114]
jl 0x1000a130
mov ebx, dword [ebp - 0x1120]
mov eax, dword [ebx]
push edi
push dword [ebp - 0x1110]
push 3
push 0
push dword [ebp - 0x111c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
lea eax, [ebp - 0x110c]
cmp dword [ebp - 0x1110], eax
je 0x1000a1ed
lea eax, [ebp - 0x1110]
call fcn.10009da2
jmp 0x1000a1ed
lea eax, [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x1008]
push eax
push 1
push 0
push edi
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x1000a1fa
mov eax, esi
call fcn.1000a581
jmp 0x1000a211
mov eax, dword [ebp - 0x1128]
mov ecx, dword [ebp - 0x1124]
call fcn.1000a590
test eax, eax
js 0x1000a211
xor eax, eax
lea esp, [ebp - 0x1138]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10017a76
leave
ret 8