Function at 0x10006030
Capabilities:
Resolve function by parsing pe exports
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x1007a39c
mov eax, dword fs:[0]
push eax
sub esp, 0x1d8
mov eax, dword [0x1008e418]
xor eax, esp
mov dword [esp + 0x1d0], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1008e418]
xor eax, esp
push eax
lea eax, [esp + 0x1ec]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x1fc]
lea eax, [esp + 0xb8]
mov dword [esp + 0x6c], eax
lea eax, [ebp + 0x10]
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x40], eax
jmp 0x10006090
xor ebx, ebx
mov dword [esp + 0xb4], 0xf
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
push 4
mov dword [esp + 0x1f8], ebx
call fcn.10056628
add esp, 4
cmp eax, ebx
je 0x100060cb
lea ecx, [esp + 0xb8]
mov dword [eax], ecx
jmp 0x100060cd
xor eax, eax
mov dword [esp + 0xb8], eax
mov byte [esp + 0x1f4], 1
call fcn.10008f90
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd0], ebx
lea esi, [ebp + 0x10]
push esi
mov dword [esp + 0x1f8], 2
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [esp + 0x1f4], 3
cmp dword [ebp + 0x68], ebx
je 0x10006a2a
mov eax, dword [ebp + 0x64]
mov edi, dword [eax]
mov eax, dword [ebp + 0x50]
lea esi, [ebp + 0x50]
cmp eax, ebx
jne 0x10006296
call fcn.10055ff2
xor eax, eax
cmp edi, dword [eax + 0x14]
jne 0x10006139
call fcn.10055ff2
push 0xffffffffffffffff
push ebx
add edi, 8
push edi
lea ecx, [esp + 0xa8]
call fcn.10008960
lea eax, [edi + 0x1c]
lea edx, [esp + 0xb8]
cmp edx, eax
je 0x10006199
mov edi, dword [eax + 0x14]
mov ebp, dword [eax]
mov eax, dword [edi]
mov ebx, edx
mov dword [esp + 0x68], eax
call fcn.1000ab20
mov edx, dword [esp + 0x68]
mov ecx, dword [esp + 0xcc]
mov eax, dword [ecx]
mov ecx, dword [esp + 0xb8]
push edi
push ebp
push edx
push ebp
push eax
mov eax, dword [esp + 0x54]
push ecx
push eax
mov ecx, ebx
push ecx
call fcn.1000dd30
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
mov eax, dword [esi + 0x14]
mov eax, dword [eax]
mov ecx, dword [esi]
push eax
push ecx
lea edx, [esp + 0x78]
push edx
push esi
call fcn.10009ad0
lea eax, [ebp + 0x10]
push eax
mov byte [esp + 0x1f8], 2
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push ebx
push 0x1007de80
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], ebx
mov byte [esp + 0x20], 0
call fcn.1000a340
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xa0]
push 2
push ecx
mov byte [esp + 0x200], 4
call fcn.100032c0
add esp, 0xc
mov byte [esp + 0x1f4], 2
cmp dword [esp + 0x2c], 0x10
jb 0x1000621a
mov edx, dword [esp + 0x18]
push edx
call fcn.10056169
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add esi, eax
push esi
call fcn.1005610b
mov eax, dword [esp + 0xd0]
mov eax, dword [eax]
mov edi, dword [esp + 0xbc]
add esp, 4
mov dword [esp + 0x30], edi
mov ebx, eax
mov esi, dword [esp + 0xcc]
mov dword [esp + 0x34], ebx
test edi, edi
je 0x10006261
cmp edi, dword [esp + 0xb8]
je 0x10006266
call fcn.10055ff2
cmp ebx, esi
je 0x10006963
lea ecx, [esp + 0x44]
push ecx
call fcn.1000f5c0
push 4
mov byte [esp + 0x1f8], 5
call fcn.10056628
add esp, 4
test eax, eax
je 0x1000629d
lea edx, [esp + 0x14]
mov dword [eax], edx
jmp 0x1000629f
mov eax, dword [eax]
jmp 0x1000612f
xor eax, eax
mov dword [esp + 0x14], eax
mov byte [esp + 0x1f4], 6
call fcn.1000a2a0
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], 0
lea eax, [esp + 0x44]
push eax
mov byte [esp + 0x1f8], 7
call fcn.10004140
lea ecx, [esp + 0x14]
call fcn.10038e30
lea eax, [esp + 0xd4]
call fcn.10003700
mov ebp, 8
mov byte [esp + 0x1f4], 8
test edi, edi
jne 0x10006312
call fcn.10055ff2
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x10006305
call fcn.10055ff2
cmp dword [ebx + 0x20], ebp
lea edi, [ebx + 8]
jb 0x10006316
mov eax, dword [edi + 4]
jmp 0x10006319
mov eax, dword [edi]
jmp 0x100062fb
lea eax, [edi + 4]
lea ecx, [esp + 0xd4]
push ecx
push eax
call fcn.10039a80
add esp, 8
test eax, eax
jne 0x10006407
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x10006355
call fcn.10055ff2
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x1000634b
call fcn.10055ff2
cmp dword [edi + 0x18], ebp
jb 0x10006359
mov eax, dword [edi + 4]
jmp 0x1000635c
mov eax, dword [eax]
jmp 0x10006341
lea eax, [edi + 4]
push eax
push str.not_find_patch_info:_ls
call fcn.100478a8
add esp, 8
lea edx, [esp + 0xd4]
push edx
push 1
call fcn.10005b60
lea esi, [esp + 0xd4]
call fcn.10005830
mov eax, dword [esp + 0x28]
mov edi, dword [eax]
mov dword [eax], eax
mov eax, dword [esp + 0x28]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], 0
cmp edi, eax
je 0x100063c1
mov ebp, dword [edi]
lea esi, [edi + 8]
call fcn.10005830
push edi
call fcn.10056169
mov eax, dword [esp + 0x2c]
add esp, 4
mov edi, ebp
cmp ebp, eax
jne 0x100063a4
push eax
call fcn.10056169
mov eax, dword [esp + 0x18]
add esp, 4
push eax
mov dword [esp + 0x2c], 0
call fcn.10056169
add esp, 4
lea esi, [esp + 0x44]
mov byte [esp + 0x1f4], 9
call fcn.10009240
mov byte [esp + 0x1f4], 2
mov ecx, dword [esp + 0x44]
push ecx
call fcn.10056169
jmp 0x10006934
call fcn.10034a90
test al, al
je 0x10006453
push str.win10_install_first_patch_only___
call fcn.10052058
add esp, 4
cmp dword [esp + 0x2c], 1
jbe 0x10006453
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x28]
mov esi, dword [edx]
test eax, eax
jne 0x10006682
call fcn.10055ff2
xor eax, eax
cmp esi, dword [eax + 0x14]
jne 0x10006447
call fcn.10055ff2
lea edx, [esi + 8]
lea ecx, [esp + 0x14]
call fcn.1000a200
mov eax, dword [esp + 0x30]
test eax, eax
jne 0x10006689
call fcn.10055ff2
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x10006470
call fcn.10055ff2
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x88], ax
push eax
mov eax, edi
lea ecx, [esp + 0x88]
mov dword [esp + 0xa0], 7
mov dword [esp + 0x9c], 0
call fcn.10008c70
mov byte [esp + 0x1f4], 0xa
mov edx, dword [esp + 0x98]
mov edi, dword [esp + 0x84]
cmp edx, ebp
jb 0x10006690
mov ebx, edi
mov dword [esp + 0x38], ebx
test edi, edi
je 0x100064f7
mov eax, edi
cmp edx, 8
jae 0x100064d7
lea eax, [esp + 0x84]
cmp eax, ebx
ja 0x100064f7
mov eax, edi
cmp edx, 8
jae 0x100064e9
lea eax, [esp + 0x84]
mov ecx, dword [esp + 0x94]
lea eax, [eax + ecx*2]
cmp ebx, eax
jbe 0x10006511
call fcn.10055ff2
mov edx, dword [esp + 0x98]
mov ecx, dword [esp + 0x94]
mov edi, dword [esp + 0x84]
mov eax, edi
cmp edx, 8
jae 0x1000651f
lea eax, [esp + 0x84]
lea ebp, [eax + ecx*2]
test ebp, ebp
je 0x1000654d
mov eax, edi
cmp edx, 8
jae 0x10006534
lea eax, [esp + 0x84]
cmp eax, ebp
ja 0x1000654d
mov eax, edi
cmp edx, 8
jae 0x10006546
lea eax, [esp + 0x84]
lea eax, [eax + ecx*2]
cmp ebp, eax
jbe 0x10006567
call fcn.10055ff2
mov edx, dword [esp + 0x98]
mov ecx, dword [esp + 0x94]
mov edi, dword [esp + 0x84]
cmp edx, 8
jb 0x100066a0
mov esi, edi
test edi, edi
je 0x1000659d
mov eax, edi
cmp edx, 8
jae 0x10006584
lea eax, [esp + 0x84]
cmp eax, esi
ja 0x1000659d
mov eax, edi
cmp edx, 8
jae 0x10006596
lea eax, [esp + 0x84]
lea ecx, [eax + ecx*2]
cmp esi, ecx
jbe 0x100065b0
call fcn.10055ff2
mov edx, dword [esp + 0x98]
mov edi, dword [esp + 0x84]
mov eax, ebp
sub eax, esi
lea ecx, [esp + 0x80]
sar eax, 1
cmp ecx, 0xfffffffc
je 0x100065fc
mov ecx, edi
cmp edx, 8
jae 0x100065d0
lea ecx, [esp + 0x84]
lea eax, [ebx + eax*2]
mov ebx, dword [esp + 0x94]
lea ecx, [ecx + ebx*2]
cmp eax, ecx
ja 0x100065f3
mov ecx, edi
cmp edx, 8
jae 0x100065ef
lea ecx, [esp + 0x84]
cmp eax, ecx
jae 0x100065f8
call fcn.10055ff2
mov ebx, dword [esp + 0x38]
cmp esi, ebp
je 0x1000661b
mov edi, ebx
sub edi, esi
movzx edx, word [esi]
push edx
call fcn.10055e24
mov word [esi + edi], ax
add esi, 2
add esp, 4
cmp esi, ebp
jne 0x10006604
mov ebp, dword [esp + 0x5c]
mov edi, dword [esp + 0x44]
lea eax, [esp + 0x80]
push eax
lea ecx, [esp + 0x7c]
push ecx
lea esi, [esp + 0x4c]
call fcn.10007380
xor ebx, ebx
mov esi, eax
cmp edi, ebx
je 0x10006645
cmp edi, dword [esi]
je 0x1000664a
call fcn.10055ff2
cmp ebp, dword [esi + 4]
jne 0x10006774
mov eax, dword [esp + 0x30]
cmp eax, ebx
jne 0x100066ac
call fcn.10055ff2
xor eax, eax
mov esi, dword [esp + 0x34]
cmp esi, dword [eax + 0x14]
jne 0x10006670
call fcn.10055ff2
lea eax, [esi + 8]
mov esi, 8
cmp dword [eax + 0x18], esi
jb 0x100066b0
mov eax, dword [eax + 4]
jmp 0x100066b3
mov eax, dword [eax]
jmp 0x1000643d
mov eax, dword [eax]
jmp 0x10006466
lea ebx, [esp + 0x84]
mov dword [esp + 0x38], ebx
jmp 0x100064c9
lea esi, [esp + 0x84]
jmp 0x10006576
mov eax, dword [eax]
jmp 0x10006662
add eax, 4
push eax
push str.patch_not_in_serv:_ls
call fcn.1004774a
add esp, 8
lea edx, [esp + 0xd4]
push edx
push 4
call fcn.10005b60
cmp dword [esp + 0x98], esi
jb 0x100066e9
mov eax, dword [esp + 0x84]
push eax
call fcn.10056169
add esp, 4
xor ecx, ecx
lea esi, [esp + 0xd4]
mov dword [esp + 0x98], 7
mov dword [esp + 0x94], ebx
mov word [esp + 0x84], cx
call fcn.10005830
mov eax, dword [esp + 0x28]
mov edi, dword [eax]
mov dword [eax], eax
mov eax, dword [esp + 0x28]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], ebx
cmp edi, eax
je 0x1000674d
lea esp, [esp]
mov ebp, dword [edi]
lea esi, [edi + 8]
call fcn.10005830
push edi
call fcn.10056169
mov eax, dword [esp + 0x2c]
add esp, 4
mov edi, ebp
cmp ebp, eax
jne 0x10006730
push eax
call fcn.10056169
mov edx, dword [esp + 0x18]
add esp, 4
push edx
mov dword [esp + 0x2c], ebx
call fcn.10056169
add esp, 4
mov byte [esp + 0x1f4], 0xb
jmp 0x10006915
mov edi, dword [esp + 0x30]
cmp edi, ebx
jne 0x10006822
call fcn.10055ff2
xor eax, eax
mov ebp, dword [esp + 0x34]
cmp ebp, dword [eax + 0x14]
jne 0x10006795
call fcn.10055ff2
lea ecx, [esp + 0xd4]
push ecx
lea edx, [esp + 0x18]
push edx
lea esi, [ebp + 8]
push esi
call fcn.100059d0
test al, al
je 0x10006835
call fcn.1005611d
cdq
mov ecx, 0xf
idiv ecx
imul edx, edx, 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0xd4]
call fcn.10004fc0
test al, al
je 0x10006829
cmp dword [esp + 0x108], 8
mov eax, dword [esp + 0xf4]
jae 0x100067f5
lea eax, [esp + 0xf4]
push 4
lea edx, [esp + 0x3c]
push edx
push 4
push eax
push str.SoftwareprojonepodlppatchInstCache_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x50], 1
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [esp + 0xd4]
push eax
push ebx
jmp 0x10006874
mov eax, dword [edi]
jmp 0x10006787
lea ecx, [esp + 0xd4]
push ecx
push 5
jmp 0x10006874
cmp edi, ebx
jne 0x10006855
call fcn.10055ff2
xor eax, eax
cmp ebp, dword [eax + 0x14]
jne 0x1000684a
call fcn.10055ff2
cmp dword [esi + 0x18], 8
jb 0x10006859
mov eax, dword [esi + 4]
jmp 0x1000685c
mov eax, dword [edi]
jmp 0x10006840
lea eax, [esi + 4]
push eax
push str.uninstall_patch_not_find__ls
call fcn.1004774a
add esp, 8
lea edx, [esp + 0xd4]
push edx
push 3
call fcn.10005b60
cmp dword [esp + 0x98], 8
jb 0x10006893
mov eax, dword [esp + 0x84]
push eax
call fcn.10056169
add esp, 4
xor ecx, ecx
lea esi, [esp + 0xd4]
mov dword [esp + 0x98], 7
mov dword [esp + 0x94], ebx
mov word [esp + 0x84], cx
call fcn.10005830
mov eax, dword [esp + 0x28]
mov edi, dword [eax]
mov dword [eax], eax
mov eax, dword [esp + 0x28]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], ebx
cmp edi, eax
je 0x100068f3
mov ebp, dword [edi]
lea esi, [edi + 8]
call fcn.10005830
push edi
call fcn.10056169
mov eax, dword [esp + 0x2c]
add esp, 4
mov edi, ebp
cmp ebp, eax
jne 0x100068d6
push eax
call fcn.10056169
mov edx, dword [esp + 0x18]
add esp, 4
push edx
mov dword [esp + 0x2c], ebx
call fcn.10056169
add esp, 4
mov byte [esp + 0x1f4], 0xc
lea esi, [esp + 0x44]
call fcn.10009240
mov byte [esp + 0x1f4], 2
mov eax, dword [esp + 0x44]
push eax
call fcn.10056169
mov ebx, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
add esp, 4
test eax, eax
jne 0x1000695f
call fcn.10055ff2
xor eax, eax
cmp ebx, dword [eax + 0x14]
jne 0x10006950
call fcn.10055ff2
mov ebx, dword [ebx]
mov ebp, dword [esp + 0x3c]
mov edi, dword [esp + 0x30]
jmp 0x10006249
mov eax, dword [eax]
jmp 0x10006946
push 0
push 0x1007de80
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], 0
mov byte [esp + 0x20], 0
call fcn.1000a340
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0xa0]
push 3
push edx
mov byte [esp + 0x200], 0xd
call fcn.100032c0
add esp, 0xc
cmp dword [esp + 0x2c], 0x10
jb 0x100069bb
mov eax, dword [esp + 0x18]
push eax
call fcn.10056169
add esp, 4
lea ebx, [esp + 0xb8]
mov dword [esp + 0x2c], 0xf
mov dword [esp + 0x28], 0
mov byte [esp + 0x18], 0
call fcn.1000ab20
mov ecx, dword [esp + 0xcc]
push ecx
call fcn.10056169
mov edx, dword [esp + 0xbc]
add esp, 4
push edx
mov dword [esp + 0xd0], 0
call fcn.10056169
add esp, 4
cmp dword [esp + 0xb4], 0x10
jb 0x10006090
mov eax, dword [esp + 0xa0]
push eax
call fcn.10056169
add esp, 4
jmp 0x10006090
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ebx, [esp + 0xb8]
mov dword [esp + 0x1f4], 0xffffffff
call fcn.1000ab20
mov ecx, dword [esp + 0xcc]
push ecx
call fcn.10056169
mov edx, dword [esp + 0xbc]
add esp, 4
xor ebx, ebx
push edx
mov dword [esp + 0xd0], ebx
call fcn.10056169
add esp, 4
cmp dword [esp + 0xb4], 0x10
jb 0x10006a8b
mov eax, dword [esp + 0xa0]
push eax
call fcn.10056169
add esp, 4
mov dword [esp + 0xb4], 0xf
mov dword [esp + 0xb0], ebx
mov byte [esp + 0xa0], bl
call fcn.1000e1f0
mov al, 1
mov ecx, dword [esp + 0x1ec]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1d0]
xor ecx, esp
call fcn.10055232
add esp, 0x1e4
ret 4