Function at 0x10006ef0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x604
mov eax, dword [str.SOFTWAREMicrosoft]
mov ecx, dword [0x1000d220]
mov edx, dword [0x1000d224]
push ebx
mov dword [esp + 0x2c], eax
mov eax, dword [0x1000d228]
mov dword [esp + 0x30], ecx
mov cx, word [0x1000d22c]
push ebp
push esi
mov dword [esp + 0x3c], edx
mov dl, byte [0x1000d22e]
push edi
mov dword [esp + 0x44], eax
mov word [esp + 0x48], cx
mov ecx, 0x14
xor eax, eax
lea edi, [esp + 0x4b]
mov byte [esp + 0x4a], dl
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x2e]
mov ebp, dword [esp + 0x2a]
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
and ebx, 0xffff
lea ecx, [esp + 0x22c]
push ebx
and edi, 0xffff
push 0x1000d218
push ecx
and ebp, 0xffff
mov dword [esp + 0x30], edi
call esi
push ebp
lea edx, [esp + 0x3cc]
push 0x1000d218
push edx
call esi
push edi
lea eax, [esp + 0x568]
push 0x1000d218
push eax
call esi
add esp, 0x24
lea ecx, [esp + 0x18]
lea edx, [esp + 0x38]
push ecx
push 0xf003f
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov dword [esp + 0x1c], eax
je 0x10006fe6
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x604
ret
mov edi, str.SYM
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x38]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 0xf003f
lea ecx, [esp + 0x40]
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x10007166
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x484]
push edx
push str.year
push eax
call fcn.10006e00
mov edx, dword [esp + 0x1c]
lea ecx, [esp + 0x300]
push ecx
push str.month
push edx
call fcn.10006e00
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0xb4]
push eax
push 0x1000d1fc
push ecx
call fcn.10006e00
mov eax, dword [esp + 0x34]
lea edx, [esp + 0x188]
push edx
push str.path
push eax
call fcn.10006e00
add esp, 0x30
mov edi, 0x1000d1f0
lea esi, [esp + 0x164]
mov cl, byte [esi]
mov dl, byte [edi]
mov al, cl
cmp cl, dl
jne 0x100070cf
test al, al
je 0x100070cb
mov dl, byte [esi + 1]
mov cl, byte [edi + 1]
mov al, dl
cmp dl, cl
jne 0x100070cf
add esi, 2
add edi, 2
test al, al
jne 0x100070a7
xor eax, eax
jmp 0x100070d4
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100070e3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x604
ret
mov esi, dword [sym.imp.MSVCRT.dll_atoi]
lea eax, [esp + 0x484]
push eax
call esi
lea ecx, [esp + 0x2f8]
mov edi, eax
push ecx
call esi
lea edx, [esp + 0xa4]
mov dword [esp + 0x28], eax
push edx
call esi
sub ebx, edi
mov edi, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
add esp, 0xc
lea ecx, [ebx + ebx*2]
shl ecx, 2
sub ecx, edi
add ecx, ebp
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
lea ecx, [edx + ecx*2]
sub ecx, eax
cmp ecx, 0x1e
jl 0x1000715c
mov edx, dword [esp + 0x10]
push 0x32
push 0x1000d1f0
push 1
push 0
push str.path
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x604
ret
mov eax, dword [esp + 0x10]
push eax
jmp 0x10007207
lea ecx, [esp + 0x1c]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push 0xf003f
push 0
push 0x1000d4e0
push 0
push 0x1000d1ec
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp dword [esp + 0x1c], 1
jne 0x10007202
mov edx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x22c]
push 0x32
push ecx
push 1
push 0
push str.year
push edx
call esi
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x3bc]
push 0x32
push eax
push 1
push 0
push str.month
push ecx
call esi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x54c]
push 0x32
push edx
push 1
push 0
push 0x1000d1fc
push eax
call esi
mov ecx, dword [esp + 0x14]
push 0x32
push 0x1000d1e8
push 1
push 0
push str.path
push ecx
call esi
mov edx, dword [esp + 0x14]
push edx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
mov eax, dword [esp + 0x18]
push eax
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x604
ret