Function at 0x1d43f6e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1038
call fcn.01d558b0
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [ebp + 8], ebx
je 0x1d442b5
cmp dword [ebp + 0xc], ebx
je 0x1d442b5
push 0x1000
lea eax, [ebp - 0x1038]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x387b3fce
lea ecx, [ebp - 0x38]
call fcn.01d44f50
lea edx, [ebp - 0x1038]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1d43fbc
mov eax, dword [ebp + 8]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1d43fcb
lea edi, [ebp - 0x1038]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1d43fdb
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push ebx
push 0x1d6e353
push ebx
lea eax, [ebp - 0x1038]
push eax
and ecx, 3
push reloc.WS2_32.dll_bind
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1d442b5
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x1038]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1d4402b
lea eax, [ebp - 0x1038]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1d4403e
sub eax, edx
push 0x6783395a
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.01d44f8b
push esi
lea ecx, [ebp - 0x1038]
push ecx
xor esi, esi
inc esi
push esi
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
push dword [ebp - 4]
call ebx
test eax, eax
setne al
test al, al
jne 0x1d442b5
push 0x1890e90f
lea ecx, [ebp - 0x15]
mov dword [ebp - 8], esi
call fcn.01d44fc8
push 4
lea ecx, [ebp - 8]
push ecx
push 4
push 0
push eax
push dword [ebp - 4]
call ebx
test eax, eax
setne al
test al, al
jne 0x1d442b5
push 0x862a147
lea ecx, [ebp - 0xd]
call fcn.01d43197
lea edx, [ebp - 0x1038]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1d440be
mov eax, dword [ebp + 0xc]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1d440cd
lea edi, [ebp - 0x1038]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1d440dd
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [ebp - 0x1038]
rep movsb byte es:[edi], byte [esi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1d440fe
sub eax, esi
push 0x799ca151
lea ecx, [ebp - 0x12]
mov esi, eax
call fcn.01d45005
push esi
lea ecx, [ebp - 0x1038]
push ecx
xor edi, edi
inc edi
push edi
push 0
push eax
push dword [ebp - 4]
call ebx
test eax, eax
setne al
test al, al
jne 0x1d442b5
mov eax, 0x1d6e384
sub eax, 0x50bc9f13
push eax
lea ecx, [ebp - 0xe]
mov dword [ebp - 8], 3
call fcn.01d45042
push 4
pop esi
push esi
lea ecx, [ebp - 8]
push ecx
push esi
push 0
push eax
push dword [ebp - 4]
call ebx
test eax, eax
setne al
test al, al
jne 0x1d442b5
mov eax, 0x1d6e38c
sub eax, 0x4d043a55
push eax
lea ecx, [ebp - 0xd]
mov dword [ebp - 8], edi
call fcn.01d4507f
push esi
lea ecx, [ebp - 8]
push ecx
push esi
push 0
push eax
push dword [ebp - 4]
call ebx
test eax, eax
setne al
test al, al
jne 0x1d442b5
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x1d6e394
sub eax, 0x45f0ed0b
push eax
lea ecx, [ebp - 0x38]
call fcn.01d450bc
lea edx, [ebp - 0x1038]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1d441cd
mov eax, dword [ebp + 8]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1d441dc
lea edi, [ebp - 0x1038]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1d441ec
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
mov eax, str.__jmbmMxbzh
sub eax, 0x6194e30f
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [ebp - 0x15]
call fcn.01d450f9
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1d44219
lea edi, [ebp - 0x1038]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1d44229
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 8]
push eax
and ecx, 3
lea eax, [ebp - 4]
push eax
rep movsb byte es:[edi], byte [esi]
xor edi, edi
push edi
push 0xf003f
push edi
push 0x1d6e36d
push edi
lea eax, [ebp - 0x1038]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1d442b5
mov eax, 0x1d6e3c8
sub eax, 0x29a4d1fe
mov esi, 0xa8
push eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 8], esi
call fcn.01d45134
push esi
push 0x1d6e288
push 3
push edi
push eax
push dword [ebp - 4]
call ebx
test eax, eax
setne al
test al, al
jne 0x1d442b5
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1d442b8
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret