Function at 0x1004c8f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x101a018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
push 0x56
lea eax, [ebp - 0x5c]
push ebx
push eax
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x88], ebx
mov byte [ebp - 0x7d], bl
mov dword [ebp - 0x60], ebx
call fcn.01010f7a
xor eax, eax
mov byte [ebp - 0x78], bl
lea edi, [ebp - 0x77]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
lea edi, [ebp - 0x64]
stosb byte es:[edi], al
mov edi, dword [ebp - 0x8c]
add esp, 0xc
cmp byte [edi + 4], al
jne 0x100489e
mov edi, 0x8000ffff
mov eax, dword [section..data]
cmp eax, section..data
je 0x1004c84
test byte [eax + 0x1c], 1
je 0x1004c84
push edi
push 0x1001380
push 0x39
push dword [eax + 0x14]
push dword [eax + 0x10]
jmp 0x1004c7f
cmp word [esi + 2], bx
je 0x10048c3
cmp word [esi + 4], bx
je 0x10048c3
mov ecx, dword [esi + 0x3c]
cmp ecx, ebx
je 0x10048c3
lea eax, [esi + 0x40]
mov dword [ebp - 0x9c], eax
cmp byte [eax], bl
je 0x10048c3
test byte [esi], 0xe0
je 0x10048ec
mov edi, 0x8007000d
mov eax, dword [section..data]
cmp eax, section..data
je 0x1004c84
test byte [eax + 0x1c], 1
je 0x1004c84
push edi
push 0x1001380
push 0x3a
jmp 0x1004893
push ecx
call fcn.01005e9e
test al, al
je 0x10048fd
xor edi, edi
jmp 0x1004c84
lea eax, [ebp - 0x88]
lea ecx, [edi + 8]
push eax
mov dword [ebp - 0x94], ecx
call fcn.01003068
mov edi, eax
cmp edi, ebx
jge 0x100493f
mov eax, dword [section..data]
cmp eax, section..data
je 0x1004c84
test byte [eax + 0x1c], 1
je 0x1004c84
push edi
push 0x1001380
push 0x3b
jmp 0x1004893
lea eax, [ebp - 0x90]
push eax
movzx eax, word [esi + 2]
push 0x124
dec eax
push eax
call fcn.0101597e
mov edi, eax
mov ebx, 0x1001380
test edi, edi
jge 0x100498f
mov eax, dword [section..data]
cmp eax, section..data
je 0x1004c4c
test byte [eax + 0x1c], 1
je 0x1004c4c
push edi
push ebx
push 0x3c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
jmp 0x1004c4c
mov ecx, dword [ebp - 0x94]
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x90]
push dword [ebp - 0x88]
call fcn.010030d5
mov edi, eax
test edi, edi
jge 0x10049d0
mov eax, dword [section..data]
cmp eax, section..data
je 0x1004c4c
test byte [eax + 0x1c], 1
je 0x1004c4c
push edi
push ebx
push 0x3d
jmp 0x100497f
lea eax, [ebp - 0x84]
push eax
push 4
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 0x8c]
mov ecx, dword [eax + 0x28]
call fcn.0100c2bd
mov edi, eax
test edi, edi
jge 0x1004a14
mov eax, dword [section..data]
cmp eax, section..data
je 0x1004c4c
test byte [eax + 0x1c], 1
je 0x1004c4c
push edi
push ebx
push 0x3e
jmp 0x100497f
mov eax, dword [ebp - 0x84]
test eax, eax
je 0x1004abf
push 0x15
lea ecx, [esi + 0x25]
push ecx
add eax, 0x14
push eax
call dword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp eax, 0x15
jne 0x1004abf
mov eax, dword [ebp - 0x84]
add eax, 0x2a
push eax
mov eax, dword [ebp - 0x7c]
push 0x2d
add eax, 0x14
push eax
call fcn.01003716
mov edi, eax
test edi, edi
jge 0x1004a7c
mov eax, dword [section..data]
cmp eax, section..data
je 0x1004c4c
test byte [eax + 0x1c], 1
je 0x1004c4c
push edi
push ebx
push 0x40
jmp 0x100497f
mov eax, dword [ebp - 0x84]
add eax, 0x84
push eax
mov eax, dword [ebp - 0x7c]
push 0x2d
add eax, 0x6e
push eax
call fcn.01003716
mov edi, eax
test edi, edi
jge 0x1004afc
mov eax, dword [section..data]
cmp eax, section..data
je 0x1004c4c
test byte [eax + 0x1c], 1
je 0x1004c4c
push edi
push ebx
push 0x41
jmp 0x100497f
mov eax, dword [ebp - 0x7c]
lea ecx, [eax + 0x6e]
push ecx
add eax, 0x14
push eax
lea eax, [esi + 0x25]
push eax
call fcn.01003dc9
mov edi, eax
test edi, edi
jge 0x1004afc
mov eax, dword [section..data]
cmp eax, section..data
je 0x1004c4c
test byte [eax + 0x1c], 1
je 0x1004c4c
push edi
push ebx
push 0x3f
jmp 0x100497f
lea eax, [ebp - 0x78]
push eax
push dword [esi + 0x3c]
call fcn.01006275
test eax, eax
jl 0x1004b38
push 0x15
lea eax, [esi + 0x10]
push eax
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp eax, 0x15
jne 0x1004b38
mov eax, dword [ebp - 0x7c]
push 0
add eax, 0xc8
push eax
push dword [esi + 0x3c]
call fcn.01006be5
test eax, eax
jge 0x1004b77
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x7c]
add eax, 0xc8
push eax
lea eax, [esi + 0x10]
push eax
call fcn.01003dc9
mov edi, eax
test edi, edi
jge 0x1004b77
mov eax, dword [section..data]
cmp eax, section..data
je 0x1004c4c
test byte [eax + 0x1c], 1
je 0x1004c4c
push edi
push ebx
push 0x42
jmp 0x100497f
mov ecx, dword [ebp - 0x7c]
push dword [ebp - 0x9c]
xor eax, eax
inc eax
mov word [ecx + 8], ax
mov ecx, dword [ebp - 0x7c]
mov word [ecx + 0xa], ax
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 0x7c]
mov dword [ecx + 4], eax
movzx eax, byte [esi]
mov ecx, dword [ebp - 0x7c]
mov dword [ecx], eax
mov ax, word [esi + 2]
mov ecx, dword [ebp - 0x7c]
mov word [ecx + 0xc], ax
mov eax, dword [esi + 8]
mov ecx, dword [ebp - 0x7c]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x7c]
movzx ecx, word [eax + 0xc]
push ecx
add eax, 0x122
push eax
call fcn.010036ae
mov edi, eax
test edi, edi
jge 0x1004be7
mov eax, dword [section..data]
cmp eax, section..data
je 0x1004c4c
test byte [eax + 0x1c], 1
je 0x1004c4c
push edi
push ebx
push 0x43
jmp 0x100497f
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x7d]
push eax
mov eax, dword [ebp - 0x90]
push eax
add eax, 0xfffffff4
push eax
mov eax, dword [ebp - 0x8c]
push dword [ebp - 0x7c]
mov ecx, dword [eax + 0x38]
call fcn.0100c688
mov edi, eax
test edi, edi
jge 0x1004c2f
mov eax, dword [section..data]
cmp eax, section..data
je 0x1004c4c
test byte [eax + 0x1c], 1
je 0x1004c4c
push edi
push ebx
push 0x44
jmp 0x100497f
cmp byte [ebp - 0x7d], 0
je 0x1004c4a
mov eax, dword [ebp - 0x98]
mov ecx, 0xffff
cmp word [eax + 8], cx
je 0x1004c4a
inc word [eax + 8]
xor edi, edi
push dword [ebp - 0x88]
mov ecx, dword [ebp - 0x94]
call fcn.01003207
test eax, eax
jge 0x1004c84
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1004c84
test byte [ecx + 0x1c], 1
je 0x1004c84
push eax
push ebx
push 0x45
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01002fd5
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01010f65
leave
ret 8