Function at 0x100143a5
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10030bc8
mov eax, dword fs:[0]
push eax
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x10032138]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov ebx, ecx
lea ecx, [esp + 0x40]
call fcn.10004f6b
xor ecx, ecx
mov dword [esp + 0x58], ecx
xor eax, eax
lea edi, [esp + 0x3c]
mov dword [esp + 0x38], ecx
stosd dword es:[edi], eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], ecx
stosd dword es:[edi], eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], ecx
test ebx, ebx
je 0x1001462d
cmp ebx, reloc.ADVAPI32.dll_TraceMessage
je 0x1001442d
cmp ebx, 0x3e8
ja 0x1001462d
push dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
push edi
push dword [ebp + 0x14]
lea esi, [esp + 0x30]
push dword [ebp + 0x10]
lea eax, [esp + 0x28]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10005c37
mov esi, eax
test esi, esi
js 0x10014632
cmp dword [esp + 0x18], 0
jne 0x10014632
push 0x10005d60
lea ecx, [esp + 0x44]
call fcn.1000503e
mov esi, eax
test esi, esi
js 0x10014632
cmp dword [ebp + 8], 0
je 0x100144ae
push 0x100030b4
lea ecx, [esp + 0x44]
call fcn.10019dee
mov esi, eax
test esi, esi
js 0x10014632
push dword [ebp + 8]
lea ecx, [esp + 0x44]
call fcn.10019dee
mov esi, eax
test esi, esi
js 0x10014632
cmp dword [ebp + 0xc], 0
je 0x100144e2
push 0x100030b4
lea ecx, [esp + 0x44]
call fcn.10019dee
mov esi, eax
test esi, esi
js 0x10014632
push dword [ebp + 0xc]
lea ecx, [esp + 0x44]
call fcn.10019dee
mov esi, eax
test esi, esi
js 0x10014632
cmp dword [ebp + 0x10], 0
je 0x10014516
push 0x100030b4
lea ecx, [esp + 0x44]
call fcn.10019dee
mov esi, eax
test esi, esi
js 0x10014632
push dword [ebp + 0x10]
lea ecx, [esp + 0x44]
call fcn.10019dee
mov esi, eax
test esi, esi
js 0x10014632
cmp dword [ebp + 0x14], 0
je 0x1001454a
push 0x100030b4
lea ecx, [esp + 0x44]
call fcn.10019dee
mov esi, eax
test esi, esi
js 0x10014632
push dword [ebp + 0x14]
lea ecx, [esp + 0x44]
call fcn.10019dee
mov esi, eax
test esi, esi
js 0x10014632
test edi, edi
je 0x10014555
and dword [esp + 0x1c], 0
jmp 0x1001455a
mov edi, 0x1000c3fc
cmp ebx, reloc.ADVAPI32.dll_TraceMessage
jne 0x10014569
or dword [esp + 0x2c], ebx
or dword [esp + 0x30], ebx
jmp 0x100145ad
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0
push ebx
lea esi, [esp + 0x34]
call fcn.1000f3c0
mov esi, eax
test esi, esi
js 0x10014632
push dword [esp + 0x30]
lea eax, [esp + 0x30]
push dword [esp + 0x30]
push dword [esp + 0x44]
push dword [esp + 0x44]
call fcn.1000f385
mov esi, eax
test esi, esi
js 0x10014632
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x18]
push eax
xor ebx, ebx
push ebx
push 0xf013f
push ebx
push ebx
push ebx
lea ecx, [esp + 0x5c]
call fcn.1000476f
push eax
xor eax, eax
cmp dword [ebp + 0x1c], eax
setne al
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x100145f6
mov esi, eax
jle 0x10014632
and esi, 0xffff
or esi, 0x80070000
jmp 0x10014632
cmp dword [esp + 0x1c], ebx
je 0x10014612
cmp dword [esp + 0x20], 2
jne 0x10014612
push ebx
push dword [esp + 0x18]
call dword [0x1000c670]
test eax, eax
jne 0x100145e4
push 8
lea eax, [esp + 0x30]
push eax
push 0xb
push ebx
push edi
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100145e4
jmp 0x10014632
mov esi, 0x80070057
cmp dword [esp + 0x14], 0
je 0x10014643
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [esp + 0x58], reloc.ADVAPI32.dll_TraceMessage
lea ecx, [esp + 0x40]
call fcn.10004fde
mov eax, esi
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18