Function at 0x10018a70
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp - 0x214]
push eax
push 0x40
push 5
push 0x556b5e
call edi
mov byte [0x556b5e], 0xe9
mov eax, 0x100189f0
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
add eax, 0xffaa949d
mov dword [0x556b5f], eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
push 5
push 0x556b5e
call edi
lea eax, [ebp - 0x214]
push eax
push 0x40
push 2
push 0x556b63
call edi
mov eax, 0x556b63
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
push 2
push 0x556b63
call edi
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call fcn.1003c000
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
lea eax, [ebp - 0x218]
push eax
push 0x20019
push 0
push str.SOFTWAREVooblyVooblygame13_v1.6_RC
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10018c81
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push str.double_click_Selection
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, str.true
lea eax, [ebp - 0x108]
nop word [eax + eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10018bb0
test dl, dl
je 0x10018bac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10018bb0
add eax, 2
add ecx, 2
test dl, dl
jne 0x10018b90
xor esi, esi
jmp 0x10018bb5
sbb esi, esi
or esi, 1
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10018c81
lea eax, [ebp - 0x214]
push eax
push 0x40
push 0xb
push 0x42fc2c
call edi
mov eax, 0x42fc2c
mov ecx, 0x90909090
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov word [eax + 8], cx
mov byte [eax + 0xa], cl
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
push 0xb
push 0x42fc2c
call edi
lea eax, [ebp - 0x214]
push eax
push 0x40
push 5
push 0x42fc83
call edi
mov byte [0x42fc83], 0xe9
mov eax, 0x10018a30
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
add eax, 0xffbd0378
mov dword [0x42fc84], eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
push 5
push 0x42fc83
call edi
lea eax, [ebp - 0x214]
push eax
push 0x40
push 1
push 0x42fc88
call edi
mov eax, 0x42fc88
mov byte [eax], 0x90
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
push 1
push 0x42fc88
call edi
push 0x103
lea eax, [ebp - 0x20b]
mov byte [ebp - 0x20c], 0
push 0
push eax
call fcn.1003c000
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
lea eax, [ebp - 0x218]
push eax
push 0x20019
push 0
push str.SOFTWAREVooblyVooblygame13_v1.6_RC
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10018d3f
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push str.selection_box
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, str.true
lea eax, [ebp - 0x20c]
nop dword [eax]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10018d20
test dl, dl
je 0x10018d1c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10018d20
add eax, 2
add ecx, 2
test dl, dl
jne 0x10018d00
xor esi, esi
jmp 0x10018d25
sbb esi, esi
or esi, 1
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10018d3f
mov dword [0x10098bf0], 1
lea eax, [ebp - 0x214]
push eax
push 0x40
push 5
push 0x420b7d
call edi
mov byte [0x420b7d], 0xe9
mov eax, 0x100189c0
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x21c]
add eax, 0xffbdf47e
mov dword [0x420b7e], eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
push 5
push 0x420b7d
call edi
lea eax, [ebp - 0x214]
push eax
push 0x40
push 2
push 0x420b82
call edi
mov eax, 0x420b82
mov ecx, 0x90909090
mov word [eax], cx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
push 2
push 0x420b82
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002063c
mov esp, ebp
pop ebp
ret