Function at 0x10001950
Capabilities:
Set registry value

Disassembly:
mov eax, 0x178c
call fcn.10126240
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x1784], eax
mov eax, dword [esp + 0x179c]
push ebx
push ebp
mov ebp, dword [esp + 0x17a0]
push esi
mov dword [esp + 0x14], eax
push edi
mov edi, dword [esp + 0x17a0]
mov ebx, ecx
xor eax, eax
mov esi, edx
mov dword [esp + 0x1c], edi
cmp ebx, eax
je 0x10001d15
cmp esi, eax
je 0x10001d15
cmp edi, eax
je 0x10001d15
mov dword [esp + 0x14], eax
cmp byte [ebx], al
je 0x10001d15
cmp byte [esi], al
je 0x10001d15
cmp byte [edi], al
je 0x10001d15
push 0x513
push eax
lea ecx, [esp + 0xd69]
push ecx
mov dword [esp + 0x1c], eax
mov byte [esp + 0xd6c], al
call fcn.10116880
add esp, 0xc
push 0x513
lea edx, [esp + 0x127d]
push 0
push edx
mov byte [esp + 0x1284], 0
call fcn.10116880
add esp, 0xc
push 0x513
lea eax, [esp + 0x335]
push 0
push eax
mov byte [esp + 0x33c], 0
call fcn.10116880
add esp, 0xc
push 0x513
lea ecx, [esp + 0x84d]
push 0
push ecx
mov byte [esp + 0x854], 0
call fcn.10116880
add esp, 0xc
push 0x103
lea edx, [esp + 0x25]
push 0
push edx
mov byte [esp + 0x2c], 0
call fcn.10116880
add esp, 0xc
cmp dword [esp + 0x17a4], 0
jne 0x10001a81
push edi
push str.EUTAPPLISTGROUPS
lea eax, [esp + 0x130]
push 0x1013fbf8
push eax
call fcn.1010d6a8
add esp, 0x10
jmp 0x10001a9b
push str.eutAllowList
lea ecx, [esp + 0x12c]
push 0x1013fb04
push ecx
call fcn.1010d6a8
add esp, 0xc
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x12c]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x10001d15
mov edi, dword [esp + 0x14]
call fcn.10001860
cmp eax, 1
jne 0x10001ade
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x10001d17
lea edx, [esp + 0xd60]
push edx
push esi
mov ecx, 0x157f
call fcn.1005e670
lea eax, [esp + 0x1280]
push eax
push ebx
mov ecx, 0x157f
call fcn.1005e670
add esp, 0x10
test ebp, ebp
je 0x10001b27
cmp byte [ebp], 0
je 0x10001b27
lea ecx, [esp + 0x330]
push ecx
push ebp
mov ecx, 0x157f
call fcn.1005e670
add esp, 8
mov eax, dword [esp + 0x18]
test eax, eax
je 0x10001b4a
cmp byte [eax], 0
je 0x10001b4a
lea edx, [esp + 0x848]
push edx
push eax
mov ecx, 0x157f
call fcn.1005e670
add esp, 8
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x127c]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x10001b76
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10001d15
mov ebp, dword [esp + 0x1c]
push str.Instant_Messengers
push ebp
call fcn.1011c280
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
add esp, 8
test eax, eax
jne 0x10001be4
push str.skype.exe
push ebx
call fcn.1011c280
add esp, 8
test eax, eax
je 0x10001bbc
push str.googletalk.exe
push ebx
call fcn.1011c280
add esp, 8
test eax, eax
jne 0x10001be4
lea edx, [esp + 0x20]
mov ecx, 0x30
push edx
mov word [esp + 0x24], cx
call edi
mov ecx, dword [esp + 0x10]
inc eax
push eax
lea eax, [esp + 0x24]
push eax
push 1
push 0
push str.Executionblocked
push ecx
call esi
push str.Music_Video_Players
push ebp
call fcn.1011c280
add esp, 8
test eax, eax
jne 0x10001c7c
push str.itunes.exe
push ebx
call fcn.1011c280
add esp, 8
test eax, eax
je 0x10001c54
push str.wmplayer.exe
push ebx
call fcn.1011c280
add esp, 8
test eax, eax
je 0x10001c54
push str.mplayer2.exe
push ebx
call fcn.1011c280
add esp, 8
test eax, eax
je 0x10001c54
push str.media_player
push ebx
call fcn.1011c280
add esp, 8
test eax, eax
je 0x10001c54
push str.studio.exe
push ebx
call fcn.1011c280
add esp, 8
test eax, eax
jne 0x10001c7c
lea eax, [esp + 0x20]
mov edx, 0x30
push eax
mov word [esp + 0x24], dx
call edi
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x24]
push ecx
push 1
push 0
push str.Executionblocked
push edx
call esi
lea eax, [esp + 0xd60]
push eax
call edi
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0xd64]
push ecx
push 1
push 0
push str.Prop3
push edx
call esi
cmp byte [esp + 0x848], 0
mov ebx, eax
je 0x10001cd2
lea eax, [esp + 0x848]
push eax
call edi
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x84c]
push ecx
push 1
push 0
push str.Prop2
push edx
call esi
mov ebx, eax
cmp byte [esp + 0x330], 0
je 0x10001d02
lea eax, [esp + 0x330]
push eax
call edi
mov edx, dword [esp + 0x10]
inc eax
push eax
lea ecx, [esp + 0x334]
push ecx
push 1
push 0
push str.Prop1
push edx
call esi
mov ebx, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x10001ad4
xor eax, eax
mov ecx, dword [esp + 0x1794]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x178c
ret