Function at 0x10015cb9
Capabilities:
Set registry value

Disassembly:
mov eax, 0x10060b13
call fcn.1005fe44
sub esp, 0x17c
push ebx
push esi
mov byte [ebp - 0x28], dl
xor ebx, ebx
mov dword [ebp - 0x18], 0x6207
cmp dword [ebp - 0x18], 0x651a
push edi
mov dword [ebp - 0x10], esp
jle 0x10015d2d
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x188]
cdq
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10015d06
mov eax, dword [eax]
push eax
call fcn.10047a23
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x188]
call fcn.1000e875
inc edi
cmp edi, 0x1a18
jl 0x10015ce8
inc esi
cmp esi, 0x7972
jl 0x10015ce6
cmp byte [ebp - 0x28], 0
je 0x1001625b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], 0x2d66
cmp dword [ebp - 0x18], 0x2ec1
mov dword [ebp - 0x5c], str.epkqpralb_sxe_hsvp_hxqfgszkt_zzk_klq_ksotw_tqnyl
jle 0x10015dd3
push 0x1389
push ebx
push 0x2092
push 0x126d
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, ebx
mov esi, 0x1007bfb8
mov dword [ebp - 0x20], ebx
mov eax, ebx
mov dword [ebp - 0x14], 0x2864
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
and eax, edi
mov ecx, esi
cdq
push edx
push eax
call fcn.1000dd80
mov eax, dword [ebp - 0x1c]
add eax, ebx
dec dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
jne 0x10015da0
inc ebx
push 0
mov dword [ebp - 0x20], ebx
cmp ebx, 0x78c4
pop ebx
jl 0x10015d91
inc edi
cmp edi, 0x669c
jl 0x10015d8e
jmp 0x10015dd8
mov esi, 0x1007bfb8
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x10], ebx
je 0x100161ff
mov byte [ebp - 0x78], bl
mov byte [ebp - 0x77], 0x2d
mov dword [ebp - 0x14], 0x137f
cmp dword [ebp - 0x14], 0x1483
jle 0x10015e3c
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov eax, ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
and eax, ebx
mov ecx, esi
or eax, edi
cdq
push edx
push eax
call fcn.1000dd80
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x1674
jl 0x10015e08
inc ebx
push 0
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x3b13
pop ebx
jl 0x10015e00
inc edi
cmp edi, 0x4a19
jl 0x10015dfd
push 0x2e
pop eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 0x10be
mov word [ebp - 0x84], ax
jge 0x10015e7d
mov edx, str.gnxmnmps_xkzahayx_idrhcrw_crzwwxo_fpqdi_bbjjsmwqv_inkzp_scmn_vcllyvxu_zanj_evwybyi_ksjsspenq
mov ecx, esi
call fcn.10010bec
jmp 0x10015e7d
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xf0]
xor eax, eax
mov dword [ebp - 0xdc], 7
mov word [ebp - 0x82], ax
mov word [ebp - 0xf0], ax
lea eax, [ebp - 0x84]
push eax
mov dword [ebp - 0xe0], ebx
call fcn.10019c41
mov edx, dword [ebp + 0xc]
lea eax, [ebp - 0xf0]
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 3
call fcn.100152d8
pop ecx
push ebx
push 1
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 5
call fcn.1000ea49
mov edi, dword [ebp - 0x64]
mov eax, edi
mov esi, dword [ebp - 0x68]
sub eax, esi
push 0x18
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x84], ebx
test eax, eax
jne 0x100161f3
push 0x2d
pop eax
push 2
mov byte [ebp - 0x34], bl
mov dword [ebp - 0x33], 0x127e033f
mov byte [ebp - 0x2f], 0x12
mov word [ebp - 0x40], ax
pop esi
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x1c], esi
cmp esi, 6
jae 0x10016032
mov dword [ebp - 0x24], 0x297a
cmp dword [ebp - 0x24], 0x2bf9
jle 0x10015f88
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov ecx, ebx
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
lea eax, [ebx + esi]
xor eax, ecx
mov ecx, 0x1007bfb8
xor eax, edi
cdq
push edx
push eax
call fcn.1000dd80
mov ecx, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x7639
jl 0x10015f3f
inc edi
push 0
pop ebx
cmp edi, 0x7e42
jl 0x10015f37
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0xaf9
jl 0x10015f35
inc esi
cmp esi, 0x442a
jl 0x10015f32
mov esi, dword [ebp - 0x1c]
movzx eax, byte [ebp - 0x34]
lea eax, [eax*2 + 2]
cmp esi, eax
jne 0x10015faa
movzx ecx, byte [ebp + esi - 0x34]
dec esi
add esi, ecx
lea eax, [ecx + 1]
mov dword [ebp - 0x70], eax
jmp 0x1001602a
mov byte [ebp - 4], 6
cmp dword [ebp - 0x24], 0x269e
jge 0x10015fe7
mov edx, str.tocni_tchpkler_lyck_ubjoe_byqptm_trvgnqt_uovbv_gvn
mov ecx, 0x1007bfb8
call fcn.10010bec
jmp 0x10015fe7
mov dword [ebp - 4], 5
mov eax, esi
sub eax, dword [ebp - 0x70]
movzx edx, byte [ebp + esi - 0x33]
movzx eax, byte [ebp + eax - 0x36]
movzx eax, word [ebp + eax*2 - 0x40]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x34]
mov word [ebp + eax*2 - 0x40], cx
lea eax, [ebp - 0x70]
push eax
sub esp, 0xc
mov cl, 1
push 0x6353
call fcn.1001579e
add esp, 0x14
add esi, 2
jmp 0x10015f14
xor eax, eax
mov dword [ebp - 0xf8], 7
mov word [ebp - 0x3e], ax
lea ecx, [ebp - 0x10c]
mov word [ebp - 0x10c], ax
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0xfc], ebx
call fcn.10019c41
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x10c]
push eax
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 8
call fcn.100152d8
pop ecx
mov esi, eax
lea eax, [ebp - 0x68]
cmp eax, esi
je 0x100160a7
mov ecx, eax
call fcn.10019e54
mov eax, dword [esi]
mov dword [ebp - 0x68], eax
mov eax, dword [esi + 4]
mov dword [ebp - 0x64], eax
mov eax, dword [esi + 8]
mov dword [ebp - 0x60], eax
mov byte [ebp - 0x79], bl
mov byte [ebp - 0x71], bl
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea ecx, [ebp - 0x170]
call fcn.10019e54
push ebx
push 1
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 5
call fcn.1000ea49
mov dword [ebp - 0x1c], 0x4fb2
cmp dword [ebp - 0x1c], 0x4fc6
jle 0x10016138
mov esi, ebx
mov dword [ebp - 0x38], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov eax, esi
mov dword [ebp - 0x2c], ebx
cdq
mov esi, ebx
idiv edi
mov ecx, edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], ebx
mov edi, 0x543e
mov eax, ebx
or eax, ecx
mov ecx, 0x1007bfb8
cdq
push edx
push eax
call fcn.1000dd80
mov ecx, dword [ebp - 0x24]
add ebx, esi
dec edi
jne 0x100160f5
inc esi
push 0
pop ebx
cmp esi, 0x14d6
jl 0x100160ed
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x38]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x653b
jl 0x100160de
inc esi
mov dword [ebp - 0x38], esi
cmp esi, 0x7db7
jl 0x100160d9
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x1c], 0x4d49
mov dword [ebp - 0x40], ebx
jge 0x10016175
mov edx, str.ytbpfo_dbgmhukwa_drqd_klxc_mxhhclld_vfjta_jteub_img_akdylws_aomzgii_sjvttqco_afiy_kyiislex
mov ecx, 0x1007bfb8
call fcn.10010bec
jmp 0x10016175
mov dword [ebp - 4], 5
mov esi, dword [ebp - 0x68]
mov edi, dword [ebp - 0x64]
jmp 0x100161f3
push esi
lea ecx, [ebp - 0x154]
call fcn.1000de95
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x154]
cmp dword [ebp - 0x140], 8
cmovae eax, dword [ebp - 0x154]
mov dword [ebp - 0x2c], eax
call fcn.10047d16
push 0xa
mov dword [eax], ebx
lea eax, [ebp - 0xb4]
push eax
push dword [ebp - 0x2c]
call fcn.10047f4b
add esp, 0xc
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0xbc]
lea ecx, [ebp - 0xa0]
push eax
call fcn.100199db
push ebx
push 1
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 5
call fcn.1000ea49
add esi, 0x18
cmp esi, edi
jne 0x10016184
lea ecx, [ebp - 0x68]
call fcn.10019e54
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x18], 0x2af8
jge 0x10016219
mov edx, dword [ebp - 0x5c]
mov ecx, 0x1007bfb8
call fcn.10010bec
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x6c]
lea eax, [ebp - 0xa0]
push eax
call fcn.10019a33
lea ecx, [ebp - 0xa0]
call fcn.10019f2d
jmp 0x100166cd
push dword [ebp - 0xb4]
mov ecx, dword [ebp + 0x1c]
lea eax, [ebp - 0x154]
movdqa xmm0, xmmword [0x1006e950]
push eax
lea eax, [ebp - 0x164]
mov dword [ebp - 0x6c], ecx
push eax
push ebx
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0xc8], ebx
movdqu xmmword [ebp - 0x164], xmm0
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
call fcn.10011607
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x5c], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x100162ce
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf4], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x100162bd
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], ebx
jl 0x10016338
mov dword [ebp - 0x3c], 0xba1bf2b2
mov dword [ebp - 0xb0], 0x77cc4247
mov dword [ebp - 0x3c], 3
cmp dword [ebp - 0x3c], ebx
jl 0x10016333
push ebx
lea eax, [ebp - 0xc8]
mov dword [ebp - 0xb8], ebx
push 0x1e0f
push eax
lea edx, [ebp - 0xb8]
lea ecx, [ebp - 0x3c]
call fcn.10018388
pop ecx
pop ecx
lea edx, [ebp - 0xb0]
mov cl, 1
call fcn.100154e1
dec dword [ebp - 0x3c]
pop ecx
jns 0x100162fd
dec dword [ebp - 0x14]
jns 0x100162e0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8]
call fcn.1000e145
push 0x7c
pop eax
push 2
mov ecx, ebx
mov dword [ebp - 0x4c], 0x21046600
mov word [ebp - 0x48], 0xc048
mov byte [ebp - 0x46], 0xd8
mov word [ebp - 0x44], ax
pop esi
mov dword [ebp - 0x88], ecx
cmp esi, 2
jne 0x1001637c
push 5
pop ecx
push ecx
mov dword [ebp - 0x88], ecx
pop esi
jmp 0x100163bf
movzx edx, byte [ebp + esi - 0x4b]
mov eax, esi
sub eax, ecx
push ebx
push 0x6bc0
movzx eax, byte [ebp + eax - 0x4e]
movzx eax, word [ebp + eax*2 - 0x44]
mov ecx, eax
and eax, edx
or ecx, edx
mov edx, 0x68bc
sub ecx, eax
movzx eax, byte [ebp + esi - 0x4c]
mov word [ebp + eax*2 - 0x44], cx
lea ecx, [ebp - 0x88]
call fcn.1001885d
pop ecx
pop ecx
mov ecx, dword [ebp - 0x88]
add esi, 2
cmp esi, 7
jb 0x1001636a
xor eax, eax
mov dword [ebp - 0x110], 7
mov word [ebp - 0x42], ax
lea ecx, [ebp - 0x124]
mov word [ebp - 0x124], ax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x114], ebx
call fcn.10019c41
mov edx, dword [ebp + 0x18]
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0xac]
mov dword [ebp - 4], 0x10
call fcn.100152d8
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 0x12
call fcn.1000ea49
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001644c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd8], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001643b
push 9
mov dword [ebp - 0x14], ebx
pop edi
cmp dword [ebp - 0x14], 3
jg 0x10016564
mov dword [ebp - 0x24], 0xce4b0ad8
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x18], 0x2c63
cmp dword [ebp - 0x18], 0x2f10
jle 0x100164b3
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, ebx
mov edi, esi
mov ebx, 0x6d64
mov eax, edi
mov ecx, 0x1007bfb8
cdq
push edx
push eax
call fcn.1000dd80
dec edi
dec ebx
jne 0x1001648c
inc esi
cmp esi, 0xee1
jl 0x10016485
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
push 9
pop edi
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x18], 0x2bf5
jge 0x100164f6
mov edx, str.voomaaqib_xnywmibh_bnqewx_cku_unvrqqcrz_ybq_wwxm_xqpghexxs_dju
mov ecx, 0x1007bfb8
call fcn.10010bec
jmp 0x100164f6
mov dword [ebp - 4], 0x12
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x18], 1
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xd8]
mov dword [ebp - 0x18], ebx
imul eax, dword [ebp - 0x14], 0xebf0
add eax, dword [ebp - 0x18]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x14]
setl cl
sub ecx, dword [ebp + eax*4 - 0xd8]
mov dword [ebp - 0x5c], ecx
inc dword [ebp - 0x14]
jmp 0x10016458
push 2
mov ecx, ebx
mov dword [ebp - 0x58], 0x86027f00
mov dword [ebp - 0x54], 0x103021d
mov word [ebp - 0x50], 0x307
mov byte [ebp - 0x4e], 0x2d
mov word [ebp - 0x94], di
pop esi
mov dword [ebp - 0x80], ecx
cmp esi, 2
jne 0x1001659a
push 3
pop ecx
push ecx
mov dword [ebp - 0x80], ecx
pop esi
jmp 0x100165e7
movzx edx, byte [ebp + esi - 0x57]
mov eax, esi
sub eax, ecx
push 1
movzx eax, byte [ebp + eax - 0x5a]
movzx eax, word [ebp + eax*2 - 0x94]
mov ecx, eax
and eax, edx
or ecx, edx
mov edx, 0x4bc0
sub ecx, eax
movzx eax, byte [ebp + esi - 0x58]
push ecx
mov word [ebp + eax*2 - 0x94], cx
lea eax, [ebp - 0x80]
push eax
push ecx
push 0x19e9
mov ecx, 0xcde
call fcn.10018362
mov ecx, dword [ebp - 0x80]
add esp, 0x14
add esi, 2
cmp esi, 0xb
jb 0x1001658b
xor eax, eax
mov edx, 0x4db6
push 0xb82
mov word [ebp - 0x8c], ax
call fcn.10017045
xor eax, eax
mov dword [ebp - 0x128], 7
pop ecx
mov word [ebp - 0x13c], ax
lea ecx, [ebp - 0x13c]
lea eax, [ebp - 0x94]
mov dword [ebp - 0x12c], ebx
push eax
call fcn.10019c41
xor eax, eax
mov byte [ebp - 4], 0x15
lea edi, [ebp - 0x94]
mov dword [ebp - 0x38], ebx
stosd dword es:[edi], eax
push 0x18
pop ecx
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp - 0xa8]
sub eax, dword [ebp - 0xac]
cdq
idiv ecx
mov esi, eax
test esi, esi
je 0x100166a5
push ecx
push 0x512a
lea eax, [ebp - 0x13c]
mov edx, 0x7ac3
push eax
push ecx
push 0x79a3
lea eax, [ebp - 0x38]
mov ecx, 0x36b6
push eax
lea eax, [ebp - 0xac]
push eax
push 1
push 0x1bdb
push 0x511
call fcn.10016ab4
mov eax, dword [ebp - 0x38]
add esp, 0x28
inc eax
mov dword [ebp - 0x38], eax
cmp eax, esi
jb 0x1001665e
mov ecx, dword [ebp + 0x1c]
lea eax, [ebp - 0xac]
push eax
call fcn.100197fe
push ebx
push 1
lea ecx, [ebp - 0x13c]
call fcn.1000ea49
lea ecx, [ebp - 0xac]
call fcn.10019e54
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret