Function at 0x10051e90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bc8f1
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x100f51d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.10012770
mov ecx, eax
test ecx, ecx
je 0x1005249f
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x100524a9
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0x13c], eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x154], 0
mov edi, 1
mov dword [ebp - 0x12c], 0x11c
call fcn.10015f60
test eax, eax
je 0x10051fa4
cmp dword [ebp - 0x128], 6
jb 0x10051fa4
lea eax, [ebp - 0x138]
mov dword [ebp - 0x138], 0
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10051fa4
lea eax, [ebp - 0x164]
mov dword [ebp - 0x140], 0
push eax
push 4
lea eax, [ebp - 0x140]
mov dword [ebp - 0x164], 0
push eax
push 0x14
push dword [ebp - 0x138]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x10051f98
xor eax, eax
cmp dword [ebp - 0x140], eax
setne al
mov dword [ebp - 0x130], eax
mov edi, eax
push dword [ebp - 0x138]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x154]
lea ecx, [ebp - 0x13c]
call fcn.10051430
mov dword [ebp - 0x138], eax
test eax, eax
je 0x1005202a
test edi, edi
je 0x10051fd4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
call fcn.1000d220
test eax, eax
jne 0x1005202a
mov esi, dword [ebp - 0x13c]
mov ecx, dword [ebx]
sub ecx, 0x10
mov dword [ebp - 0x130], ecx
lea edx, [esi - 0x10]
cmp edx, ecx
je 0x10052444
cmp dword [ecx + 0xc], 0
jl 0x1005201a
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x1005201a
mov ecx, edx
call fcn.10017460
mov ecx, dword [ebp - 0x130]
mov edi, eax
call fcn.10012730
lea eax, [edi + 0x10]
mov dword [ebx], eax
jmp 0x10052444
push dword [esi - 0xc]
mov ecx, ebx
push esi
call fcn.10016cf0
jmp 0x10052444
lea eax, [ebp - 0x150]
mov dword [ebp - 0x130], eax
call fcn.10012770
mov ecx, eax
test ecx, ecx
je 0x100524b0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x100524ba
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0x150], eax
mov byte [ebp - 4], 4
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x130], eax
call fcn.10012770
mov ecx, eax
test ecx, ecx
je 0x100524c1
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x100524cb
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0x14c], eax
mov byte [ebp - 4], 6
lea eax, [ebp - 0x148]
mov dword [ebp - 0x130], eax
call fcn.10012770
mov ecx, eax
test ecx, ecx
je 0x100524d2
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x100524dc
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0x148], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x144], 0
call fcn.100518f0
mov eax, dword [ebp - 0x144]
mov esi, dword [ebp - 0x13c]
mov dword [ebp - 0x140], eax
test al, 3
jne 0x1005217a
cmp dword [ebp - 0x138], 0
je 0x100521bf
cmp dword [ebp - 0x154], 0
je 0x100521bf
mov esi, dword [ebp - 0x13c]
mov ecx, dword [ebx]
lea edx, [esi - 0x10]
sub ecx, 0x10
mov dword [ebp - 0x130], ecx
cmp edx, ecx
je 0x1005235f
cmp dword [ecx + 0xc], 0
jl 0x100522a9
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x100522a9
mov ecx, edx
call fcn.10017460
mov ecx, dword [ebp - 0x130]
mov edi, eax
call fcn.10012730
lea eax, [edi + 0x10]
mov dword [ebx], eax
jmp 0x1005235f
cmp dword [ebp - 0x138], 0
je 0x100521bf
push edi
mov edx, ebx
lea ecx, [ebp - 0x150]
call fcn.100519e0
add esp, 4
test eax, eax
je 0x1005212c
test esi, esi
je 0x100524e3
push esi
push dword [ebx]
call fcn.100a62ba
add esp, 8
test eax, eax
je 0x1005235f
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x140], eax
and eax, 3
cmp al, 3
je 0x100521ea
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x150]
call fcn.100518f0
mov eax, dword [ebp - 0x140]
cmp eax, dword [ebp - 0x144]
jne 0x100521f2
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
jne 0x1005221b
push edi
mov edx, ebx
lea ecx, [ebp - 0x150]
call fcn.100519e0
add esp, 4
test eax, eax
jne 0x1005221b
cmp dword [ebp - 0x138], eax
je 0x1005221b
cmp dword [ebp - 0x154], eax
jne 0x10052132
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x130]
call fcn.100512c0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x160]
push 0x202
push dword [eax]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10010e10
test eax, eax
sete byte [ebp - 0x131]
mov byte [ebp - 4], 0xe
or eax, 0xffffffff
mov edx, dword [ebp - 0x130]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100522b9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x100524ed
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x100522b9
push dword [esi - 0xc]
mov ecx, ebx
push esi
call fcn.10016cf0
jmp 0x1005235f
cmp byte [ebp - 0x131], 0
je 0x10052336
cmp dword [esi - 0xc], 0
je 0x100522f2
mov eax, dword [ebx]
test eax, eax
je 0x100524f4
push eax
push esi
call fcn.100a62ba
add esp, 8
test eax, eax
je 0x100522f2
push ecx
push esi
push str.m2_old
lea ecx, [ebp - 0x160]
call fcn.10010630
mov edx, dword [ebx]
mov edi, dword [ebp - 0x160]
test edx, edx
je 0x1005232b
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10052303
sub ecx, ebx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push 0x100e6eec
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [ebp - 4], 9
test edi, edi
je 0x10052355
push edi
jmp 0x10052345
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x10052355
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 0
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x148]
mov dword [ebp - 0x130], eax
mov byte [ebp - 4], 0x12
or ebx, 0xffffffff
mov ecx, dword [ebp - 0x148]
mov eax, ebx
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100523ac
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x100524fe
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x130], eax
mov byte [ebp - 4], 0x11
mov eax, ebx
mov ecx, dword [ebp - 0x14c]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100523f6
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x10052507
mov eax, dword [edx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 1
lea eax, [ebp - 0x150]
mov dword [ebp - 0x130], eax
mov byte [ebp - 4], 1
mov eax, ebx
mov ecx, dword [ebp - 0x150]
add ecx, 0xfffffff0
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x10052444
mov edx, dword [ecx]
push ecx
mov eax, dword [edx]
mov edi, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x10052510
mov eax, dword [edx + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [eax + 4]
call ebx
jmp 0x1005244a
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1005247e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x10052519
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call ebx
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10071699
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10010ca0
call edx
jmp 0x10051ee6
push 0x80004005
call fcn.10010ca0
call edx
jmp 0x1005205c
push 0x80004005
call fcn.10010ca0
call edx
jmp 0x1005209b
push 0x80004005
call fcn.10010ca0
call edx
jmp 0x100520da
push 0x80004005
call fcn.10010ca0
call edi
jmp 0x100522b9
push 0x80004005
call fcn.10010ca0
mov ecx, edx
call edi
jmp 0x100523ac
mov ecx, edx
call edi
jmp 0x100523f6
mov ecx, edx
call edi
jmp 0x10052444
call edx
jmp 0x1005247e