Function at 0x1000591c
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x524
mov eax, dword [0x10013010]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, 0x10001f5c
push edi
call fcn.10006a49
pop ecx
call fcn.1000654e
test eax, eax
jne 0x1000596c
push 0x10001794
push eax
push eax
push edi
push 0x43c
push 0x10001270
call fcn.10006b9b
add esp, 0x18
xor eax, eax
jmp 0x10005e09
push ebx
xor ebx, ebx
cmp dword [0x10013f04], ebx
jne 0x1000598f
call fcn.10005191
test eax, eax
jne 0x1000598f
push 0x10001cd0
push ebx
push ebx
push edi
push 0x444
jmp 0x100059ec
cmp esi, ebx
jne 0x100059a2
push 0x10001f30
push ebx
push ebx
push edi
push 0x44b
jmp 0x100059ec
push esi
call fcn.10004e22
test eax, eax
je 0x10005a47
mov eax, dword [0x10013f30]
cmp eax, ebx
jne 0x100059c8
push 0x10001ef8
push ebx
push ebx
push edi
push 0x458
jmp 0x100059ec
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push 0x7d0
call eax
test eax, eax
jne 0x100059fb
push 0x10001ed8
push ebx
push ebx
push edi
push 0x45e
push 0x10001270
call fcn.10006b9b
add esp, 0x18
jmp 0x10005a47
push dword [esi + 8]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
call ebx
lea ecx, [ebp - 0x20c]
push ecx
mov dword [ebp - 0x520], eax
call ebx
mov ecx, dword [ebp - 0x520]
push dword [esi + 8]
lea ecx, [ecx + eax - 1]
mov eax, 0x104
cmp ecx, eax
jle 0x10005a4e
push 0x10001eb4
push 0
push 0
push edi
push 0x463
push 0x10001270
call fcn.10006b9b
add esp, 0x1c
xor eax, eax
jmp 0x10005e08
lea ecx, [ebp - 0x20c]
push ecx
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.100050d5
add esp, 0x10
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x51c]
push eax
xor ebx, ebx
push ebx
push 2
push ebx
push ebx
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
je 0x10005aa3
push ebx
push eax
push 0x10001ea0
push edi
push 0x473
jmp 0x10005d83
push 0x104
lea eax, [ebp - 0x518]
push eax
push dword [esi + 0xc]
call dword [sym.imp.ole32.dll_StringFromGUID2]
push ebx
push ebx
cmp eax, ebx
jne 0x10005ace
push 0x10001710
push edi
push 0x47d
jmp 0x10005d83
push 0x104
lea ecx, [ebp - 0x310]
push ecx
push eax
lea eax, [ebp - 0x518]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x10005b0a
push 0x100016e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100016c8
push edi
push 0x486
jmp 0x10005d83
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x7d1
call dword [0x10013f30]
test eax, eax
jne 0x10005b37
push 0x10001ed8
push ebx
push ebx
push edi
push 0x48c
jmp 0x10005d83
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x310]
push eax
push 1
push ebx
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x10005b79
push ebx
push eax
push 0x10001e8c
push edi
push 0x499
jmp 0x10005d83
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x7d2
call dword [0x10013f30]
test eax, eax
jne 0x10005ba6
push 0x10001ed8
push ebx
push ebx
push edi
push 0x4a2
jmp 0x10005d83
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esi + 0x10]
lea eax, [ebp - 0x108]
push 1
push ebx
push eax
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x10005be0
push ebx
push eax
push 0x10001e8c
push edi
push 0x4af
jmp 0x10005d83
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x7d3
call dword [0x10013f30]
test eax, eax
jne 0x10005c0d
push 0x10001ed8
push ebx
push ebx
push edi
push 0x4b8
jmp 0x10005d83
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esi + 0x14]
lea eax, [ebp - 0x108]
push 1
push ebx
push eax
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x10005c47
push ebx
push eax
push 0x10001e8c
push edi
push 0x4c5
jmp 0x10005d83
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x7d5
call dword [0x10013f30]
test eax, eax
jne 0x10005c74
push 0x10001ed8
push ebx
push ebx
push edi
push 0x4ce
jmp 0x10005d83
push dword [esi + 0x18]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esi + 0x18]
lea eax, [ebp - 0x108]
push 1
push ebx
push eax
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x10005cae
push ebx
push eax
push 0x10001e8c
push edi
push 0x4db
jmp 0x10005d83
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x7d4
call dword [0x10013f30]
test eax, eax
jne 0x10005cdb
push 0x10001ed8
push ebx
push ebx
push edi
push 0x4e4
jmp 0x10005d83
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esi + 0x1c]
lea eax, [ebp - 0x108]
push 1
push ebx
push eax
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x10005d12
push ebx
push eax
push 0x10001e78
push edi
push 0x4f1
jmp 0x10005d83
cmp dword [esi], 4
jne 0x10005dd0
cmp dword [esi + 0x20], ebx
je 0x10005dd0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0x7d6
call dword [0x10013f30]
test eax, eax
jne 0x10005d4e
push 0x10001ed8
push ebx
push ebx
push edi
push 0x4fc
jmp 0x10005d83
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esi + 0x20]
lea eax, [ebp - 0x108]
push 1
push ebx
push eax
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x10005dd0
push ebx
push eax
push 0x10001e8c
push edi
push 0x509
push 0x10001270
call fcn.10006b9b
add esp, 0x18
cmp dword [ebp - 0x51c], ebx
je 0x10005dc2
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x10005dc2
push ebx
push eax
push 0x10001e60
push edi
push 0x518
push 0x10001270
call fcn.10006b9b
add esp, 0x18
push 0x10001e3c
call fcn.10006a49
xor eax, eax
jmp 0x10005e07
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x10005dfa
push ebx
push eax
push 0x100012e8
push edi
push 0x50f
push 0x10001270
call fcn.10006b9b
add esp, 0x18
push 0x10001e14
call fcn.10006a49
xor eax, eax
inc eax
pop ecx
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100072a1
leave
ret 8