Function at 0x1c8b6
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x49c
mov eax, dword [0x294d0]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00017aca
test al, al
jne 0x1c8de
mov eax, 0xc0000001
jmp 0x1ce08
push ebx
push edi
xor eax, eax
mov word [ebp - 0x424], ax
lea edi, [ebp - 0x422]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor ebx, ebx
mov eax, 0x200
push 0x3ff
mov word [ebp - 0x422], ax
lea eax, [ebp - 0x403]
push ebx
push eax
mov dword [ebp - 0x410], ebx
mov dword [ebp - 0x408], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 0x404], bl
call sub.ntoskrnl.exe_memset
lea eax, [ebp - 0x404]
add esp, 0xc
mov dword [ebp - 0x420], eax
xor eax, eax
movzx ecx, word [eax + 0x2312c]
mov word [ebp + eax - 0x404], cx
inc eax
inc eax
cmp cx, bx
jne 0x1c93b
push esi
call fcn.0001212e
mov esi, eax
call fcn.0001213a
mov ecx, dword [ebp - 0x420]
lea edi, [ecx + eax*2]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov eax, dword [ebp - 0x420]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x1c973
sub eax, ecx
push 0x1c
sar eax, 1
add eax, eax
mov word [ebp - 0x424], ax
pop eax
push 0x1e
mov word [ebp - 0x454], ax
pop eax
push 0x14
mov word [ebp - 0x452], ax
pop eax
push 0x16
mov word [ebp - 0x45c], ax
pop eax
mov word [ebp - 0x45a], ax
push 0x18
pop edi
lea eax, [ebp - 0x424]
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x43c]
push eax
mov esi, 0xf003f
push esi
lea eax, [ebp - 0x410]
push eax
mov dword [ebp - 0x450], 0x25434
mov dword [ebp - 0x458], 0x24ff0
mov dword [ebp - 0x43c], edi
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x430], 0x240
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x428], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jge 0x1ca1f
mov eax, 0xc0000001
jmp 0x1ce05
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x454]
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x41c]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x43c]
push eax
push esi
lea eax, [ebp - 0x408]
push eax
mov dword [ebp - 0x43c], edi
mov dword [ebp - 0x430], 0x240
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
mov esi, eax
cmp esi, ebx
jge 0x1ca91
push dword [ebp - 0x410]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov eax, esi
jmp 0x1ce05
mov esi, dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push 0x12
pop eax
push 0x14
mov word [ebp - 0x48c], ax
pop eax
push 0x5a
push 0x24f94
push 2
mov word [ebp - 0x48a], ax
push ebx
lea eax, [ebp - 0x48c]
push eax
push dword [ebp - 0x408]
mov dword [ebp - 0x488], 0x22900
call esi
cmp eax, ebx
mov dword [ebp - 0x40c], eax
jl 0x1cd4a
push 0x1a
mov eax, edi
mov word [ebp - 0x49c], ax
pop eax
push 4
mov word [ebp - 0x49a], ax
lea eax, [ebp - 0x414]
push eax
push 4
push ebx
lea eax, [ebp - 0x49c]
push eax
push dword [ebp - 0x408]
mov dword [ebp - 0x498], 0x230fc
mov dword [ebp - 0x414], 1
call esi
cmp eax, ebx
mov dword [ebp - 0x40c], eax
jl 0x1cd4a
push 0xa
pop eax
push 0xc
mov word [ebp - 0x444], ax
pop eax
push 4
mov word [ebp - 0x442], ax
lea eax, [ebp - 0x414]
push eax
push 4
push ebx
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0x408]
mov dword [ebp - 0x440], 0x230ce
mov dword [ebp - 0x414], 2
call esi
cmp eax, ebx
mov dword [ebp - 0x40c], eax
jl 0x1cd4a
push 8
pop eax
push 0xa
mov word [ebp - 0x494], ax
pop eax
push 4
mov word [ebp - 0x492], ax
lea eax, [ebp - 0x414]
push eax
push 4
push ebx
lea eax, [ebp - 0x494]
push eax
push dword [ebp - 0x408]
mov dword [ebp - 0x490], 0x230f2
mov dword [ebp - 0x414], 0x20
call esi
cmp eax, ebx
mov dword [ebp - 0x40c], eax
jl 0x1cd4a
push 0x20
pop eax
push 0x22
mov word [ebp - 0x464], ax
pop eax
push 4
mov word [ebp - 0x462], ax
lea eax, [ebp - 0x414]
push eax
push 4
push ebx
lea eax, [ebp - 0x464]
push eax
push dword [ebp - 0x408]
mov dword [ebp - 0x460], 0x24f72
mov dword [ebp - 0x414], ebx
call esi
cmp eax, ebx
mov dword [ebp - 0x40c], eax
jl 0x1cd4a
push 0x14
pop eax
push 0x16
mov word [ebp - 0x484], ax
pop eax
push edi
push 0x24f58
push 1
mov word [ebp - 0x482], ax
push ebx
lea eax, [ebp - 0x484]
push eax
push dword [ebp - 0x408]
mov dword [ebp - 0x480], 0x24f42
call esi
cmp eax, ebx
mov dword [ebp - 0x40c], eax
jl 0x1cd4a
push 0x16
pop eax
push 0x48
push 0x253ea
mov word [ebp - 0x474], ax
push 1
mov eax, edi
mov word [ebp - 0x472], ax
push ebx
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0x408]
mov dword [ebp - 0x470], 0x230da
call esi
cmp eax, ebx
mov dword [ebp - 0x40c], eax
jl 0x1cd4a
push 0x16
pop eax
push 0x1a
push 0x253ce
mov word [ebp - 0x44c], ax
push 1
mov eax, edi
mov word [ebp - 0x44a], ax
push ebx
lea eax, [ebp - 0x44c]
push eax
push dword [ebp - 0x408]
mov dword [ebp - 0x448], 0x24eae
call esi
cmp eax, ebx
mov dword [ebp - 0x40c], eax
jl 0x1cd4a
mov eax, dword [ebp - 0x408]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x45c]
mov dword [ebp - 0x434], eax
lea eax, [ebp - 0x41c]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x43c]
push eax
push 0xf003f
lea eax, [ebp - 0x418]
push eax
mov dword [ebp - 0x43c], edi
mov dword [ebp - 0x430], 0x240
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
cmp eax, ebx
mov dword [ebp - 0x40c], eax
jge 0x1cd6b
push dword [ebp - 0x408]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwClose]
call esi
push dword [ebp - 0x410]
call esi
mov eax, dword [ebp - 0x40c]
jmp 0x1ce05
push 0x16
pop eax
push 6
push 0x24ea6
push 1
mov word [ebp - 0x46c], ax
push ebx
lea eax, [ebp - 0x46c]
push eax
push dword [ebp - 0x418]
mov word [ebp - 0x46a], di
mov dword [ebp - 0x468], 0x24e8e
call esi
mov edi, eax
cmp edi, ebx
jl 0x1cde5
push 0x14
pop eax
push 0x16
mov word [ebp - 0x47c], ax
pop eax
mov word [ebp - 0x47a], ax
movzx eax, word [0x186d370]
push eax
push dword [0x186d374]
lea eax, [ebp - 0x47c]
push 2
push ebx
push eax
push dword [ebp - 0x418]
mov dword [ebp - 0x478], 0x24e78
call esi
mov edi, eax
push dword [ebp - 0x418]
mov esi, dword [sym.imp.ntoskrnl.exe_ZwClose]
call esi
push dword [ebp - 0x408]
call esi
push dword [ebp - 0x410]
call esi
mov eax, edi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.000223b6
leave
ret