Function at 0x1000c4c0
Capabilities:
Set registry value

Disassembly:
push 0x24
mov eax, 0x10028b2f
call fcn.1002850f
mov ebx, ecx
mov dword [ebp - 0x28], ebx
xor eax, eax
mov esi, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x30], esi
push 0x2000
mov dword [ebp - 4], eax
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
test edi, edi
jne 0x1000c500
mov ebx, 0x8007000e
jmp 0x1000c85e
push edi
mov ecx, ebx
call fcn.1000cd8a
mov ebx, eax
test ebx, ebx
jns 0x1000c51a
push edi
call dword [sym.imp.msvcrt.dll_free]
jmp 0x1000c85d
xor eax, eax
mov ebx, eax
push dword [ebx*8 + 0x10001888]
push edi
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcmpiW]
test eax, eax
je 0x1000c547
inc ebx
cmp ebx, 3
jb 0x1000c51e
push edi
call dword [sym.imp.msvcrt.dll_free]
mov ebx, 0x80020009
jmp 0x1000c85d
movzx eax, word [ebx*8 + 0x1000188c]
push 0x2000
mov dword [ebp - 0x24], eax
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
jne 0x1000c577
push dword [ebp - 0x1c]
call dword [sym.imp.msvcrt.dll_free]
mov ebx, 0x8007000e
jmp 0x1000c85d
mov ecx, dword [ebp - 0x28]
call fcn.1000d5a7
mov ecx, dword [ebp - 0x28]
push edi
call fcn.1000cd8a
mov ebx, eax
test ebx, ebx
jns 0x1000c5a3
push edi
call dword [sym.imp.msvcrt.dll_free]
push dword [ebp - 0x1c]
call dword [sym.imp.msvcrt.dll_free]
jmp 0x1000c85c
mov eax, dword [ebp - 0x24]
xor ebx, ebx
movzx eax, ax
mov dword [ebp - 0x2c], ebx
sub eax, 8
je 0x1000c6c5
sub eax, 9
je 0x1000c5e7
dec eax
sub eax, 1
jne 0x1000c837
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push edi
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [ebp - 0x2c]
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 4
push ebx
jmp 0x1000c6b2
mov ebx, edi
xor edx, edx
lea ecx, [ebx + 2]
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x1000c5ee
sub ebx, ecx
sar ebx, 1
test bl, 1
jne 0x1000c640
mov eax, ebx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x20], eax
cmp eax, 0x400
ja 0x1000c62a
mov ecx, eax
call fcn.1000c95d
test al, al
mov eax, dword [ebp - 0x20]
je 0x1000c62a
call fcn.10028670
mov eax, esp
jmp 0x1000c639
push eax
lea ecx, [ebp - 0x30]
call fcn.1000c9c6
mov esi, dword [ebp - 0x30]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x1000c65a
push edi
call dword [sym.imp.msvcrt.dll_free]
push dword [ebp - 0x1c]
call dword [sym.imp.msvcrt.dll_free]
mov ebx, 0x80004005
jmp 0x1000c85c
push dword [ebp - 0x20]
xor ecx, ecx
push ecx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
add esp, 0xc
mov dword [ebp - 0x14], eax
test ebx, ebx
jle 0x1000c6a7
mov esi, dword [ebp - 0x24]
mov cx, word [edi + eax*2]
call fcn.1000c43a
movzx edx, al
mov eax, dword [ebp - 0x14]
and eax, 1
shl eax, 2
push 4
pop ecx
sub ecx, eax
mov eax, dword [ebp - 0x14]
shl edx, cl
mov ecx, dword [ebp - 0x14]
shr ecx, 1
or byte [ecx + esi], dl
inc eax
mov dword [ebp - 0x14], eax
cmp eax, ebx
jl 0x1000c675
mov esi, dword [ebp - 0x18]
push dword [ebp - 0x20]
xor eax, eax
push dword [ebp - 0x24]
push 3
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
jmp 0x1000c837
mov edx, edi
cmp byte [ebp + 0x14], bl
je 0x1000c7f6
mov ecx, edi
xor ebx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1000c6d7
sub ecx, edx
sar ecx, 1
cmp ecx, 0xffe
jg 0x1000c640
push 0x2000
call dword [sym.imp.msvcrt.dll_malloc]
mov dword [ebp - 0x14], eax
pop ecx
test eax, eax
jne 0x1000c71f
push edi
call dword [sym.imp.msvcrt.dll_free]
push dword [ebp - 0x1c]
call dword [sym.imp.msvcrt.dll_free]
mov ebx, 0x8007000e
jmp 0x1000c85c
mov dword [ebp - 0x24], ebx
mov ecx, dword [ebp - 0x28]
mov byte [ebp - 4], 8
push 0x10005508
mov ecx, dword [ecx + 4]
call fcn.1000c317
mov ebx, eax
test ebx, ebx
je 0x1000c7ec
mov edx, ebx
mov ecx, edi
call fcn.1000c38c
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1000c7ec
cmp eax, dword [ebp + 0x10]
je 0x1000c76e
push eax
push edi
call dword [sym.imp.api_ms_win_core_string_l2_1_0.dll_CharPrevW]
cmp word [eax], 0x22
je 0x1000c7ec
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
sub eax, edi
sar eax, 1
xor edx, edx
push eax
push edi
push ecx
mov word [ecx], dx
call dword [sym.imp.api_ms_win_core_string_obsolete_l1_1_0.dll_lstrcpynW]
push 0x10005518
push 0x1000
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll_wcscat_s]
push ebx
push 0x1000
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll_wcscat_s]
push 0x10005518
push 0x1000
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll_wcscat_s]
add esp, 0x24
lea ecx, [ebx + 2]
xor edx, edx
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x1000c7c0
mov eax, dword [ebp - 0x18]
sub ebx, ecx
sar ebx, 1
lea eax, [eax + ebx*2]
mov ebx, dword [ebp - 0x14]
push eax
push 0x1000
push ebx
call dword [sym.imp.msvcrt.dll_wcscat_s]
add esp, 0xc
mov edx, ebx
jmp 0x1000c7f1
mov ebx, dword [ebp - 0x14]
mov edx, edi
xor eax, eax
mov byte [ebp - 4], al
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x18], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x20]
jne 0x1000c7fe
sub ecx, dword [ebp - 0x18]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
xor eax, eax
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
test ebx, ebx
je 0x1000c837
push ebx
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x28]
call fcn.1000cd8a
push edi
mov ebx, eax
call dword [sym.imp.msvcrt.dll_free]
push dword [ebp - 0x1c]
call dword [sym.imp.msvcrt.dll_free]
test ebx, ebx
js 0x1000c85c
xor eax, eax
mov ebx, eax
pop ecx
pop ecx
mov dword [ebp - 4], 0xf
test esi, esi
je 0x1000c879
mov edi, dword [esi]
push esi
mov esi, edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
test edi, edi
jne 0x1000c869
mov eax, ebx
lea esp, [ebp - 0x40]
call fcn.100284c1
ret 0x10