Function at 0x10013060
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push ebx
push ebp
mov ebp, dword [esp + 0x20]
xor eax, eax
push ebp
push 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], eax
or ebx, 0xffffffff
mov dword [esp + 0x1c], eax
call fcn.10012ea0
add esp, 8
test al, al
je 0x100132b1
push edi
push 1
lea eax, [esp + 0x14]
lea edi, [esp + 0x18]
call fcn.10012d80
add esp, 4
test al, al
je 0x100132b0
mov edx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
shr esi, 2
cmp byte [esp + 0x2c], 0
je 0x1001312e
test edx, edx
je 0x10013111
lea eax, [ebx + 2]
cmp esi, eax
jbe 0x10013111
mov ecx, dword [esp + 0x18]
mov edi, edi
cmp dword [ecx + eax*4], edx
je 0x100130de
add eax, 1
cmp eax, esi
jb 0x100130d0
jmp 0x10013115
cmp eax, 0xffffffff
je 0x10013115
lea ecx, [ecx + eax*4]
sub esi, eax
lea eax, [esi*4 - 4]
push eax
lea edx, [ecx + 4]
push edx
push ecx
call fcn.100082d0
sub dword [esp + 0x20], 4
push 0
lea eax, [esp + 0x24]
lea edi, [esp + 0x28]
call fcn.10012d80
add esp, 0x10
mov ecx, dword [esp + 0x18]
test ecx, ecx
je 0x100132af
push ecx
call fcn.10007a21
add esp, 4
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x14
ret
test edx, edx
mov edi, dword [esp + 0x18]
jne 0x10013168
mov eax, 1
cmp esi, eax
jbe 0x10013155
nop
mov ecx, dword [edi + eax*4]
cmp ecx, edx
jb 0x1001314e
lea edx, [ecx + 1]
mov dword [esp + 0x10], edx
add eax, 1
cmp eax, esi
jb 0x10013140
push ebp
push 0
lea ecx, [esp + 0x18]
call fcn.10012ea0
mov edx, dword [esp + 0x18]
add esp, 8
mov eax, 1
cmp esi, eax
jbe 0x1001317d
cmp dword [edi + eax*4], edx
je 0x100131ce
add eax, 1
cmp eax, esi
jb 0x10013171
mov ebp, ebx
push 0x1001ad30
push 1
lea ecx, [esp + 0x24]
call fcn.10012ea0
add esp, 8
test al, al
jne 0x100131a9
push str.Tcpip
push 1
lea ecx, [esp + 0x24]
call fcn.10012ea0
add esp, 8
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jbe 0x100131d4
mov eax, 1
cmp esi, eax
jbe 0x100131d4
lea ebx, [ebx]
cmp dword [edi + eax*4], ecx
je 0x100131d2
add eax, 1
cmp eax, esi
jb 0x100131c0
jmp 0x100131d4
mov ebp, eax
jmp 0x1001317f
mov ebx, eax
cmp ebp, 0xffffffff
je 0x10013215
cmp ebx, 0xffffffff
je 0x1001324b
cmp ebx, ebp
jae 0x100132a2
mov eax, ebp
sub eax, ebx
cmp eax, 1
jbe 0x100132a2
lea eax, [eax*4 - 4]
push eax
lea esi, [edi + ebx*4 + 4]
lea ecx, [edi + ebx*4 + 8]
push esi
push ecx
call fcn.100082d0
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov dword [esi], edx
jmp 0x1001324b
cmp ebx, 0xffffffff
je 0x1001323f
sub esi, ebx
lea eax, [esi*4 - 4]
push eax
lea ebp, [edi + ebx*4 + 4]
lea ecx, [edi + ebx*4 + 8]
push ebp
push ecx
call fcn.100082d0
mov edx, dword [esp + 0x1c]
add esp, 0xc
mov dword [ebp], edx
jmp 0x10013246
mov eax, dword [esp + 0x10]
mov dword [edi + esi*4], eax
add dword [esp + 0x14], 4
lea ecx, [esp + 0x20]
push ecx
push 3
push 0
push str.SYSTEMCurrentControlSetControlGroupOrderList
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100132a2
mov eax, dword [esp + 0x14]
cmp eax, 4
jbe 0x10013279
shr eax, 2
sub eax, 1
jmp 0x1001327b
xor eax, eax
mov dword [edi], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
push edx
push edi
push 3
push 0
push str.PNP_TDI
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x100132af
push edi
call fcn.10007a21
add esp, 4
pop esi
pop edi
pop ebp
pop ebx
add esp, 0x14
ret