Function at 0x1000aebb
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1108]
mov eax, 0x1108
call fcn.1001f710
push 0xffffffffffffffff
push 0x1002c05d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1003a0a0]
xor eax, ebp
mov dword [ebp + 0x1104], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 0x1114]
mov ebx, dword [ebp + 0x1110]
and dword [ebp - 0x18], 0
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x104]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ebx
call fcn.1000b4bd
test eax, eax
jl 0x1000b2dc
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x104]
push eax
call fcn.1000adf7
pop ecx
pop ecx
test eax, eax
jne 0x1000af4e
mov eax, 0x80020009
jmp 0x1000b2dc
call fcn.1000bb98
lea eax, [ebp + 0x104]
mov ecx, esi
call fcn.1000b4bd
test eax, eax
jl 0x1000b2dc
movzx eax, word [ebp - 0x18]
sub eax, 8
je 0x1000b297
sub eax, 9
je 0x1000b187
dec eax
dec eax
je 0x1000b088
sub eax, 0x3ff5
jne 0x1000b2cc
lea eax, [ebp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
and dword [ebp], 0
inc eax
inc eax
and dword [ebp - 4], 0
push eax
mov byte [ebp - 4], 1
call fcn.1000aea1
pop ecx
cmp eax, 0x100
jbe 0x1000affe
push eax
lea eax, [ebp]
push eax
call fcn.1000a939
mov edi, dword [ebp]
test edi, edi
je 0x1000b06c
cmp byte [ebp + 0x104], 0
lea esi, [ebp + 0x104]
je 0x1000b02d
mov ebx, dword [sym.imp.USER32.dll_CharNextA]
push esi
call ebx
mov cl, byte [esi]
cmp cl, 0x5c
jne 0x1000b00c
cmp byte [eax], 0x30
jne 0x1000b00c
mov byte [edi], 0
push eax
inc edi
call ebx
mov esi, eax
jmp 0x1000b028
lea eax, [ebp + 4]
mov dword [ebp], eax
jmp 0x1000afc4
mov byte [edi], cl
movzx eax, byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
test eax, eax
je 0x1000b026
inc edi
inc esi
mov al, byte [esi]
test al, al
je 0x1000b02d
mov byte [edi], al
inc edi
inc esi
cmp byte [esi], 0
jne 0x1000afe4
mov byte [edi], 0
mov byte [edi + 1], 0
mov edi, dword [ebp]
mov ebx, edi
test edi, edi
jne 0x1000b041
push 0xd
jmp 0x1000b06e
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add edi, eax
add esi, eax
cmp eax, 1
jne 0x1000b043
mov eax, dword [ebp - 0x20]
push esi
push ebx
push 7
push 0
push dword [ebp - 0x24]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
jmp 0x1000b06f
push 0xe
pop esi
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x1000b2bc
lea eax, [ebp]
call fcn.1000ae8b
jmp 0x1000b2bc
xor ebx, ebx
mov dword [ebp - 0x14], ebx
lea eax, [ebp + 0x104]
push eax
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
inc edi
push ebx
mov eax, edi
cdq
push 2
push edx
push eax
mov dword [ebp - 0x18], edi
call fcn.10026c50
cmp edx, ebx
jg 0x1000b0d2
jl 0x1000b0c1
cmp eax, 0x7fffffff
ja 0x1000b0d2
push edx
push eax
lea ecx, [ebp - 0x18]
call fcn.10012205
mov edi, dword [ebp - 0x18]
pop ecx
pop ecx
jmp 0x1000b0d7
mov eax, 0x80070057
cmp eax, ebx
jl 0x1000b17d
cmp edi, 0x400
jg 0x1000b100
push edi
call fcn.10012257
pop ecx
test al, al
je 0x1000b100
mov eax, edi
call fcn.100278d0
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1000b10d
mov eax, edi
lea esi, [ebp - 0x14]
call fcn.100122c3
mov ebx, dword [ebp - 0x14]
push 3
shr edi, 1
push edi
lea ecx, [ebp + 0x104]
push ecx
mov esi, eax
call fcn.1001113d
test eax, eax
je 0x1000b179
lea ecx, [ebp - 0x1c]
push ecx
xor edi, edi
push edi
push edi
push eax
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [ebp - 0x1c]
push 4
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
push 4
push edi
push dword [ebp - 0x24]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
cmp ebx, edi
je 0x1000b2bc
mov eax, ebx
mov ebx, dword [ebx]
push eax
call fcn.1001881d
pop ecx
test ebx, ebx
jne 0x1000b15a
jmp 0x1000b2bc
mov eax, ebx
mov ebx, dword [ebx]
push eax
call fcn.1001881d
pop ecx
test ebx, ebx
jne 0x1000b16e
mov eax, 0x8007000e
jmp 0x1000b2dc
lea eax, [ebp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x14], eax
test al, 1
je 0x1000b1a5
mov eax, 0x80004005
jmp 0x1000b2dc
and dword [ebp], 0
cdq
sub eax, edx
mov edi, eax
sar edi, 1
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 4
push edi
mov byte [ebp - 4], 5
call fcn.1000aea1
pop ecx
cmp eax, 0x100
jbe 0x1000b1d8
push eax
lea eax, [ebp]
push eax
call fcn.1000a939
jmp 0x1000b1e9
lea eax, [ebp + 4]
mov dword [ebp], eax
jmp 0x1000b1e9
xor esi, esi
cmp dword [ebp], esi
jne 0x1000b201
lea eax, [ebp + 4]
test eax, eax
je 0x1000b19b
lea eax, [ebp]
call fcn.1000ae8b
jmp 0x1000b19b
push edi
push esi
push dword [ebp]
call fcn.10016180
add esp, 0xc
cmp dword [ebp - 0x14], esi
jle 0x1000b26c
mov cl, byte [ebp + esi + 0x104]
mov eax, esi
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp]
cmp cl, 0x30
jl 0x1000b253
cmp cl, 0x39
jle 0x1000b24c
cmp cl, 0x40
jle 0x1000b253
cmp cl, 0x46
jle 0x1000b247
cmp cl, 0x60
jle 0x1000b253
cmp cl, 0x66
jg 0x1000b253
sub cl, 0x57
jmp 0x1000b24f
sub cl, 0x37
jmp 0x1000b24f
sub cl, 0x30
mov dl, cl
jmp 0x1000b255
xor dl, dl
mov ebx, esi
and ebx, 1
shl ebx, 2
push 4
pop ecx
sub ecx, ebx
shl dl, cl
or byte [eax], dl
inc esi
cmp esi, dword [ebp - 0x14]
jl 0x1000b213
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
push edi
push dword [ebp]
push 3
push 0
push dword [ebp - 0x24]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
lea eax, [ebp + 4]
cmp dword [ebp], eax
je 0x1000b2bc
lea eax, [ebp]
call fcn.1000ae8b
jmp 0x1000b2bc
lea eax, [ebp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp + 0x104]
push eax
push 1
push 0
push ebx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
test esi, esi
je 0x1000b2c9
mov eax, esi
call fcn.1000b4ae
jmp 0x1000b2dc
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov ecx, esi
call fcn.1000b4bd
test eax, eax
jl 0x1000b2dc
xor eax, eax
lea esp, [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1104]
xor ecx, ebp
call fcn.10016165
add ebp, 0x1108
leave
ret 8