Function at 0x10002190
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x123]
mov byte [ebp - 0x124], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x20], ebx
stosb byte es:[edi], al
jp 0x100021c3
push cx
mov cl, 0x21
pop cx
jnp 0x100021c3
push edx
push edi
sub dx, dx
cmp edx, ecx
cmp dx, ax
test edx, 0x4d5b
sub di, 0x50f1
mov di, 0x11cb
and di, ax
pop edi
pop edx
mov edi, 0x100062d8
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x124]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jle 0x10002217
mov si, si
mov si, si
jg 0x10002217
fsub qword [ebp + 0x7d8b92c9]
or al, 0x83
leave
push dword [ebx]
ror byte [ebp - 0x1236b], 0xff
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x124]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
push edi
test edi, 0x6e34
dec ax
dec ah
or eax, ecx
xor al, dh
or eax, 0x24ad
cmp ax, cx
test eax, eax
dec ah
and di, di
pop edi
pop eax
lea eax, [ebp - 4]
lea ecx, [ebp - 0x124]
push eax
push 3
push ebx
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100022e8
jo 0x100022a6
push cx
mov ch, 0xe0
pop cx
jno 0x100022a6
mov esp, 0x1e26fa6d
invalid
lea edx, [ebp - 4]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x124]
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x100022e8
push di
push eax
push ecx
test dl, cl
and di, 0x377
cmp ecx, 0x5354
pop ecx
pop eax
pop di
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
js 0x100022fd
xchg cx, cx
mov edi, edi
mov edx, edx
jns 0x100022fd
adc eax, 0x6649512f
and ecx, edi
push ecx
dec ecx
and cx, di
or cx, 0x61be
pop ecx
mov ecx, dword [ebp + 8]
mov edi, dword [ebp + 0x14]
mov edx, dword [ecx]
xor edx, edi
mov dword [ebp - 8], edx
js 0x10002323
jns 0x10002323
add eax, 0x8b104d8b
push ebp
cld
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
lea eax, [ebp - 8]
push 4
push eax
push 4
push ebx
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100024cb
pushal
test bx, 0xa43
cmp ch, 0x6e
sub ch, bl
cmp dx, 0x7a98
sub ecx, edx
popal
mov eax, dword [ebp + 8]
mov cx, word [eax + 4]
xor cx, word [ebp + 0x1c]
mov word [ebp - 0x14], cx
push bx
push si
push edi
or edi, 0x3f3c
and si, cx
pop edi
pop si
pop bx
mov dx, word [eax + 6]
xor dx, word [ebp + 0x1e]
mov word [ebp - 0x12], dx
pushal
and bl, ah
inc dl
sub ch, ah
test ax, 0x1e59
popal
mov esi, dword [ebp + 8]
mov ax, word [esi + 8]
xor ax, word [ebp + 0x20]
mov word [ebp - 0x10], ax
push ecx
push dx
xor ch, ah
or cl, dl
sub dl, 0x3f
inc ch
test esi, ecx
test ch, 0x27
pop dx
pop ecx
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp - 4]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [ebp - 0x14]
push 6
push ecx
push 3
push 0
push edx
push eax
call edi
test eax, eax
jne 0x100024cb
push ebx
push cx
test dx, cx
test bl, ch
test cl, 0x43
and ch, bh
or cl, bl
and cx, di
pop cx
pop ebx
mov cx, word [esi + 0xa]
xor cx, word [ebp + 0x28]
mov word [ebp - 0x1c], cx
jbe 0x10002405
mov dx, dx
mov esi, esi
ja 0x10002405
sub ch, byte [ebx]
cmp byte [edx - 0xb], dl
sub dword [edi + 0x66], esp
mov edx, dword [esi + 0xc]
mov dx, word [esi + 0xc]
xor dx, word [ebp + 0x2a]
mov word [ebp - 0x1a], dx
jbe 0x10002428
push eax
pop eax
ja 0x10002428
pop esi
fisubr dword [ecx + 0x7a96ed64]
dec esp
in eax, dx
xchg esi, eax
jp 0x1000244d
dec esp
mov ax, word [esi + 0xe]
xor ax, word [ebp + 0x2c]
mov word [ebp - 0x18], ax
jb 0x1000244d
mov di, di
nop
nop
nop
jae 0x1000244d
loope 0x10002423
lodsd eax, dword [esi]
mov dword [edi], esi
cdq
mov eax, dword [0x9750e2b5]
mov esi, 0x8bb8ec44
push ebp
and al, 0x8b
inc ebp
cld
mov edx, dword [ebp + 0x24]
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x1c]
push 6
push ecx
push 3
push 0
push edx
push eax
call edi
test eax, eax
jne 0x100024cb
push eax
push dx
and al, bh
xor dl, al
or dh, dh
xor ah, 0x62
sub eax, 0x3488
and eax, 0x7ee5
dec dh
add eax, eax
pop dx
pop eax
mov ecx, dword [esi + 0x10]
mov edx, dword [ebp + 0x34]
xor ecx, edx
mov dword [ebp - 0xc], ecx
pushal
mov eax, eax
mov cx, 0xebe
popal
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp - 4]
lea edx, [ebp - 0xc]
push 4
push edx
push 4
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100024cb
mov dword [ebp - 0x20], 1
pushal
test bx, 0xa43
cmp ch, 0x6e
sub ch, bl
cmp dx, 0x7a98
sub ecx, edx
popal
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret