Function at 0x10beb40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x113c6f2
mov eax, dword fs:[0]
push eax
sub esp, 0x13c
mov eax, dword [0x115f604]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor esi, esi
push esi
push 0x1018dc4
lea ecx, [ebp - 0x120]
push ecx
push 0x1018d48
lea edx, [ebp - 0x11c]
push 2
push edx
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x120], esi
call fcn.01075110
add esp, 0x18
mov dword [ebp - 4], esi
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x144], 0x1015ae4
mov dword [ebp - 0x13c], esi
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
mov ecx, 0x1161d94
mov byte [ebp - 4], 2
call edx
add eax, 0x10
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x130], esi
mov dword [ebp - 0x134], 0x100c630
push 0x1018cf0
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 4
call fcn.0107f6b0
push 0x1018ce8
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 5
call fcn.010be370
push 0x1018cc0
lea ecx, [ebp - 0x124]
call fcn.010be370
push 0x1018cbc
lea ecx, [ebp - 0x124]
call fcn.010be370
cmp word [ebx], 8
jne 0x10bef08
mov ecx, dword [ebp - 0x124]
lea eax, [ebp - 0x128]
push eax
push 0x20006
push esi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x128], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10bec9b
mov edx, dword [ebp - 0x128]
xor eax, eax
cmp edi, esi
setne al
mov dword [ebp - 0x138], edx
cmp eax, esi
jne 0x10becd9
push 0x80004005
call fcn.01071710
jle 0x10beca7
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
call fcn.01127f00
test al, al
je 0x10bef08
mov eax, dword [ebp - 0x120]
push eax
push 0x1018c68
push 0x1018be8
push esi
call fcn.01128b70
add esp, 0x10
jmp 0x10bef08
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 0x128]
lea ecx, [eax + eax + 2]
push ecx
push edi
push 1
push esi
push 0x1018bbc
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
je 0x10bed3d
jle 0x10bed0b
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
call fcn.01127f00
test al, al
je 0x10bef08
mov eax, dword [ebp - 0x120]
push eax
push 0x1018b58
push 0x1018ad8
push esi
call fcn.01128b70
add esp, 0x10
jmp 0x10bef08
push edi
push 0x20000
push esi
push esi
push 0xa
call dword [sym.imp.CRYPT32.dll_CertOpenStore]
mov edx, dword [ebp - 0x144]
mov edi, eax
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x144]
call eax
cmp edi, esi
mov dword [ebp - 0x140], edi
jne 0x10bedb8
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x10bed7a
call edi
jmp 0x10bed86
call edi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
call fcn.01127f00
test al, al
je 0x10bef08
mov ecx, dword [ebp - 0x120]
push ecx
push 0x1015d38
push 0x1018a58
push esi
call fcn.01128b70
add esp, 0x10
jmp 0x10bef08
mov eax, dword [ebx + 8]
lea edx, [ebp - 0x12c]
push edx
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov ecx, dword [ebx + 8]
push eax
push ecx
call fcn.010bea20
cmp eax, esi
mov dword [ebp - 0x120], eax
jge 0x10bee09
call fcn.01127f00
test al, al
je 0x10bef08
mov edx, dword [ebp - 0x120]
push edx
push 0x1018a10
push 0x1018990
push esi
call fcn.01128b70
add esp, 0x10
jmp 0x10bef08
mov ecx, dword [ebp - 0x12c]
mov eax, dword [ecx - 0xc]
push eax
push ecx
push 0x10001
call dword [sym.imp.CRYPT32.dll_CertCreateCertificateContext]
push eax
lea ecx, [ebp - 0x134]
call fcn.010b5500
mov eax, dword [ebp - 0x130]
cmp eax, esi
jne 0x10bee83
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x10bee45
call edi
jmp 0x10bee51
call edi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
call fcn.01127f00
test al, al
je 0x10bef08
mov eax, dword [ebp - 0x120]
push eax
push 0x1018928
push 0x10188a8
push esi
call fcn.01128b70
add esp, 0x10
jmp 0x10bef08
mov ecx, dword [ebp - 0x140]
push esi
push 3
push eax
push ecx
call dword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
test eax, eax
jne 0x10beedf
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x10beea8
call edi
jmp 0x10beeb4
call edi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x120], eax
call fcn.01127f00
test al, al
je 0x10bef08
mov edx, dword [ebp - 0x120]
push edx
push 0x1015ed8
push 0x1018828
push esi
call fcn.01128b70
add esp, 0x10
jmp 0x10bef08
mov eax, dword [ebp - 0x130]
mov edi, dword [ebp - 0x148]
push eax
mov ecx, edi
mov dword [ebp - 0x130], esi
call fcn.010be340
push eax
mov ecx, edi
call fcn.010bd6c0
mov ecx, eax
call fcn.010b5500
mov eax, dword [ebp - 0x124]
mov edi, dword [ebp - 0x120]
add eax, 0xfffffff0
mov byte [ebp - 4], 4
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10bef34
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 3
call fcn.0109b4c0
mov eax, dword [ebp - 0x12c]
add eax, 0xfffffff0
mov byte [ebp - 4], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10bef69
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 1
call fcn.010b5fa0
mov eax, dword [ebp - 0x138]
cmp eax, esi
je 0x10bef89
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x11c]
mov dword [ebp - 4], 0xffffffff
call fcn.01075230
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.010840d6
mov esp, ebp
pop ebp
ret 0xc