Function at 0xe0b64
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0xe0ecc
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0xe0ea7
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0xe0e96
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
je 0xe0be2
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x10]
call fcn.00025330
mov eax, dword [ebp - 0x10]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
jmp 0xe0c10
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00025330
mov eax, dword [ebp - 0x14]
call fcn.00014090
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
cmp dword [ebp - 0xc], 0
je 0xe0e74
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0xe0edc
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
cmp dword [ebp - 0xc], 0
je 0xe0c48
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0xe0ee8
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
cmp dword [ebp - 0xc], 0
je 0xe0c9e
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0xe0f28
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
cmp dword [ebp - 0xc], 0
je 0xe0cad
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0xe0f44
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
cmp dword [ebp - 0xc], 0
je 0xe0d81
mov dword [ebp - 4], 0x1869f
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0xe0f80
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
mov dword [ebp - 4], eax
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0xe0f94
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0xe0fa8
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0xe0fb4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 4], 5
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0xe0fc4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
cmp dword [ebp - 0xc], 0
je 0xe0d90
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0xe0fd0
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
cmp dword [ebp - 0xc], 0
je 0xe0e03
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0xe1008
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
mov dword [ebp - 4], eax
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0xe1020
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
cmp dword [ebp - 0xc], 0
je 0xe0e12
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
push 0xe102c
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
xor eax, eax
mov dword [ebp - 4], eax
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push 0xe1074
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
cmp dword [ebp - 0xc], 0
je 0xe0e6f
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe0e9d
cmp dword [ebp - 0xc], 0
je 0xe0e90
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
ret