Function at 0x10b56c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x113b700
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x115f604]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x18], edi
mov eax, 1
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0xd], al
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
cmp dword [0x100320c], ebx
mov byte [ebp - 4], al
jne 0x10b5740
lea ecx, [ebp - 0x28]
push ecx
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x10b5817
call esi
cmp eax, 0x3f0
jne 0x10b582a
lea edx, [ebp - 0x20]
push edx
call fcn.0112deb0
mov eax, dword [eax]
lea ecx, [ebp - 0x1c]
push ecx
push 0x2001f
push ebx
push 0x1015960
push eax
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x10b5772
mov edi, dword [ebp - 0x1c]
xor esi, esi
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x10b5780
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 2
jne 0x10b57da
lea edx, [ebp - 0x20]
push edx
mov byte [ebp - 0xd], bl
call fcn.0112deb0
mov eax, dword [eax]
lea ecx, [ebp - 0x24]
push ecx
lea edx, [ebp - 0x1c]
push edx
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x1015960
push eax
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x10b57ca
xor eax, eax
cmp edi, ebx
je 0x10b57c4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], edi
mov esi, eax
mov eax, dword [ebp - 0x20]
cmp eax, ebx
je 0x10b57da
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x10b5851
jle 0x10b57ec
and esi, 0xffff
or esi, 0x80070000
call fcn.01127f00
test al, al
je 0x10b58bb
push esi
push 0x1015960
push 0x1011450
push 0x10158e0
push ebx
call fcn.01128b70
add esp, 0x14
jmp 0x10b58bb
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
cmp eax, ebx
mov dword [ebp - 0x2c], eax
jne 0x10b5740
call esi
test eax, eax
jg 0x10b5836
call esi
mov esi, eax
jmp 0x10b5846
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
cmp esi, ebx
jl 0x10b58bb
mov esi, 0x80070005
jmp 0x10b58bb
cmp byte [ebp - 0xd], bl
je 0x10b5874
lea eax, [ebp - 0x14]
push eax
push 0x10158b0
lea ecx, [ebp - 0x18]
call fcn.010b5520
cmp eax, 2
jne 0x10b5870
xor ecx, ecx
jmp 0x10b5877
cmp eax, ebx
jne 0x10b58ad
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + 1]
cmp eax, ecx
jb 0x10b5882
xor esi, esi
jmp 0x10b588a
or eax, 0xffffffff
mov esi, 0x80070216
cmp esi, ebx
mov dword [ebp - 0x14], eax
jl 0x10b58bb
push 4
lea ecx, [ebp - 0x20]
push ecx
push 4
push ebx
push 0x10158b0
push edi
mov dword [ebp - 0x20], eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
je 0x10b58bb
jle 0x10b58b9
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.010b5490
cmp edi, ebx
je 0x10b58d1
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret