Function at 0x344f75
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.0033c64e
call fcn.003421f2
mov dword [esp], 0x103
xor edi, edi
lea eax, [ebp - 0x203]
push edi
push eax
mov byte [ebp - 0x204], 0
call sub.ntdll.dll_memset
add esp, 0xc
push 0x8007
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 0x356dd8
push 0x356db8
call fcn.00334464
pop ecx
pop ecx
call fcn.00334ba2
push eax
push 0x32a8ef
mov esi, 0x355c80
push esi
mov ecx, esi
call fcn.003467f1
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push edi
push 0x1f03ff
call dword [sym.imp.KERNEL32.dll_OpenThread]
push eax
push 0x338f99
push esi
mov ecx, esi
call fcn.003467f1
call fcn.003388dd
push eax
push 0x33483b
push esi
mov ecx, esi
call fcn.003467f1
push 0x356c34
push 0x356b30
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
lea eax, [ebp - 0x204]
push eax
call fcn.0032e793
pop ecx
call fcn.00334b44
test eax, eax
jne 0x34504a
call fcn.00344f52
jmp 0x34505b
push edi
push edi
push 0x344ed5
push 0xffffffffffffffff
call fcn.0033b6f2
add esp, 0x10
push edi
push edi
xor esi, esi
inc esi
push esi
push edi
push edi
push 0x357c18
call fcn.0033c66e
add esp, 0x18
call fcn.0033f706
cmp byte [0x357c18], 0
je 0x345088
call fcn.0033052b
call fcn.0033bd38
mov ebx, dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueA]
push 2
push 4
mov dword [ebp + 8], edi
pop edi
push edi
lea eax, [ebp - 4]
push eax
push edi
mov dword [ebp - 4], esi
push 0x326024
mov esi, 0x325fe8
push esi
call ebx
push 2
push edi
lea eax, [ebp - 4]
push eax
push edi
push 0x325fd8
push esi
call ebx
push 2
push edi
lea eax, [ebp + 8]
push eax
push 3
push 0x325fcc
push esi
call ebx
push 2
push edi
lea eax, [ebp + 8]
push eax
push edi
push 0x325fb8
push esi
call ebx
push 2
push edi
lea eax, [ebp + 8]
push eax
push edi
push 0x325fa8
push esi
call ebx
and dword [ebp - 4], 0
push 0x11
pop ecx
mov esi, 0x325f60
lea edi, [ebp - 0xb0]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], 3
xor edi, edi
push edi
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x68]
push 0x63
push eax
call sub.ntdll.dll__snprintf
add esp, 0x10
push 2
push 4
pop esi
push esi
lea eax, [ebp + 8]
push eax
push esi
push 0x325f58
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 5], 0
call ebx
push 2
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x325f50
lea eax, [ebp - 0x68]
push eax
call ebx
push 2
push esi
lea eax, [ebp - 4]
push eax
push esi
push 0x325f48
lea eax, [ebp - 0x68]
push eax
call ebx
inc edi
cmp edi, esi
jle 0x34510b
push 0x13
pop ecx
mov esi, 0x325ef8
lea edi, [ebp - 0x100]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
inc esi
push esi
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x68]
push 0x63
push eax
call sub.ntdll.dll__snprintf
add esp, 0x10
push 2
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0x325f48
lea eax, [ebp - 0x68]
push eax
mov byte [ebp - 5], 0
call ebx
inc esi
cmp esi, 4
jle 0x34517b
and dword [ebp + 8], 0
push 2
push 4
pop edi
push edi
lea eax, [ebp + 8]
push eax
push edi
push 0x325ee8
mov esi, 0x325eb4
push esi
call ebx
push 2
push edi
lea eax, [ebp + 8]
push eax
push edi
push 0x325e9c
push esi
call ebx
and dword [ebp + 8], 0
push 2
push edi
lea eax, [ebp + 8]
push eax
push edi
push 0x325e80
push 0x325e50
call ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_Sleep]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4