Function at 0x10011e30
Capabilities:
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x1006688a
mov eax, dword fs:[0]
push eax
mov eax, 0x107c
call fcn.10055c00
mov eax, dword [0x1007c060]
xor eax, esp
mov dword [esp + 0x1078], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x1007c060]
xor eax, esp
push eax
lea eax, [esp + 0x1090]
mov dword fs:[0], eax
push 0x10080430
mov edi, ecx
mov dword [esp + 0x58], 0x10080430
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [esp + 0x1098], 0
test edi, edi
je 0x10012408
mov ecx, edi
call fcn.10011520
test eax, eax
je 0x10011eab
mov byte [0x100804ad], 1
jmp 0x10011eb8
push str._SaveKeyRule_failed
call fcn.10024175
add esp, 4
mov eax, dword [0x10080cb8]
mov ebx, dword [0x10080cb4]
mov ebp, eax
cmp ebx, eax
jbe 0x10011ed9
call fcn.1004a7af
mov eax, dword [0x10080cb8]
mov ebx, dword [0x10080cb4]
mov esi, dword [0x10080ca8]
cmp ebx, eax
jbe 0x10011ee8
call fcn.1004a7af
mov eax, dword [0x10080ca8]
push ebp
push esi
push ebx
push eax
lea ebx, [esp + 0x44]
mov esi, 0x10080ca8
call fcn.10005820
mov ebp, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea ecx, [esp + 0x38]
push ecx
push 4
push 0x1006b0f8
push str.Softwareprojonepodlp_smprule_
xor ebx, ebx
push 0x80000002
mov dword [esp + 0x4c], ebx
call ebp
push 4
lea edx, [esp + 0x38]
push edx
push 4
push str.AllowedCopyLimits
push str.Softwareprojonepodlp_smprule_
push 0x80000002
mov dword [esp + 0x4c], ebx
call ebp
lea eax, [esp + 0x3c]
push eax
call fcn.1000c1c0
add esp, 4
mov byte [esp + 0x1098], 1
cmp byte [esp + 0x44], 7
jne 0x100123f8
push 0xc
push str.CryptEnabled
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.10004c30
mov edi, 0x1006b0f8
lea esi, [esp + 0x18]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1098], 2
call fcn.1000cb20
mov byte [esp + 0x1098], 1
cmp dword [esp + 0x30], 0x10
jb 0x10011fb9
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.1004a7e9
add esp, 4
push 0xa
push 0x1006ad48
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.10004c30
mov edi, str.CryptoMode
lea esi, [esp + 0x18]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1098], 3
call fcn.1000cb20
mov byte [esp + 0x1098], 1
cmp dword [esp + 0x30], 0x10
jb 0x1001200f
mov edx, dword [esp + 0x1c]
push edx
call fcn.1004a7e9
add esp, 4
push 0x10
push str.EncryptClipboard
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0xf
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.10004c30
mov edi, 0x1006bb08
lea esi, [esp + 0x18]
lea ecx, [esp + 0x3c]
mov byte [esp + 0x1098], 4
call fcn.1000cb20
mov edi, 0x10
mov byte [esp + 0x1098], 1
cmp dword [esp + 0x30], edi
jb 0x10012069
mov eax, dword [esp + 0x1c]
push eax
call fcn.1004a7e9
add esp, 4
push 0x11
mov esi, 0xf
push str.MaxOfflineEnabled
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.10004c30
lea ecx, [esp + 0x18]
push 0x100804ac
push ecx
lea ecx, [esp + 0x44]
mov byte [esp + 0x10a0], 5
call fcn.1000c560
add esp, 8
mov byte [esp + 0x1098], 1
cmp dword [esp + 0x30], edi
jb 0x100120c3
mov edx, dword [esp + 0x1c]
push edx
call fcn.1004a7e9
add esp, 4
cmp byte [0x100804ac], bl
je 0x1001212a
push str.MaxOfflineHours
lea ecx, [esp + 0x1c]
call fcn.10002d90
lea eax, [esp + 0x18]
push 0x1007e164
push eax
lea ecx, [esp + 0x44]
mov byte [esp + 0x10a0], 6
call fcn.1000c650
add esp, 8
mov byte [esp + 0x1098], 1
cmp dword [esp + 0x30], edi
jb 0x10012112
mov ecx, dword [esp + 0x1c]
push ecx
call fcn.1004a7e9
add esp, 4
mov eax, dword [0x1007e164]
mov edx, eax
shl edx, 4
sub edx, eax
add edx, edx
add edx, edx
mov dword [0x1007e164], edx
jmp 0x10012134
mov dword [0x1007e164], 0xea24
push edi
push str.AllowedCopyLimit
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.10004c30
lea eax, [esp + 0x17]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x10a0], 7
lea ecx, [esp + 0x44]
mov byte [esp + 0x1f], bl
call fcn.1000c560
add esp, 8
test al, al
je 0x10012180
cmp byte [esp + 0x17], bl
mov byte [esp + 0x17], 1
jne 0x10012184
mov byte [esp + 0x17], bl
mov byte [esp + 0x1098], 1
cmp dword [esp + 0x30], edi
jb 0x1001219f
mov edx, dword [esp + 0x1c]
push edx
call fcn.1004a7e9
add esp, 4
cmp byte [esp + 0x17], bl
je 0x1001222f
push str.AllowedCopyLimitChars
lea ecx, [esp + 0x1c]
call fcn.10002d90
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
push ecx
mov byte [esp + 0x10a0], 8
lea ecx, [esp + 0x44]
mov dword [esp + 0x3c], ebx
call fcn.1000c650
movzx esi, al
add esp, 8
neg esi
sbb esi, esi
and esi, dword [esp + 0x34]
mov byte [esp + 0x1098], 1
cmp dword [esp + 0x30], edi
jb 0x100121ff
mov edx, dword [esp + 0x1c]
push edx
call fcn.1004a7e9
add esp, 4
cmp esi, 0x3e7
jle 0x1001220c
mov esi, 0x3e7
push 4
lea eax, [esp + 0x38]
push eax
push 4
push str.AllowedCopyLimits
push str.Softwareprojonepodlp_smprule_
push 0x80000002
mov dword [esp + 0x4c], esi
call ebp
mov esi, 0xf
push esi
push str.EnableWhitePath
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], bl
call fcn.10004c30
lea ecx, [esp + 0x17]
push ecx
lea edx, [esp + 0x1c]
mov byte [esp + 0x109c], 9
push edx
lea ecx, [esp + 0x44]
mov byte [esp + 0x1f], bl
call fcn.1000c560
add esp, 8
test al, al
je 0x1001227b
cmp byte [esp + 0x17], bl
mov byte [esp + 0x17], 1
jne 0x1001227f
mov byte [esp + 0x17], bl
mov byte [esp + 0x1098], 1
cmp dword [esp + 0x30], edi
jb 0x1001229a
mov eax, dword [esp + 0x1c]
push eax
call fcn.1004a7e9
add esp, 4
cmp byte [esp + 0x17], bl
je 0x10012357
push str.DteWhitePaths
lea ecx, [esp + 0x5c]
call fcn.10002d90
sub esp, 0x18
mov dword [esp + 0x4c], esp
mov eax, esp
je 0x100122d0
mov dword [eax], vtable.std::tr1::_Impl_base1_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t____class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__.0
mov dword [eax], 0x1006abc0
mov dword [eax + 4], fcn.10001430
mov dword [eax + 0x10], eax
lea ecx, [esp + 0x70]
push ecx
lea edx, [esp + 0x58]
push edx
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x10bc], 0xb
call fcn.1000c830
add esp, 0xc
mov byte [esp + 0x10b0], 0xc
lea ecx, [esp + 0x8c]
push ecx
mov ecx, eax
mov byte [esp + 0x10b4], 0xd
call fcn.100082b0
add esp, 0x1c
push 0x10080ca8
mov ebx, eax
mov byte [esp + 0x109c], 0xe
call fcn.100033c0
lea esi, [esp + 0x74]
call fcn.10003370
lea esi, [esp + 0x18]
call fcn.10003180
mov byte [esp + 0x1098], 1
cmp dword [esp + 0x70], edi
jb 0x10012355
mov edx, dword [esp + 0x5c]
push edx
call fcn.1004a7e9
add esp, 4
xor ebx, ebx
lea eax, [esp + 0x3c]
push eax
call fcn.1000d910
add esp, 4
cmp dword [0x1007e6e0], ebx
je 0x100123f8
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push str._OfflineMonitorThread
push 0x25e
push str..dterule.cpp
push str._s._d:_s
lea ecx, [esp + 0x9c]
push 0x800
push ecx
mov dword [0x1007e6e0], ebx
call esi
add esp, 0x18
lea edx, [esp + 0x8c]
push edx
push 0x1000f130
call fcn.100242d3
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push str._DteWorkMonitor
push 0x25f
push str..dterule.cpp
push str._s._d:_s
lea eax, [esp + 0x9c]
push 0x800
push eax
call esi
add esp, 0x18
lea ecx, [esp + 0x8c]
push ecx
push 0x1000fad0
call fcn.100242d3
push eax
call edi
lea esi, [esp + 0x3c]
mov byte [esp + 0x1098], bl
call fcn.1003ac21
push 0x10080430
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [esp + 0x1090]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x1078]
xor ecx, esp
call fcn.1004a172
add esp, 0x1088
ret