Function at 0xc2a1394
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc0
mov eax, dword [0xc2b2728]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
push 0x400
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
call fcn.0c2987c5
mov dword [ebp - 0xbc], eax
cmp eax, ebx
jne 0xc2a13db
mov edi, 0x8007000e
jmp 0xc2a157e
lea ecx, [ebp - 0xa8]
push ecx
push 0x200
push eax
lea edi, [esi + 0xc]
push edi
call fcn.0c2a7f70
test eax, eax
je 0xc2a145a
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0xc0]
push eax
push ebx
push 0xc28196c
push dword [ebp - 0xa8]
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xb4], 4
mov dword [ebp - 0xc0], ebx
call fcn.0c285b76
test eax, eax
jne 0xc2a1448
test byte [ebp - 0xb0], 1
je 0xc2a1444
or dword [esi + 4], 1
jmp 0xc2a1448
and dword [esi + 4], 0xfffffffe
push dword [ebp - 0xa8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xa8], ebx
push dword [ebp - 0xbc]
call fcn.0c29882d
push edi
call fcn.0c2a100f
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xac]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0xc281698
push 0x80000002
call edi
test eax, eax
jne 0xc2a1579
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xa8]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push dword [esi + 8]
push dword [ebp - 0xac]
call edi
test eax, eax
jne 0xc2a1579
push 0x50
lea eax, [ebp - 0xa4]
push eax
lea eax, [esi + 0xc]
push eax
call fcn.0c286460
mov edi, eax
cmp edi, ebx
jl 0xc2a157e
lea eax, [ebp - 0xa4]
push eax
call fcn.0c285992
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add eax, eax
push eax
lea eax, [ebp - 0xa4]
push eax
push 1
push ebx
push 0xc28148c
push dword [ebp - 0xa8]
call edi
test eax, eax
jne 0xc2a1579
push dword [esi + 0x1c]
call fcn.0c285992
add eax, eax
push eax
push dword [esi + 0x1c]
push 1
push ebx
push 0xc2819f4
push dword [ebp - 0xa8]
call edi
test eax, eax
jne 0xc2a1579
mov eax, dword [esi + 0x20]
cmp eax, ebx
je 0xc2a1557
push eax
call fcn.0c285992
add eax, eax
push eax
push dword [esi + 0x20]
push 1
push ebx
push 0xc2819dc
push dword [ebp - 0xa8]
call edi
push dword [esi + 0x24]
call fcn.0c285992
add eax, eax
push eax
push dword [esi + 0x24]
push 1
push ebx
push 0xc281498
push dword [ebp - 0xa8]
call edi
test eax, eax
je 0xc2a15ad
mov edi, 0x80004005
cmp dword [ebp - 0xa8], ebx
je 0xc2a1592
push dword [ebp - 0xa8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xac], ebx
je 0xc2a15a6
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0xc2a166f
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0xc2a15d0
push eax
call fcn.0c285992
add eax, eax
push eax
push dword [esi + 0x28]
push 1
push ebx
push 0xc2819b8
push dword [ebp - 0xa8]
call edi
mov eax, dword [esi + 0x2c]
cmp eax, ebx
je 0xc2a15f6
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push dword [esi + 0x2c]
push 1
push ebx
push 0xc2818fc
push dword [ebp - 0xa8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esi + 0x30]
cmp eax, ebx
je 0xc2a1619
push eax
call fcn.0c285992
add eax, eax
push eax
push dword [esi + 0x30]
push 1
push ebx
push 0xc281454
push dword [ebp - 0xa8]
call edi
cmp dword [esi], 0x38
jne 0xc2a1641
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0xc2a1641
push eax
call fcn.0c285992
add eax, eax
push eax
push dword [esi + 0x34]
push 1
push ebx
push 0xc2819a4
push dword [ebp - 0xa8]
call edi
push 4
add esi, 4
push esi
push 4
push ebx
push 0xc28196c
push dword [ebp - 0xa8]
call edi
push dword [ebp - 0xac]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0xa8]
call esi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0c2af3be
leave
ret 4