Function at 0xb1460
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xc
push 0
push 0
dec ecx
jne 0xb1468
push ebx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xb17ab
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 4
push 4
push 0xb17bc
call fcn.00051010
mov ebx, eax
test ebx, ebx
je 0xb14dc
lea edx, [ebp - 0x28]
mov eax, 0xb17e0
call fcn.00031d88
lea eax, [ebp - 0x28]
push eax
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 4]
call fcn.0001a00c
lea edx, [ebp - 0x30]
mov eax, 0xb17ec
call fcn.00031d88
lea eax, [ebp - 0x30]
push eax
push 1
push 0x10000000
push 2
push 3
lea eax, [ebp - 0x24]
push eax
push 0
lea edx, [ebp - 0x38]
mov eax, 0xb1800
call fcn.00031d88
mov eax, dword [ebp - 0x38]
mov ecx, 0xb1814
mov edx, 0x80000002
call fcn.0004ece4
lea edx, [ebp - 0x34]
call fcn.0002d44c
mov edx, dword [ebp - 0x34]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 4]
call fcn.00019ef4
cmp dword [ebp - 0x24], 0
je 0xb156f
lea edx, [ebp - 0x3c]
mov eax, 0xb1828
call fcn.00031d88
lea eax, [ebp - 0x3c]
push eax
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 0x24]
call fcn.0002b100
mov edx, dword [ebp - 0x40]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 4]
call fcn.0001a00c
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
mov edx, 0x2800
call fcn.0002aea4
xor edx, edx
push ebp
push 0xb171c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0xb182c
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
cmp dword [ebp - 0xc], 0
je 0xb16be
mov dword [ebp - 0x1c], 0x2800
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
je 0xb1617
lea edx, [ebp - 0x44]
mov eax, 0xb1848
call fcn.00031d88
lea eax, [ebp - 0x44]
push eax
lea edx, [ebp - 0x48]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x48]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 4]
call fcn.0001a00c
jmp 0xb16ed
cmp dword [ebp - 0x1c], 0x80
jae 0xb163d
lea edx, [ebp - 0x4c]
mov eax, 0xb1854
call fcn.00031d88
mov eax, dword [ebp - 0x4c]
mov edx, dword [ebp - 4]
call fcn.0001a00c
jmp 0xb16ed
mov eax, dword [ebp - 0x18]
add eax, 0x14
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
mov eax, dword [ebp - 0x18]
add eax, 0x7a
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x20]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
jmp 0xb16ed
lea edx, [ebp - 0x50]
mov eax, 0xb1864
call fcn.00031d88
lea eax, [ebp - 0x50]
push eax
lea edx, [ebp - 0x54]
mov eax, ebx
call fcn.0002b100
mov edx, dword [ebp - 0x54]
pop eax
call fcn.00013ed4
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 4]
call fcn.0001a00c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xb1723
cmp dword [ebp - 0xc], 0
je 0xb1709
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
mov edx, 0x2800
call fcn.0002aecc
ret