Function at 0x27557e70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x275a855f
mov eax, dword fs:[0]
push eax
sub esp, 0x148
mov eax, dword [0x275ba2ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x120], esi
mov dword [ebp - 0x144], esi
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x140], esi
mov dword [ebp - 0x128], esi
mov edi, dword [ebp + 8]
push edi
push 0x275164fc
push 0x275164a8
lea eax, [ebp - 0x120]
push eax
push 0x27516438
lea ecx, [ebp - 0x11c]
push 2
push ecx
mov byte [ebp - 4], 2
call fcn.2753a320
add esp, 0x1c
push ebx
mov dword [ebp - 0x150], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 0x14c], 1
lea edx, [ebp + 8]
lea ecx, [ebx + 0x18]
push edx
mov byte [ebp - 4], 4
call fcn.2753d5b0
push esi
lea ecx, [ebp - 0x12c]
push ecx
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x130], esi
mov eax, dword [edi - 0xc]
lea edx, [ebp - 0x130]
push edx
add eax, eax
push eax
push edi
mov ecx, 0x275bbad4
call fcn.2759f910
mov dword [ebp - 0x120], eax
mov eax, dword [ebp - 0x130]
xor edi, edi
cmp eax, esi
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x13c], esi
mov dword [ebp - 0x134], esi
je 0x27557f80
mov edi, eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x134], eax
lea ecx, [ebp - 0x13c]
push ecx
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 5
call fcn.2753b7f0
cmp edi, esi
mov byte [ebp - 4], 4
je 0x27557fa5
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x120], esi
jl 0x275580cb
lea edx, [ebp - 0x124]
push edx
push 0x20006
push esi
push 0x27516198
push SysReAllocString
mov dword [ebp - 0x124], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x27557fe6
mov ecx, dword [ebp - 0x124]
xor eax, eax
mov dword [ebp - 0x128], ecx
cmp eax, 2
mov edi, eax
jne 0x2755803f
lea edx, [ebp - 0x154]
push edx
lea eax, [ebp - 0x124]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push 0x27516198
push SysReAllocString
mov dword [ebp - 0x124], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x2755803d
mov ecx, dword [ebp - 0x128]
xor eax, eax
cmp ecx, esi
je 0x27558031
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x124]
mov dword [ebp - 0x128], ecx
mov edi, eax
cmp edi, esi
je 0x27558066
call fcn.27595010
test al, al
je 0x275580b5
push 0x27516198
push 0x275163d8
push 0x27516368
push esi
call fcn.27595fd0
add esp, 0x10
jmp 0x275580b5
mov edx, dword [ebp - 0x148]
mov eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x128]
push edx
push eax
push 3
push esi
push 0x2751617c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
cmp edi, esi
je 0x275580cb
call fcn.27595010
test al, al
je 0x275580b5
push 0x27516198
push 0x2751617c
push 0x27516308
push 0x27516298
push esi
call fcn.27595fd0
add esp, 0x14
cmp edi, esi
jle 0x275580c5
and edi, 0xffff
or edi, 0x80070000
mov dword [ebp - 0x120], edi
mov edi, dword [ebp - 0x120]
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x11c]
mov byte [ebp - 4], 2
call fcn.2753a430
mov eax, dword [ebp - 0x128]
cmp eax, esi
je 0x275580f8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x144]
cmp eax, esi
je 0x27558109
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x2755812f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.2757f388
mov esp, ebp
pop ebp
ret 4