Function at 0x10032870
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
mov eax, dword [0x102223f8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
movups xmm0, xmmword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x24]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x278], eax
lea eax, [ebp - 0x54]
push 0x27
push eax
lea eax, [ebp - 0x26c]
push eax
movups xmmword [ebp - 0x26c], xmm0
call dword [sym.imp.OLE32.dll_StringFromGUID2]
test eax, eax
jns 0x100328d0
pop edi
pop esi
lfence
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100847aa
mov esp, ebp
pop ebp
ret 0x20
lea eax, [ebp - 0x54]
push eax
push str.CLSID_ls
lea eax, [ebp - 0x25c]
push 0x104
push eax
call fcn.100275c0
add esp, 0x10
lea eax, [ebp - 0x270]
push 0
push eax
push 0
push 0x20206
push 0
push 0
push 0
lea eax, [ebp - 0x25c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10032931
pop edi
pop esi
or eax, 0x80070000
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100847aa
mov esp, ebp
pop ebp
ret 0x20
push esi
push 0x101eea14
lea eax, [ebp - 0x25c]
push 0x104
push eax
call fcn.100275c0
add esp, 0x10
lea eax, [ebp - 0x25c]
push 0x208
push eax
push 1
push 0
push 0
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x10032986
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or esi, 0x80070000
jmp 0x10032b03
push ebx
push 0x101eea14
lea eax, [ebp - 0x25c]
push 0x104
push eax
call fcn.100275c0
add esp, 0x10
lea eax, [ebp - 0x274]
push 0
push eax
push 0
push 0x20206
push 0
push 0
push 0
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x1003296f
push edi
push 0x101eea14
lea eax, [ebp - 0x25c]
push 0x104
push eax
call fcn.100275c0
add esp, 0x10
lea eax, [ebp - 0x25c]
mov esi, 0x104
cmp word [eax], 0
je 0x10032a02
add eax, 2
sub esi, 1
jne 0x100329f4
mov ecx, esi
mov edi, 0x104
mov eax, edi
mov edx, esi
sub eax, esi
neg ecx
sbb ecx, ecx
and ecx, eax
neg edx
sbb edx, edx
and edx, ecx
neg esi
sbb esi, esi
and esi, edx
lea eax, [esi*2 + 2]
push eax
lea eax, [ebp - 0x25c]
push eax
push 1
push 0
push 0
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
je 0x10032a6b
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or esi, 0x80070000
jmp 0x10032b03
push dword [ebp - 0x278]
lea eax, [ebp - 0x25c]
push 0x101eea14
push 0x104
push eax
call fcn.100275c0
add esp, 0x10
lea eax, [ebp - 0x25c]
mov edx, edi
cmp word [eax], 0
je 0x10032aa0
add eax, 2
sub edx, 1
jne 0x10032a92
sub edi, edx
mov eax, edx
neg eax
mov ecx, edx
sbb eax, eax
and eax, edi
neg ecx
sbb ecx, ecx
and ecx, eax
neg edx
sbb edx, edx
and edx, ecx
lea eax, [edx*2 + 2]
push eax
lea eax, [ebp - 0x25c]
push eax
push 1
push 0
push str.ThreadingModel
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x270]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jle 0x10032b03
movzx esi, si
or esi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100847aa
mov esp, ebp
pop ebp
ret 0x20