Function at 0x1000cca0
Capabilities:
Set registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100348a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x314
push ebx
push esi
push edi
mov ebx, ecx
jmp 0x1000ccd5
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x11f]
mov byte [ebp - 0x120], 0
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 0x14]
push 0xa
stosw word es:[edi], ax
lea eax, [ebp - 0x120]
push eax
push ecx
call fcn.100186a8
mov edx, dword [ebx + 0x3c4]
lea ecx, [ebx + 0x3c4]
add esp, 0xc
mov eax, dword [edx - 8]
push eax
push eax
call fcn.1002cb5b
mov esi, dword [ebp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
push 1
lea eax, [ebp - 0x120]
push 0
push eax
push esi
call edi
test eax, eax
je 0x1000cd4c
push 0
push 0
push str.RFail
call fcn.1002fece
push 0
push 0xffffffffffffffff
call dword [0x10048c3c]
mov ecx, dword [ebp + 0x10]
add ecx, 3
mov al, byte [ecx]
test al, al
je 0x1000cd87
push 1
push ecx
push 1
push 0
dec al
push 0x10043fd0
push esi
mov byte [ecx], al
call edi
test eax, eax
je 0x1000cd87
push 0
push 0
push str.RFail1
call fcn.1002fece
push 0
push 0xffffffffffffffff
call dword [0x10048c3c]
mov edx, dword [ebp + 0x10]
mov al, byte [edx + 5]
test al, al
je 0x1000cf6b
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x31f]
mov byte [ebp - 0x320], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x320]
push 0xff
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0x80
push 3
push 0
push 1
lea ecx, [ebp - 0x320]
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000ce04
push 0
push 0x10
push str.Create_Fail1_
call fcn.1002fece
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea edx, [ebp - 0x1c]
push 0
push edx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea eax, [ebp - 0x1c]
push 0xffffffffffffffff
push eax
lea ecx, [ebp - 0x14]
call fcn.1002810c
lea ecx, [ebp - 0x10]
push str._Y__m__d__H:_M:_S
push ecx
lea ecx, [ebp - 0x14]
call fcn.10028158
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
lea eax, [ebp + 0x14]
push edx
push eax
call fcn.10008560
add esp, 8
mov ecx, ebx
mov byte [ebp - 4], 1
call fcn.1000cf90
mov esi, dword [ebp + 0x10]
mov edx, eax
xor eax, eax
lea edi, [ebp - 0x21f]
movsx ecx, byte [esi + 0xa]
add edx, ecx
mov ecx, 0x3f
mov byte [ebp - 0x220], 0
push 0x10
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x220]
push eax
push edx
call fcn.100186a8
mov edi, dword [ebp + 8]
add esp, 0xc
lea ecx, [ebp - 0x20]
lea edx, [ebp - 0x220]
push ecx
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000ceee
push esi
push edi
mov ecx, ebx
call fcn.1000cfc0
cmp eax, 0xfffffffe
jne 0x1000cf50
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0
call fcn.1002c896
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.1002c896
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0x220]
push eax
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [ebp + 0x14]
lea ecx, [ebp + 0x14]
mov eax, dword [edx - 8]
push eax
push eax
call fcn.1002cb5b
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push eax
mov eax, dword [ebp + 0xc]
push 1
push 0
push 0x10043ff8
push eax
call esi
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx - 8]
lea ecx, [ebp + 0x14]
push eax
push eax
call fcn.1002cb5b
mov edx, dword [ebp + 0xc]
push eax
push 1
push 0
push 0x10043ff4
push edx
call esi
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], 0
call fcn.1002c896
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
call fcn.1002c896
jmp 0x1000cf7b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x14