Function at 0x10036c5
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10091b8]
push ebx
push esi
push edi
push 0x100
lea ecx, [ebp - 0x208]
push ecx
push 0xffffffffffffffff
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
push 0
push 0
mov dword [ebp - 0x218], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push 0x10019a8
call fcn.01004c8a
mov edi, dword [0x1009424]
pop ecx
jmp 0x1003a03
lea eax, [ebp - 0x206]
push eax
lea eax, [edi + 0x20a]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x10039fd
mov esi, dword [ebp + 0xc]
movzx eax, si
push eax
push dword [ebp - 0x218]
push 0x100198c
call fcn.01004c8a
xor eax, eax
mov al, byte [edi + 0x410]
and esi, 1
add esp, 0xc
and eax, 1
cmp ax, si
je 0x10037b2
push 0x1001970
call fcn.01004c8a
pop ecx
push 2
lea eax, [ebp - 0x214]
push eax
call fcn.01002dc8
test eax, eax
jne 0x10037a7
lea ebx, [edi + 0x208]
push ebx
push 0x1001958
call fcn.01004c8a
pop ecx
pop ecx
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10037b2
push 0x1001930
call fcn.01004c8a
pop ecx
mov ax, word [ebp + 0xc]
neg si
mov word [edi + 0x410], ax
lea eax, [ebp - 0x20c]
push eax
lea ebx, [edi + 0x208]
sbb esi, esi
xor eax, eax
push eax
and esi, 0xfffffffa
push eax
add esi, 0x2a
mov word [ebx], si
mov esi, dword [ebp - 0x218]
push 4
push esi
push eax
mov byte [esi], 0x24
call sub.NDdeApi.dll_Ordinal_509
push dword [ebp - 0x20c]
push 0x1001910
call fcn.01004c8a
pop ecx
pop ecx
push dword [ebp - 0x20c]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
test eax, eax
mov dword [ebp - 0x21c], eax
jne 0x1003828
push 0x10018fc
call fcn.01004c8a
pop ecx
jmp 0x10039a8
lea ecx, [ebp - 0x20c]
push ecx
push dword [ebp - 0x20c]
push eax
push 4
push esi
push 0
call sub.NDdeApi.dll_Ordinal_509
test eax, eax
je 0x100384f
push eax
push 0x10018e4
jmp 0x1003995
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_GetSecurityDescriptorDacl]
test eax, eax
jne 0x1003885
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10018d0
jmp 0x1003995
and dword [ebp - 0x20c], 0
lea eax, [ebp - 0x210]
push eax
push 0
jmp 0x1003962
mov eax, dword [ebp - 0x210]
mov cl, byte [eax]
xor esi, esi
test cl, cl
je 0x10038bc
cmp cl, 1
je 0x10038bc
push 0x10018b8
call fcn.01004c8a
jmp 0x100394e
test byte [eax + 4], 1
je 0x10038d8
push 0x10018b4
call fcn.01004c8a
mov eax, dword [ebp - 0x210]
pop ecx
mov esi, 0x80000000
test byte [eax + 4], 2
je 0x10038f5
push 0x10018b4
call fcn.01004c8a
mov eax, dword [ebp - 0x210]
pop ecx
or esi, 0x40000000
mov edx, dword [eax + 4]
mov ecx, 0x102fd
and edx, ecx
cmp edx, ecx
jne 0x100391a
push 0x10018b0
call fcn.01004c8a
mov eax, dword [ebp - 0x210]
pop ecx
or esi, 0xc0010000
mov ecx, dword [eax + 4]
mov eax, 0xf03ff
and ecx, eax
cmp ecx, eax
jne 0x1003939
push 0x10018ac
call fcn.01004c8a
pop ecx
or esi, 0x10000000
push esi
push 0x10018a0
call fcn.01004c8a
mov eax, dword [ebp - 0x210]
pop ecx
mov dword [eax + 4], esi
inc dword [ebp - 0x20c]
pop ecx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x20c]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_GetAce]
test eax, eax
jne 0x100389a
push dword [ebp - 0x21c]
push 4
push edi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
test eax, eax
jne 0x100399c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x100188c
call fcn.01004c8a
pop ecx
pop ecx
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea esi, [edi + 0x40c]
push dword [esi]
push dword [0x10091f0]
call sub.USER32.dll_DdeFreeStringHandle
push 0x4b0
push ebx
push dword [0x10091f0]
call sub.USER32.dll_DdeCreateStringHandleW
test eax, eax
mov dword [esi], eax
jne 0x10039de
push 0x100186c
call fcn.01004c8a
jmp 0x10039fc
push 2
lea eax, [ebp - 0x214]
push eax
call fcn.01002dc8
test eax, eax
je 0x1003a2e
push ebx
push 0x1001840
call fcn.01004c8a
pop ecx
pop ecx
mov edi, dword [edi + 0x41c]
test edi, edi
jne 0x1003713
push dword [ebp - 0x218]
push 0x1001820
call fcn.01004c8a
pop ecx
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01007021
leave
ret 8
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
lea ebx, [edi + 0x208]
call esi
push eax
push edi
push ebx
push 0x10017f8
call fcn.01004c8a
add esp, 0x10
push edi
call esi
lea eax, [eax + eax + 2]
push eax
push edi
push 1
push 0
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x1009a80]
push dword [0x1009450]
push dword [0x10091f0]
call sub.USER32.dll_DdePostAdvise
xor eax, eax
inc eax
jmp 0x1003a1f