Function at 0x347a031e
Capabilities:
Set registry value

Disassembly:
sub esp, 0x88
mov eax, dword [0x347765c8]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
push ebp
mov ebp, dword [esp + 0x9c]
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x2001f
xor edi, edi
push edi
push 0x34773838
push 0x80000002
mov dword [esp + 0x24], edi
mov ebx, 0xffffb1d4
mov dword [esp + 0x28], edi
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x347a039b
lea ecx, [esp + 0x10]
push ecx
push 0x34773838
xor esi, esi
call fcn.3479fc7d
test eax, eax
je 0x347a0381
mov esi, ebx
cmp esi, edi
mov ebx, esi
jl 0x347a05f6
cmp esi, 0x4ec4
jne 0x347a039b
mov dword [esp + 0x14], 1
mov esi, dword [esp + 0xa0]
cmp esi, 0x13
mov edi, dword [esp + 0xa8]
je 0x347a03be
test ebp, ebp
je case.0x347a0455.25
test edi, edi
jbe case.0x347a0455.25
lea eax, [esi - 5]
cmp eax, 0xf
ja case.0x347a03cd.7
movzx edx, byte [eax + 0x347a0650]
jmp dword [edx*4 + 0x347a0640]
mov eax, ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x347a03d9
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 2]
mov eax, esi
sub eax, 0x2a
je 0x347a040b
sub eax, 1
je 0x347a0404
sub eax, 1
jne 0x347a0412
mov esi, 0x1a
jmp 0x347a041c
mov esi, 0x16
jmp 0x347a041c
mov esi, 0x1b
jmp 0x347a041c
cmp esi, 0x13
je 0x347a0433
cmp esi, 0x12
je 0x347a0433
mov eax, esi
shl eax, 4
cmp edi, dword [eax + 0x34771c60]
jbe 0x347a0445
mov ebx, 0xffffb1c5
jmp 0x347a05f6
cmp edi, 0x20a
jbe 0x347a0445
mov ebx, 0xffffb1c5
jmp 0x347a05f6
cmp esi, 0x28
ja case.0x347a0455.25
movzx ecx, byte [esi + 0x347a0680]
jmp dword [ecx*4 + 0x347a0660]
cmp esi, 6
jne 0x347a0489
push 0x5c
push ebp
call fcn.3477f3fd
mov ebx, eax
test ebx, ebx
je 0x347a04aa
push ebp
mov word [ebx], 0
call fcn.347773d6
test eax, eax
je case.0x347a0455.25
mov word [ebx], 0x5c
jmp 0x347a04aa
cmp esi, 8
jne 0x347a04aa
push ebp
call fcn.347777d4
test eax, eax
je case.0x347a0455.25
push ebp
call fcn.347773d6
test eax, eax
je case.0x347a0455.25
test edi, edi
jbe 0x347a04da
mov eax, ebp
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x347a04b5
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 2]
cmp edi, 0x1fe
jbe 0x347a04da
mov ebx, 0xffffb128
jmp 0x347a05f6
mov ecx, dword [esp + 0x10]
push edi
push ebp
shl esi, 4
mov edx, dword [esi + 0x34771c5c]
mov eax, dword [esi + 0x34771c58]
push edx
xor ebx, ebx
push ebx
push eax
push ecx
call sub.advapi32.dll_RegSetValueExW
test eax, eax
jne 0x347a05f6
jmp 0x347a05f6
cmp edi, 0x54
jne case.0x347a0455.25
mov ecx, dword [esp + 0x10]
push edi
push ebp
shl esi, 4
mov edx, dword [esi + 0x34771c5c]
mov eax, dword [esi + 0x34771c58]
push edx
push 0
push eax
push ecx
call sub.advapi32.dll_RegSetValueExW
test eax, eax
jne 0x347a05f6
xor ebx, ebx
jmp 0x347a05f6
mov ecx, dword [0x347efae8]
lea edx, [esp + 0x18]
push edx
mov edx, dword [ecx + 0x150]
push 0x28
lea eax, [esp + 0x24]
push eax
push ebp
call edx
mov eax, dword [esp + 0x18]
push eax
shl esi, 4
mov edx, dword [esi + 0x34771c5c]
mov eax, dword [esi + 0x34771c58]
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push 0
push eax
push ecx
call sub.advapi32.dll_RegSetValueExW
test eax, eax
jne 0x347a05f6
xor ebx, ebx
jmp 0x347a05f6
cmp edi, 0x10
jne case.0x347a0455.25
push 0x27
lea edx, [esp + 0x48]
push edx
push ebp
call fcn.347b6f2b
test eax, eax
je 0x347a05f6
lea eax, [esp + 0x44]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x347a05a5
sub eax, edx
mov edx, dword [esp + 0x10]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [esp + 0x48]
push ecx
push 1
push 0
push 0x34772894
push edx
call sub.advapi32.dll_RegSetValueExW
test eax, eax
jne 0x347a05f6
xor ebx, ebx
jmp 0x347a05f6
cmp word [ebp], 0
je case.0x347a0455.25
mov eax, dword [esp + 0x10]
push edi
push ebp
push esi
push eax
call fcn.3479fe6e
mov ebx, eax
jmp 0x347a05f6
mov ebx, 0xfffffc15
mov eax, dword [esp + 0x10]
test eax, eax
je 0x347a0610
push eax
call dword [sym.imp.advapi32.dll_RegFlushKey]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
cmp dword [esp + 0x14], 0
je 0x347a0620
test ebx, ebx
mov eax, 0x4ec4
je 0x347a0622
mov eax, ebx
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.347ea89f
add esp, 0x88
ret 0x10