Function at 0x1036b4e
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push 0x1006ff4
mov dword [ebp - 0x41c], eax
mov ebx, 0x103
lea eax, [ebp - 0x414]
push ebx
xor esi, esi
push eax
mov dword [ebp - 0x418], esi
call fcn.01027f64
add esp, 0x10
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x414]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1036c71
push 0x10087a8
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01027e68
test eax, eax
jl 0x1036c05
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1036bdf
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push esi
push dword [ebp - 0x418]
call edi
push 0x1008750
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01027e68
test eax, eax
jl 0x1036c4e
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1036c24
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 2
push esi
push 0x1004364
push dword [ebp - 0x418]
call edi
push 2
push 0x1002720
push 1
push esi
push 0x1008730
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x41c]
lea eax, [ebp - 0x414]
push 0x1007088
push ebx
push eax
call fcn.01027f64
add esp, 0x10
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x414]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1036d05
push 0x1007018
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01027e68
test eax, eax
jl 0x1036cf9
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1036ccf
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1007068
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x41c]
lea eax, [ebp - 0x414]
push 0x1006f58
push ebx
push eax
call fcn.01027f64
add esp, 0x10
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x414]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1036df9
push 0x10086f0
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01027e68
test eax, eax
jl 0x1036d8d
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1036d67
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push esi
push dword [ebp - 0x418]
call edi
push 0x1008698
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01027e68
test eax, eax
jl 0x1036dd6
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1036dac
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 2
push esi
push 0x1004364
push dword [ebp - 0x418]
call edi
push 2
push 0x1002720
push 1
push esi
push 0x1008730
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x41c]
lea eax, [ebp - 0x414]
push 0x1006fc8
push ebx
push eax
call fcn.01027f64
add esp, 0x10
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x414]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1036e8d
push 0x1006f78
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01027e68
test eax, eax
jl 0x1036e81
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1036e57
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1007068
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102df7d
leave
ret 4