Function at 0x1008b5f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x101279d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x26c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x268], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x260], eax
push 0x27
lea eax, [ebp - 0x54]
mov dword [ebp - 0x27c], ecx
mov dword [ebp - 0x264], edx
mov edx, dword [ebp + 0x20]
push eax
lea ecx, [ebp - 0x26c]
push ecx
mov dword [ebp - 0x278], edx
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea edx, [ebp - 0x54]
push edx
push str.CLSID_ls
lea eax, [ebp - 0x25c]
push 0x104
push eax
call fcn.1008aae0
add esp, 0x10
lea ecx, [ebp - 0x270]
push ecx
lea edx, [ebp - 0x25c]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x1008b6a5
pop edi
or eax, 0x80070000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a6f5d
mov esp, ebp
pop ebp
ret 0x20
push ebx
push esi
push 0x100f429c
lea eax, [ebp - 0x25c]
push 0x104
push eax
call fcn.1008aae0
mov edx, dword [ebp - 0x270]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueW]
add esp, 0x10
push 0x208
lea ecx, [ebp - 0x25c]
push ecx
push 1
push 0
push edx
call ebx
mov esi, eax
test esi, esi
je 0x1008b70c
mov eax, dword [ebp - 0x270]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, esi
pop edi
or eax, 0x80070000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a6f5d
mov esp, ebp
pop ebp
ret 0x20
push edi
push 0x100f429c
lea ecx, [ebp - 0x25c]
push 0x104
push ecx
call fcn.1008aae0
mov ecx, dword [ebp - 0x270]
add esp, 0x10
lea edx, [ebp - 0x274]
push edx
lea eax, [ebp - 0x25c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov esi, eax
test esi, esi
je 0x1008b76e
mov edx, dword [ebp - 0x270]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, esi
pop edi
or eax, 0x80070000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a6f5d
mov esp, ebp
pop ebp
ret 0x20
mov eax, dword [ebp - 0x27c]
push eax
push 0x100f429c
lea ecx, [ebp - 0x25c]
push 0x104
push ecx
call fcn.1008aae0
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
add esp, 0x10
lea edx, [ebp - 0x25c]
push edx
call edi
mov edx, dword [ebp - 0x274]
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x25c]
push ecx
push 1
push 0
push edx
call ebx
mov esi, eax
test esi, esi
je 0x1008b7ee
mov eax, dword [ebp - 0x270]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call edi
mov ecx, dword [ebp - 0x274]
push ecx
call edi
pop ebx
mov eax, esi
pop edi
or eax, 0x80070000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a6f5d
mov esp, ebp
pop ebp
ret 0x20
mov edx, dword [ebp - 0x278]
push edx
push 0x100f429c
lea eax, [ebp - 0x25c]
push 0x104
push eax
call fcn.1008aae0
add esp, 0x10
lea ecx, [ebp - 0x25c]
push ecx
call edi
mov ecx, dword [ebp - 0x274]
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x25c]
push eax
push 1
push 0
push str.ThreadingModel
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x270]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov esi, eax
call edi
mov eax, dword [ebp - 0x274]
push eax
call edi
test esi, esi
jle 0x1008b863
and esi, 0xffff
or esi, 0x80070000
mov ecx, dword [ebp - 4]
pop ebx
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100a6f5d
mov esp, ebp
pop ebp
ret 0x20