Function at 0xe0c7c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x29
push 0
push 0
dec ecx
jne 0xe0c84
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0xe0f72
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 4
push 4
push 0xe0f84
call fcn.0004c8f4
mov edi, eax
test edi, edi
je 0xe0cf0
lea edx, [ebp - 0x24]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0xe0fb0
call fcn.00013ff4
mov eax, dword [ebp - 0x20]
mov ecx, esi
xor edx, edx
call fcn.000deea0
push 1
push 0x10000000
push 2
push 3
lea eax, [ebp - 0x1c]
push eax
push 0
mov ecx, 0xe0fc0
mov edx, 0x80000002
mov eax, 0xe0fdc
call fcn.0004c644
lea edx, [ebp - 0x12c]
call fcn.00029850
lea edx, [ebp - 0x12c]
lea eax, [ebp - 0x2c]
call fcn.00013f4c
mov ecx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov edx, 0xe0ff4
call fcn.00013ff4
mov eax, dword [ebp - 0x28]
mov ecx, esi
xor edx, edx
call fcn.000ded38
cmp dword [ebp - 0x1c], 0
je 0xe0d77
push dword [esi]
push 0xe1010
lea edx, [ebp - 0x130]
mov eax, dword [ebp - 0x1c]
call fcn.00027478
push dword [ebp - 0x130]
mov eax, esi
mov edx, 3
call fcn.00014068
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0xe1014
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov edi, eax
cmp dword [ebp - 4], 0
je 0xe0eaf
lea eax, [ebp - 0x10]
mov edx, 0x2800
call fcn.000271f0
mov dword [ebp - 0x14], 0x2800
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov edi, eax
test edi, edi
je 0xe0e14
lea edx, [ebp - 0x138]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x138]
lea eax, [ebp - 0x134]
mov edx, 0xe1038
call fcn.00013ff4
mov eax, dword [ebp - 0x134]
mov ecx, esi
xor edx, edx
call fcn.000deea0
jmp 0xe0e97
cmp dword [ebp - 0x14], 0x72
jae 0xe0e2a
mov ecx, esi
xor edx, edx
mov eax, 0xe104c
call fcn.000deea0
jmp 0xe0e97
mov eax, dword [ebp - 0x10]
add eax, 0x16
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
mov eax, dword [ebp - 0x10]
add eax, 0x6e
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
add eax, 2
mov byte [eax], 3
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x18]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
lea eax, [ebp - 0x10]
mov edx, 0x2800
call fcn.00027218
jmp 0xe0ee1
lea edx, [ebp - 0x140]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x140]
lea eax, [ebp - 0x13c]
mov edx, 0xe1064
call fcn.00013ff4
mov eax, dword [ebp - 0x13c]
mov ecx, esi
xor edx, edx
call fcn.000deea0
cmp dword [ebp - 8], 0
je 0xe0f39
push 0
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push 4
push 4
push 0xe0f84
call fcn.0004c8b8
mov edi, eax
test edi, edi
je 0xe0f47
lea edx, [ebp - 0x148]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x148]
lea eax, [ebp - 0x144]
mov edx, 0xe1078
call fcn.00013ff4
mov eax, dword [ebp - 0x144]
mov ecx, esi
xor edx, edx
call fcn.000deea0
jmp 0xe0f47
mov ecx, esi
xor edx, edx
mov eax, 0xe108c
call fcn.000deea0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe0f79
lea eax, [ebp - 0x148]
mov edx, 7
call fcn.00013d3c
lea eax, [ebp - 0x2c]
mov edx, 4
call fcn.00013d3c
ret