Function at 0x101fbf6
Capabilities:
Set registry value

Disassembly:
push 0xad0
mov eax, 0x1030932
call fcn.0102b282
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xab0], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xad0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp + 0x18]
mov edi, ecx
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xaa8], ecx
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xaa0], 1
cmp eax, ebx
jne 0x101fc60
push 0x10078d8
push ebx
push 0x10
push 0x1035128
call fcn.0102ca9a
mov eax, 0x80004003
jmp 0x1020177
mov dword [eax], ebx
cmp dword [edi + 8], ebx
je 0x1020160
cmp dword [edi + 0xc], ebx
je 0x1020160
cmp word [ecx], 2
je 0x101fce4
push 5
pop ecx
push 0x7ee
lea eax, [ebp - 0xa08]
push ebx
mov esi, 0x10078c0
lea edi, [ebp - 0xa1c]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memset
add esp, 0xc
push 2
push ebx
push ebx
push 0x401
lea eax, [ebp - 0xa1c]
push eax
push 0x10
push dword [ebp - 0xaa8]
call dword [sym.imp.WS2_32.dll_GetNameInfoW]
lea eax, [ebp - 0xa1c]
push eax
push 0x1007838
push 4
push 2
push 0x1035128
call fcn.0102ca9a
add esp, 0x14
mov eax, 0x80004005
jmp 0x102017a
mov eax, dword [edi + 8]
mov ecx, dword [eax]
mov dword [ebp - 0xad4], ecx
mov ecx, dword [edi + 0xc]
mov edx, dword [ecx]
mov dword [ebp - 0xad8], edx
mov ecx, dword [ecx + 8]
mov eax, dword [eax + 8]
push ecx
push eax
push 0x10077a8
push 5
mov esi, 0x1035128
jmp 0x101fd98
mov ecx, dword [edi + 0xc]
lea eax, [ebp - 0xad8]
push eax
call fcn.01030284
mov dword [ebp - 0xaac], eax
cmp eax, ebx
je 0x1020158
push 0x80
lea eax, [ebp - 0xa9c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xa9c]
push eax
push dword [ebp - 0xaa4]
call fcn.0101f9ed
cmp eax, ebx
jl 0x101fd88
push 2
pop ecx
cmp word [ebp - 0xa9c], cx
jne 0x101fd88
mov eax, dword [ebp - 0xaa8]
mov eax, dword [eax + 4]
cmp dword [ebp - 0xa98], eax
je 0x101fdc5
push eax
push dword [ebp - 0xa98]
push 0x10076d0
push ecx
push ecx
jmp 0x101fd9a
movzx ecx, word [ebp - 0xa9c]
push ecx
push eax
push 0x10075d8
push 2
push 2
push esi
call fcn.0102ca9a
mov ecx, dword [edi + 8]
add esp, 0x18
lea eax, [ebp - 0xad4]
push eax
call fcn.01030284
mov dword [ebp - 0xaa4], eax
cmp eax, ebx
jne 0x101fd13
jmp 0x1020158
push 0x1007528
push 4
push ecx
push esi
call fcn.0102ca9a
add esp, 0x10
mov dword [ebp - 0xaa0], ebx
mov dword [ebp - 0xac8], ebx
mov dword [ebp - 0xac4], ebx
mov dword [ebp - 0xac0], ebx
push 0x2001f
push 0x1002430
push 0x80000002
lea ecx, [ebp - 0xac8]
mov dword [ebp - 4], ebx
call fcn.0101c831
cmp eax, ebx
jne 0x1020117
mov eax, dword [ebp - 0xaac]
push dword [eax]
mov dword [ebp - 0xaa8], ebx
push 0x10074a0
push 5
push 2
push esi
call fcn.0102ca9a
mov eax, dword [ebp - 0xaac]
mov eax, dword [eax]
add esp, 0x14
lea ecx, [ebp - 0xaa8]
push ecx
push eax
lea ecx, [ebp - 0xac8]
call fcn.0101f767
cmp eax, ebx
je 0x101fe84
jle 0x101fe5e
and eax, 0xffff
or eax, 0x80070000
push eax
mov dword [ebp - 0xaa4], eax
mov eax, dword [ebp - 0xaac]
push dword [eax]
push 0x1007450
push 5
push 2
push esi
call fcn.0102ca9a
add esp, 0x18
jmp 0x102013c
push dword [ebp - 0xaa8]
mov edi, dword [ebp - 0xaac]
mov eax, dword [edi]
push eax
push 0x10073d0
push ebx
push 0x10
push esi
call fcn.0102ca9a
xor eax, eax
add esp, 0x18
cmp dword [ebp - 0xaa8], 1
mov dword [ebp - 0xabc], ebx
sete al
mov dword [ebp - 0xab8], ebx
mov dword [ebp - 0xab4], ebx
mov dword [ebp - 0xaac], eax
push ebx
push ebx
push 0x2001f
push ebx
push ebx
push dword [ebp - 0xab0]
lea ecx, [ebp - 0xabc]
push dword [ebp - 0xac8]
mov byte [ebp - 4], 1
call fcn.0101c7dc
cmp eax, ebx
je 0x101ff19
jle 0x101fefc
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x1007338
push ebx
push 0x10
push esi
mov dword [ebp - 0xaa0], eax
call fcn.0102ca9a
add esp, 0x14
jmp 0x102010a
push dword [ebp - 0xaa4]
lea ecx, [ebp - 0xaa4]
call fcn.0101ccb7
push 1
push dword [ebp - 0xaa4]
lea ecx, [ebp - 0xabc]
push 0x1007320
mov byte [ebp - 4], 2
call fcn.0101c890
cmp eax, ebx
je 0x101ff79
jle 0x101ff56
and eax, 0xffff
or eax, 0x80070000
push eax
push dword [ebp - 0xaa4]
mov dword [ebp - 0xaa0], eax
push 0x1007258
push ebx
push 0x10
push esi
call fcn.0102ca9a
add esp, 0x18
jmp 0x10200fe
lea eax, [ebp - 0xab0]
push eax
lea eax, [ebp - 0x218]
push eax
push 0x1002100
lea ecx, [ebp - 0xabc]
mov dword [ebp - 0xab0], 0x104
call fcn.0101f7a6
test eax, eax
jne 0x1020036
mov eax, dword [edi]
lea ecx, [ebp - 0x218]
push ecx
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1020036
lea eax, [ebp - 0xaa8]
push eax
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0xac8]
call fcn.0101f767
test eax, eax
jne 0x1020036
cmp dword [ebp - 0xaa8], 2
jne 0x1020036
push 4
lea eax, [ebp - 0xab0]
push eax
push 4
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0xac8]
mov dword [ebp - 0xab0], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
push 1
lea eax, [ebp - 0x218]
push eax
jne 0x1020024
push 0x1007190
push 5
jmp 0x102002b
push 0x10070c8
push 2
push 2
push esi
call fcn.0102ca9a
add esp, 0x18
mov eax, dword [edi]
push 1
push eax
push 0x1002100
lea ecx, [ebp - 0xabc]
call fcn.0101c890
cmp eax, ebx
je 0x102006e
jle 0x102005b
and eax, 0xffff
or eax, 0x80070000
push eax
push dword [edi]
mov dword [ebp - 0xaa0], eax
push 0x1007000
jmp 0x101ff68
push 1
push dword [ebp - 0xad0]
lea ecx, [ebp - 0xabc]
push 0x100262c
call fcn.0101c890
cmp eax, ebx
je 0x10200ad
jle 0x1020096
and eax, 0xffff
or eax, 0x80070000
push eax
push dword [ebp - 0xad0]
mov dword [ebp - 0xaa0], eax
push 0x1006f38
jmp 0x101ff68
push 1
push dword [ebp - 0xacc]
lea ecx, [ebp - 0xabc]
push 0x1006f10
call fcn.0101c890
cmp eax, ebx
je 0x10200ec
jle 0x10200d5
and eax, 0xffff
or eax, 0x80070000
push eax
push dword [ebp - 0xacc]
mov dword [ebp - 0xaa0], eax
push 0x1006e38
jmp 0x101ff68
cmp dword [ebp - 0xaac], ebx
je 0x10200fe
mov eax, dword [edi]
mov ecx, dword [ebp - 0xadc]
mov dword [ecx], eax
push dword [ebp - 0xaa4]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0xabc]
call fcn.0101c7be
jmp 0x102014d
jle 0x1020123
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x1006da8
push 5
push 2
push esi
mov dword [ebp - 0xaa4], eax
call fcn.0102ca9a
add esp, 0x14
cmp dword [edi + 0x40], ebx
jne 0x102014d
mov eax, dword [ebp - 0xaa4]
mov dword [ebp - 0xaa0], eax
lea ecx, [ebp - 0xac8]
call fcn.0101c7be
mov eax, dword [ebp - 0xaa0]
jmp 0x102017a
push 0x1006d20
push ebx
push 0x10
push 0x1035128
call fcn.0102ca9a
mov eax, 0x80070057
add esp, 0x10
call fcn.0102b314
ret 0x14