Function at 0x10197e5
Capabilities:
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x102e0fc]
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x208], esi
jne 0x1019821
mov eax, 0x80004003
jmp 0x1019a9f
push 0x28
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0x20c], eax
jne 0x101983d
mov eax, 0x8007000e
jmp 0x1019a9f
push ebx
push edi
lea eax, [ebp - 0x208]
push eax
push 2
push esi
push 0x1006308
mov ebx, 0x80000001
push ebx
call fcn.0102b456
test eax, eax
jne 0x10198d6
push 0x208
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
mov dword [ebp - 0x214], eax
je 0x10198ca
mov edi, 0x104
push edi
push eax
call fcn.0102be9a
test eax, eax
je 0x10198be
push 0x100696c
push edi
push dword [ebp - 0x214]
call fcn.0100d5b3
push dword [ebp - 0x214]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x214]
push 1
push esi
push 0x100694c
push dword [ebp - 0x208]
call fcn.0102b543
push dword [ebp - 0x214]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100693c
push 0x10068d0
lea eax, [ebp - 0x204]
push 0xff
push eax
call fcn.0100d585
add esp, 0x10
push esi
lea eax, [ebp - 0x208]
push eax
push esi
push 3
push esi
push esi
push esi
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.0102b0de
mov edi, eax
cmp edi, esi
jne 0x1019a37
mov edi, 0x100658c
jmp 0x1019932
cmp dword [0x102fe18], 0x3e8
jge 0x1019962
inc dword [0x102fe18]
push dword [0x102fe18]
push edi
push 0x14
push dword [ebp - 0x20c]
call fcn.0100d585
add esp, 0x10
push esi
push esi
push esi
push esi
push dword [ebp - 0x20c]
push dword [ebp - 0x208]
call fcn.0102b674
test eax, eax
je 0x1019920
push dword [ebp - 0x210]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x210]
push 2
push esi
push dword [ebp - 0x20c]
push dword [ebp - 0x208]
call fcn.0102b543
mov edi, eax
cmp edi, esi
jne 0x101999a
inc dword [0x102fe18]
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x1019a37
cmp dword [ebp - 0x218], esi
je 0x1019a5d
push 0x10068b4
push 0x10068d0
lea eax, [ebp - 0x204]
push 0xff
push eax
call fcn.0100d585
add esp, 0x10
push esi
lea eax, [ebp - 0x208]
push eax
push esi
push 3
push esi
push esi
push esi
lea eax, [ebp - 0x204]
push eax
push ebx
call fcn.0102b0de
mov edi, eax
cmp edi, esi
jne 0x1019a37
push dword [ebp - 0x218]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x218]
push 2
push esi
push dword [ebp - 0x20c]
push dword [ebp - 0x208]
call fcn.0102b543
push dword [ebp - 0x208]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
je 0x1019a5d
jle 0x1019a45
and edi, 0xffff
or edi, 0x80070000
push edi
push dword [ebp - 0x210]
push 0x1006874
push 2
call fcn.01027d6c
add esp, 0x10
jmp 0x1019a8f
push dword [ebp - 0x210]
push 0x1006838
push 5
call fcn.01027d6c
add esp, 0xc
cmp dword [ebp + 0x14], esi
je 0x1019a8a
push esi
push dword [ebp - 0x210]
mov ecx, 0x102fe20
push 8
call fcn.0101857a
mov edi, 0xd2af9
push dword [ebp - 0x20c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov eax, edi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.01016306
leave
ret 0x10