Function at 0x10021c0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x120], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
inc edi
xor ebx, ebx
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x10c], ebx
call fcn.01002928
push 0x3d
call fcn.01002309
test eax, eax
je 0x10022fd
call fcn.01002928
mov esi, 0x100
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x110], eax
cmp eax, ebx
je 0x1004bea
push 0x22
call fcn.01002309
test eax, eax
jne 0x1004bf9
push 0x64
call fcn.01002309
test eax, eax
je 0x1004c55
mov esi, 0x1001f12
movzx eax, word [esi]
push eax
call fcn.01002309
inc esi
inc esi
test eax, eax
je 0x1004c33
cmp word [esi], bx
jne 0x1002253
cmp dword [ebp - 0x108], ebx
je 0x10022d8
call fcn.01002928
push dword [ebp - 0x110]
call fcn.01002956
test eax, eax
je 0x1004c44
call fcn.01001f7c
test eax, eax
je 0x1004c44
push 4
pop edi
mov esi, edi
cmp dword [ebp - 0x108], ebx
je 0x10022d8
cmp dword [0x101d064], 0x500
jb 0x1004d65
push esi
push dword [ebp - 0x110]
push edi
push ebx
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1004dc1
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x10c], ebx
jne 0x10022fd
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100160d
leave
ret 8
call fcn.0100d73f
jmp 0x10022ec
mov dword [0x101d068], 0x84
jmp 0x10022ec
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x114], esi
call fcn.0100233e
test eax, eax
je 0x1004c28
call fcn.01001f7c
test eax, eax
jne 0x1004d4e
mov dword [ebp - 0x10c], edi
jmp 0x1004d48
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], edi
jmp 0x1002266
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], edi
jmp 0x1002298
push 0x2d
call fcn.01002309
test eax, eax
je 0x1004c8b
call fcn.01001f7c
test eax, eax
jne 0x1004c74
mov dword [ebp - 0x10c], edi
jmp 0x10022d8
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x10022d8
mov esi, 0x1005518
movzx eax, word [esi]
push eax
call fcn.01002309
inc esi
inc esi
test eax, eax
jne 0x1004cab
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], edi
cmp word [esi], bx
jne 0x1004c90
cmp dword [ebp - 0x108], ebx
je 0x10022d8
push 0x28
call fcn.01002309
test eax, eax
je 0x1004db9
lea eax, [ebp - 0x114]
push eax
call fcn.01002956
test eax, eax
je 0x1004ce6
push 0x29
call fcn.01002309
test eax, eax
jne 0x1004cf2
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], edi
mov edi, dword [ebp - 0x114]
cmp dword [ebp - 0x108], ebx
je 0x10022d8
mov eax, dword [ebp - 0x110]
push 0x3a
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], 0x100
call fcn.01002309
test eax, eax
je 0x1004d3e
lea eax, [ebp - 0x118]
push eax
call fcn.0100dbaa
test eax, eax
je 0x1004d3e
call fcn.01001f7c
test eax, eax
jne 0x1004d4e
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x108], ebx
mov eax, dword [ebp - 0x118]
mov esi, dword [ebp - 0x114]
mov dword [ebp - 0x110], eax
jmp 0x100229d
cmp edi, 2
je 0x1004d73
cmp edi, 7
jne 0x10022b5
push ebx
push ebx
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x11c]
mov byte [ebp - 0x104], bl
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push dword [ebp - 0x110]
lea eax, [ebp - 0x104]
push edi
push ebx
push eax
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x10022d0
push 3
pop edi
jmp 0x1004cf8
mov dword [0x101d068], 0x84
jmp 0x10022d8