Function at 0x100f6b1
Capabilities:
Change registry key timestamp
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x884
mov eax, dword [0x101203c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [ebp - 0x860], eax
xor eax, eax
mov word [ebp - 0x81c], si
lea edi, [ebp - 0x81a]
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov word [ebp - 0x844], si
xor eax, eax
lea edi, [ebp - 0x842]
stosd dword es:[edi], eax
push 0x25
push ebx
mov dword [ebp - 0x808], ebx
mov dword [ebp - 0x810], esi
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], esi
mov dword [ebp - 0x83c], esi
stosw word es:[edi], ax
mov dword [ebp - 0x820], esi
mov dword [ebp - 0x80c], esi
mov dword [ebp - 0x814], esi
call fcn.01008306
test eax, eax
pop ecx
pop ecx
je 0x100f829
push dword [ebp - 0x808]
xor ebx, ebx
lea eax, [ebp - 0x884]
inc ebx
push eax
mov dword [ebp - 0x83c], ebx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov edi, dword [sym.imp.ntdll.dll_RtlExpandEnvironmentStrings_U]
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x884]
push eax
push esi
call edi
cmp eax, 0xc0000023
je 0x100f792
cmp dword [0x10125b0], esi
je 0x100f7ce
push eax
push dword [ebp - 0x808]
push 0x1003b90
jmp 0x100f7c0
push dword [ebp - 0x814]
call fcn.0100ff49
cmp eax, esi
mov dword [ebp - 0x818], eax
jne 0x100f7d5
cmp dword [0x10125b0], esi
je 0x100f7ce
push dword [ebp - 0x808]
push dword [ebp - 0x814]
push 0x1003b54
push 0x1003b40
push ebx
call fcn.0100ff93
add esp, 0x14
xor eax, eax
jmp 0x100fc5d
mov ax, word [ebp - 0x814]
mov word [ebp - 0x81a], ax
lea eax, [ebp - 0x814]
push eax
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x884]
push eax
push esi
mov word [ebp - 0x81c], si
mov dword [ebp - 0x834], ebx
call edi
cmp eax, esi
jge 0x100f83a
cmp dword [0x10125b0], esi
je 0x100fc03
push eax
push dword [ebp - 0x808]
push 0x1003b90
jmp 0x100fb9d
push ebx
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor ebx, ebx
inc ebx
lea eax, [ebp - 0x810]
push eax
push dword [ebp - 0x818]
call fcn.0100ed21
test eax, eax
jne 0x100f86c
cmp dword [0x10125b0], esi
je 0x100fc03
push dword [ebp - 0x808]
push 0x1003b10
jmp 0x100fbed
mov eax, dword [ebp - 0x810]
test byte [eax], 1
jne 0x100f893
cmp dword [0x10125b0], esi
je 0x100fc03
push dword [ebp - 0x808]
push 0x1003ae4
jmp 0x100fbed
lea ecx, [ebp - 0x844]
push ecx
add eax, 0x10
push eax
call fcn.01010496
cmp eax, esi
jge 0x100f8be
cmp dword [0x10125b0], esi
je 0x100fc03
push eax
push 0x1003ab0
jmp 0x100fbed
mov edi, dword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
lea eax, [ebp - 0x804]
mov dword [ebp - 0x824], eax
mov ebx, 0x10039f8
push ebx
lea eax, [ebp - 0x828]
push eax
mov word [ebp - 0x828], si
mov word [ebp - 0x826], 0x800
call edi
push 0x1001254
lea eax, [ebp - 0x828]
push eax
call edi
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
lea eax, [ebp - 0x844]
push eax
call fcn.01010531
push ebx
lea eax, [ebp - 0x87c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x87c]
mov dword [ebp - 0x854], eax
lea eax, [ebp - 0x864]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x85c]
push eax
mov dword [ebp - 0x85c], 0x18
mov dword [ebp - 0x858], esi
mov dword [ebp - 0x850], 0x40
mov dword [ebp - 0x84c], esi
mov dword [ebp - 0x848], esi
call fcn.0100f368
mov edi, dword [sym.imp.ntdll.dll_NtCreateKey]
mov ebx, 0x2000f
or eax, ebx
push eax
lea eax, [ebp - 0x820]
push eax
call edi
cmp eax, esi
jge 0x100f9b2
cmp dword [0x10125b0], esi
je 0x100fc03
push eax
push dword [ebp - 0x878]
push 0x10039cc
push 0x1003b40
push 1
jmp 0x100fba3
lea eax, [ebp - 0x828]
mov dword [ebp - 0x854], eax
lea eax, [ebp - 0x864]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x85c]
push eax
mov dword [ebp - 0x85c], 0x18
mov dword [ebp - 0x858], esi
mov dword [ebp - 0x850], 0x40
mov dword [ebp - 0x84c], esi
mov dword [ebp - 0x848], esi
call fcn.0100f368
or eax, ebx
push eax
lea eax, [ebp - 0x80c]
push eax
call edi
cmp eax, esi
jge 0x100fa24
cmp dword [0x10125b0], esi
je 0x100fc03
push eax
push dword [ebp - 0x824]
push 0x10039a4
jmp 0x100f9a6
push dword [ebp - 0x808]
call fcn.010080f4
mov edi, dword [sym.imp.ntdll.dll_NtSetValueKey]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x808]
xor eax, eax
cmp dword [ebp - 0x83c], esi
setne al
inc eax
push eax
push esi
push 0x10125d8
push dword [ebp - 0x80c]
call edi
cmp eax, esi
jge 0x100fa8a
cmp dword [0x10125b0], esi
je 0x100fc03
push eax
push dword [ebp - 0x808]
push dword [0x10125dc]
push 0x1003974
push 0x1003b40
push 1
jmp 0x100fb20
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push 0x10125e0
push dword [ebp - 0x80c]
call edi
cmp eax, esi
jge 0x100fac1
cmp dword [0x10125b0], esi
je 0x100fc03
push eax
push dword [ebp + 0xc]
push dword [0x10125e4]
push 0x1003944
jmp 0x100fa7e
mov eax, dword [ebp - 0x810]
mov eax, dword [eax + 0xc]
cmp eax, esi
je 0x100fb2d
push eax
call fcn.010080f4
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x810]
push dword [eax + 0xc]
xor ebx, ebx
inc ebx
push ebx
push esi
push 0x10125e8
push dword [ebp - 0x80c]
call edi
cmp eax, esi
jge 0x100fb30
cmp dword [0x10125b0], esi
je 0x100fc03
push eax
mov eax, dword [ebp - 0x810]
push dword [eax + 0xc]
push dword [0x10125ec]
push 0x1003944
push 0x1003b40
push ebx
call fcn.0100ff93
add esp, 0x18
jmp 0x100fc03
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x860]
cmp eax, esi
jne 0x100fb5b
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x874]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp - 0x870]
jmp 0x100fb66
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebp - 0x830], ecx
push 8
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x830]
push eax
push 0xb
push esi
push 0x10125f0
push dword [ebp - 0x80c]
call edi
cmp eax, esi
jge 0x100fbad
cmp dword [0x10125b0], esi
je 0x100fc03
push eax
push dword [0x10125f4]
push 0x100391c
push 0x1003b40
push ebx
call fcn.0100ff93
add esp, 0x14
jmp 0x100fc03
mov eax, dword [ebp - 0x830]
mov dword [ebp - 0x86c], eax
mov eax, dword [ebp - 0x82c]
push 8
mov dword [ebp - 0x868], eax
lea eax, [ebp - 0x86c]
push eax
push esi
push dword [ebp - 0x80c]
call dword [sym.imp.ntdll.dll_NtSetInformationKey]
cmp eax, esi
jge 0x100fbfd
cmp dword [0x10125b0], esi
je 0x100fc03
push eax
push 0x10038e8
push 0x1003b40
push ebx
call fcn.0100ff93
add esp, 0x10
jmp 0x100fc03
mov dword [ebp - 0x838], ebx
cmp dword [ebp - 0x810], esi
je 0x100fc16
push dword [ebp - 0x810]
call fcn.0100e741
cmp dword [ebp - 0x834], esi
je 0x100fc31
cmp dword [ebp - 0x818], esi
je 0x100fc31
push dword [ebp - 0x818]
call fcn.0100ff6e
cmp dword [ebp - 0x80c], esi
mov edi, dword [sym.imp.ntdll.dll_NtClose]
je 0x100fc47
push dword [ebp - 0x80c]
call edi
cmp dword [ebp - 0x820], esi
je 0x100fc57
push dword [ebp - 0x820]
call edi
mov eax, dword [ebp - 0x838]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01007b7f
leave
ret 0xc