Function at 0x100021d0
Capabilities:
Get session user name
Set registry value

Disassembly:
sub esp, 0x11c
mov eax, dword [0x100215e0]
push ebx
push ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push esi
push edi
mov dword [esp + 0x128], eax
xor ebp, ebp
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push 0x1002a5e0
push 0x80000002
mov dword [esp + 0x38], ebp
xor esi, esi
mov dword [esp + 0x34], ebp
call ebx
cmp eax, ebp
jne 0x10002225
mov edx, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 0x14], edx
cmp eax, ebp
mov edi, eax
jne 0x100023c7
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push 0x1002a4d8
push 0x80000002
mov dword [esp + 0x34], ebp
call ebx
cmp eax, ebp
jne 0x1000225c
mov esi, dword [esp + 0x10]
xor eax, eax
cmp eax, ebp
mov edi, eax
jne 0x100023bc
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x100022a7
mov edi, dword [str.Installer]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea edx, [esp + 0x28]
push edx
push 1
push ebp
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x100022cf
mov eax, dword [str.Unknown]
mov ebx, dword [str.Installer]
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push 1
push ebp
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ebp
call fcn.1000f72c
mov ecx, dword [str.InstallTime]
add esp, 4
push 8
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x1c]
push eax
push 0xb
push ebp
push ecx
push esi
mov dword [esp + 0x34], edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp esi, ebp
je 0x10002305
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov edi, dword [esp + 0x14]
cmp edi, ebp
je 0x1000231a
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], ebp
mov edi, ebp
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push 0x1002a5e0
push 0x80000001
mov dword [esp + 0x34], ebp
call ebx
cmp eax, ebp
jne 0x10002356
xor eax, eax
cmp edi, ebp
je 0x1000234e
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], ecx
cmp eax, ebp
mov edi, eax
jne 0x100023bc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push ebp
push 0x2001f
push ebp
push ebp
push ebp
push 0x1002a4d8
push 0x80000001
mov dword [esp + 0x34], ebp
call ebx
cmp eax, ebp
jne 0x10002394
xor eax, eax
cmp esi, ebp
je 0x10002390
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x10]
cmp eax, ebp
mov edi, eax
jne 0x100023bc
mov edx, dword [str.IsInstaller]
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push ebp
push edx
push esi
mov dword [esp + 0x28], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, eax
cmp esi, ebp
je 0x100023c7
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x100023d6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x128]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
call fcn.1000e24e
add esp, 0x11c
ret