Function at 0x100b714
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x10191f4]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x120], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
inc edi
xor ebx, ebx
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x10c], ebx
call fcn.0100b11f
push 0x3d
call fcn.0100ac54
test eax, eax
je 0x100b9fa
call fcn.0100b11f
mov esi, 0x100
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 0x110], eax
jne 0x100b78d
mov dword [0x1019978], 0x84
jmp 0x100b9ff
push 0x22
call fcn.0100ac54
test eax, eax
je 0x100b7d2
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x114], esi
call fcn.0100af4a
test eax, eax
je 0x100b7c7
call fcn.0100b0a1
test eax, eax
jne 0x100b93e
mov dword [ebp - 0x10c], edi
jmp 0x100b938
push 0x64
call fcn.0100ac54
test eax, eax
je 0x100b843
mov esi, 0x1001abe
xor eax, eax
mov ax, word [esi]
push eax
call fcn.0100ac54
inc esi
inc esi
test eax, eax
jne 0x100b7ff
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], edi
cmp word [esi], bx
jne 0x100b7e2
cmp dword [ebp - 0x108], ebx
je 0x100b9e6
call fcn.0100b11f
push dword [ebp - 0x110]
call fcn.0100b43e
test eax, eax
je 0x100b82d
call fcn.0100b0a1
test eax, eax
jne 0x100b839
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], edi
push 4
pop edi
mov esi, edi
jmp 0x100b950
push 0x2d
call fcn.0100ac54
test eax, eax
je 0x100b879
call fcn.0100b0a1
test eax, eax
jne 0x100b862
mov dword [ebp - 0x10c], edi
jmp 0x100b9e6
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x100b9e6
mov esi, 0x1001ab4
xor eax, eax
mov ax, word [esi]
push eax
call fcn.0100ac54
inc esi
inc esi
test eax, eax
jne 0x100b89b
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], edi
cmp word [esi], bx
jne 0x100b87e
cmp dword [ebp - 0x108], ebx
je 0x100b9e6
push 0x28
call fcn.0100ac54
test eax, eax
je 0x100b9b5
lea eax, [ebp - 0x114]
push eax
call fcn.0100b43e
test eax, eax
je 0x100b8d6
push 0x29
call fcn.0100ac54
test eax, eax
jne 0x100b8e2
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], edi
mov edi, dword [ebp - 0x114]
cmp dword [ebp - 0x108], ebx
je 0x100b9e6
mov eax, dword [ebp - 0x110]
push 0x3a
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], 0x100
call fcn.0100ac54
test eax, eax
je 0x100b92e
lea eax, [ebp - 0x118]
push eax
call fcn.0100b5a7
test eax, eax
je 0x100b92e
call fcn.0100b0a1
test eax, eax
jne 0x100b93e
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x108], ebx
mov eax, dword [ebp - 0x118]
mov esi, dword [ebp - 0x114]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x108], ebx
je 0x100b9e6
cmp dword [0x1019974], 0x500
jae 0x100b9bd
cmp edi, 2
je 0x100b972
cmp edi, 7
jne 0x100b9bd
push ebx
push ebx
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x11c]
mov byte [ebp - 0x104], bl
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push dword [ebp - 0x110]
lea eax, [ebp - 0x104]
push edi
push ebx
push eax
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x100b9d8
push 3
pop edi
jmp 0x100b8e8
push esi
push dword [ebp - 0x110]
push edi
push ebx
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100b9e6
mov dword [0x1019978], 0x84
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x10c], ebx
je 0x100b9ff
call fcn.0100b14f
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01016b82
leave
ret 8