Function at 0x101e715
Capabilities:
Set registry value

Disassembly:
push 0x88
mov eax, 0x1020b14
call fcn.01017678
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x88], eax
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x70], ebx
lea edi, [ebp - 0x6c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x84], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x8c], 1
stosd dword es:[edi], eax
call fcn.0101ee93
mov edi, dword [ebp - 0x84]
mov esi, eax
lea eax, [edi + 0x10]
push eax
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x90], eax
call fcn.0101e272
push 0x100255c
lea ecx, [ebp - 0x84]
mov dword [ebp - 4], ebx
call fcn.0100ef81
push 0x5c
pop eax
cmp ax, word [esi]
jne 0x101e798
inc esi
inc esi
push esi
lea ecx, [ebp - 0x84]
call fcn.0100ef81
push 2
pop eax
cmp dword [ebp + 0x10], eax
jne 0x101e7af
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x80]
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x94]
mov ecx, edi
call fcn.0101e5e7
cmp eax, ebx
jge 0x101e7e3
mov esi, eax
push dword [ebp - 0x84]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
call fcn.010176cc
ret 0xc
push 0x28
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x101e7fe
mov esi, 0x8007007a
jmp 0x101e7cd
cmp dword [ebp - 0x74], ebx
je 0x101e82f
push dword [ebp - 0x88]
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x74]
mov ecx, edi
call fcn.0101e2a7
mov esi, eax
cmp esi, ebx
jge 0x101e829
push esi
call fcn.0100c562
test al, al
jne 0x101e82f
jmp 0x101e7cd
mov dword [ebp - 0x8c], ebx
cmp dword [ebp + 0x10], 2
jne 0x101e8c1
cmp dword [ebp - 0x8c], ebx
jne 0x101e846
cmp dword [ebp - 0x74], ebx
jne 0x101e8c1
mov dword [ebp - 0x78], 1
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x78], eax
je 0x101e87d
push dword [ebp - 0x88]
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x78]
mov ecx, edi
call fcn.0101e2a7
mov esi, eax
cmp esi, ebx
jge 0x101e888
push esi
call fcn.0100c562
test al, al
je 0x101e7cd
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], 4
jl 0x101e84d
jmp 0x101e88e
mov dword [ebp - 0x8c], ebx
cmp dword [ebp - 0x74], ebx
jne 0x101e8c1
push dword [ebp - 0x88]
mov ecx, edi
push dword [ebp - 0x94]
call fcn.0101e205
mov esi, eax
cmp esi, ebx
jge 0x101e8bb
push esi
call fcn.0100c562
test al, al
jne 0x101e8c1
jmp 0x101e7cd
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x7c], ebx
push dword [ebp - 0x90]
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.0101e272
push 0x10025c0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.0100ef81
push dword [ebp - 0x88]
lea eax, [ebp - 0x7c]
push eax
mov edi, 0x20019
push edi
push dword [ebp - 0x74]
mov esi, 0x80000002
push esi
call fcn.0101ec90
cmp eax, ebx
je 0x101e92d
jle 0x101e915
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push dword [ebp - 0x74]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x7c]
call fcn.0101dd55
jmp 0x101e7cd
push dword [ebp - 0x88]
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x7c]
call fcn.0101ece2
cmp eax, ebx
je 0x101e94e
cmp eax, 2
je 0x101e954
cmp eax, ebx
jg 0x101e90b
jmp 0x101e915
mov dword [ebp - 0x8c], ebx
cmp dword [ebp + 0x10], 1
jne 0x101e9cd
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x80], ebx
push dword [ebp - 0x88]
lea eax, [ebp - 0x80]
push eax
push 2
push dword [ebp - 0x84]
mov byte [ebp - 4], 3
push esi
call fcn.0101ec90
cmp eax, ebx
je 0x101e99e
jle 0x101e98f
and eax, 0xffff
or eax, 0x80070000
lea ecx, [ebp - 0x80]
mov esi, eax
call fcn.0101dd55
jmp 0x101e917
push 4
lea eax, [ebp - 0x90]
push eax
push 4
push ebx
push 0x1002548
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_RegSetValueExW]
cmp eax, ebx
je 0x101e9c0
jg 0x101e985
jmp 0x101e98f
lea ecx, [ebp - 0x80]
call fcn.0101dd55
jmp 0x101ea83
cmp dword [ebp + 0x10], ebx
jne 0x101ea83
push 0x5c
push dword [ebp - 0x84]
call sub.msvcrt.dll_wcsrchr
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x101ea06
push dword [ebp - 0x74]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x7c]
call fcn.0101dd55
mov esi, 0x8000ffff
jmp 0x101e7cd
xor eax, eax
mov word [ebx], ax
and dword [ebp - 0x78], eax
inc ebx
inc ebx
push dword [ebp - 0x88]
lea eax, [ebp - 0x78]
push eax
push edi
push dword [ebp - 0x84]
mov byte [ebp - 4], 4
push esi
call fcn.0101ec90
xor esi, esi
cmp eax, esi
je 0x101ea4a
cmp eax, 2
je 0x101ea50
jmp 0x101ea6d
and eax, 0xffff
or eax, 0x80070000
lea ecx, [ebp - 0x78]
jmp 0x101e992
mov dword [ebp - 0x8c], esi
cmp dword [ebp - 0x78], esi
je 0x101ea79
push dword [ebp - 0x88]
push ebx
push dword [ebp - 0x78]
call fcn.0101ece2
cmp eax, esi
je 0x101ea73
cmp eax, 2
je 0x101ea79
cmp eax, esi
jg 0x101ea38
jmp 0x101ea42
mov dword [ebp - 0x8c], esi
lea ecx, [ebp - 0x78]
call fcn.0101dd55
xor ebx, ebx
push dword [ebp - 0x74]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x7c]
call fcn.0101dd55
cmp dword [ebp - 0x8c], ebx
je 0x101eaa6
mov esi, 0x80070002
jmp 0x101e7cd
xor esi, esi
jmp 0x101e7cd