Function at 0x100d7de
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x1001ce8
push eax
call fcn.010027cc
lea ecx, [ebp - 0x210]
push ecx
push 2
push 0
push 0
push eax
mov dword [ebp - 0x210], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100da4a
lea eax, [ebp - 0x208]
push eax
call fcn.01002090
test eax, eax
je 0x100da30
push ebx
push esi
push edi
dec dword [0x105d104]
push 0x5c
call fcn.01002309
test eax, eax
je 0x100d852
mov esi, 0x100da68
jmp 0x100d861
cmp word [0x1001ce8], 0
mov esi, 0x1001ce8
je 0x100d87a
movzx eax, word [esi]
push eax
call fcn.01002309
inc esi
inc esi
test eax, eax
je 0x100da14
cmp word [esi], 0
jne 0x100d861
push 0x5c
call fcn.01002309
mov edi, eax
test edi, edi
je 0x100da14
xor esi, esi
jmp 0x100d8b6
mov ecx, dword [ebp - 0x208]
cmp cx, 0x20
je 0x100d8ca
push ecx
call fcn.01001fe0
test eax, eax
jne 0x100d8ca
cmp esi, 0xff
jae 0x100d8c8
mov word [ebp + esi*2 - 0x204], cx
inc esi
lea eax, [ebp - 0x208]
push eax
call fcn.01002090
test eax, eax
je 0x100d8ca
jmp 0x100d88f
xor edi, edi
test edi, edi
je 0x100da14
xor eax, eax
mov edi, 0x100
mov dword [ebp - 0x20c], edi
mov word [ebp + esi*2 - 0x204], ax
call fcn.01002928
push 0x3d
call fcn.01002309
test eax, eax
je 0x100d8fe
push 0x20
call fcn.01002309
push edi
push 0x40
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
xor eax, eax
test esi, esi
setne al
mov edi, eax
jmp 0x100d991
test edi, edi
je 0x100d9fb
push dword [ebp - 0x208]
call fcn.01001fe0
test eax, eax
jne 0x100d9a8
mov eax, dword [ebp - 0x20c]
lea ecx, [eax - 1]
cmp ebx, ecx
jb 0x100d985
and dword [ebp - 0x20c], 0
lea ecx, [ebp - 0x20c]
push ecx
push 0x100
push eax
call fcn.0100e39f
test eax, eax
jl 0x100d9a6
push 2
push dword [ebp - 0x20c]
push esi
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
xor ecx, ecx
test eax, eax
setne cl
mov edi, ecx
test edi, edi
je 0x100d9fb
mov esi, eax
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x20c], eax
mov ax, word [ebp - 0x208]
mov word [esi + ebx*2], ax
inc ebx
lea eax, [ebp - 0x208]
push eax
call fcn.01002090
test eax, eax
je 0x100d9a8
jmp 0x100d916
xor edi, edi
test edi, edi
je 0x100d9fb
lea eax, [ebp - 0x214]
push eax
push 2
pop ecx
mov eax, ebx
mul ecx
push edx
push eax
call fcn.0100d4a6
test eax, eax
jl 0x100d9f7
push dword [ebp - 0x214]
xor eax, eax
push esi
mov word [esi + ebx*2], ax
push 1
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
test eax, eax
je 0x100da05
mov dword [0x101d068], 0x84
jmp 0x100da05
xor edi, edi
jmp 0x100da05
mov dword [0x101d068], 0x132
test esi, esi
je 0x100da10
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
test edi, edi
jne 0x100da19
call fcn.0100d73f
lea eax, [ebp - 0x208]
push eax
call fcn.01002090
test eax, eax
jne 0x100d83a
pop edi
pop esi
pop ebx
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100da54
mov dword [0x101d068], 0x83
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100160d
leave
ret 4