Function at 0x101fd99
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
push eax
push 0x1006db0
push dword [ebp + 8]
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1020484
cmp dword [ebp + 8], 0x80000002
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
pop ebx
jne 0x10201af
push ebx
lea eax, [edi + 0x104]
push eax
push ebx
push 0
push 0x1008b70
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x110]
push eax
push ebx
push 0
push 0x1008b54
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x164]
push eax
push ebx
push 0
push 0x1008b38
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x170]
push eax
push ebx
push 0
push 0x1008b18
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x17c]
push eax
push ebx
push 0
push 0x1008afc
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x14c]
push eax
push ebx
push 0
push 0x1008adc
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x11c]
push eax
push ebx
push 0
push 0x1008ac4
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x128]
push eax
push ebx
push 0
push 0x1008aac
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x134]
push eax
push ebx
push 0
push 0x1008a98
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x140]
push eax
push ebx
push 0
push 0x1008a80
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x158]
push eax
push ebx
push 0
push 0x1008a60
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x188]
push eax
push ebx
push 0
push 0x1008a48
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x194]
push eax
push ebx
push 0
push 0x1008a30
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x1a0]
push eax
push ebx
push 0
push 0x1008a14
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x1ac]
push eax
push ebx
push 0
push 0x10089f8
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x1b8]
push eax
push ebx
push 0
push 0x10089dc
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x1c4]
push eax
push ebx
push 0
push 0x10089c0
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x108]
push eax
push ebx
push 0
push 0x10089a0
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x114]
push eax
push ebx
push 0
push 0x1008984
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x168]
push eax
push ebx
push 0
push 0x1008968
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x174]
push eax
push ebx
push 0
push 0x1008948
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x180]
push eax
push ebx
push 0
push 0x100892c
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x150]
push eax
push ebx
push 0
push 0x100890c
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x120]
push eax
push ebx
push 0
push 0x10088f4
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x12c]
push eax
push ebx
push 0
push 0x10088dc
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x138]
push eax
push ebx
push 0
push 0x10088c8
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x144]
push eax
push ebx
push 0
push 0x10088b0
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x15c]
push eax
push ebx
push 0
push 0x1008890
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x18c]
push eax
push ebx
push 0
push 0x1008878
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x198]
push eax
push ebx
push 0
push 0x1008860
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x1a4]
push eax
push ebx
push 0
push 0x1008844
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x1b0]
push eax
push ebx
push 0
push 0x1008828
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x1bc]
push eax
push ebx
push 0
push 0x100880c
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x1c8]
push eax
push ebx
push 0
push 0x1010330
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x9c]
push eax
push ebx
push 0
push 0x100701c
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xa0]
push eax
push ebx
push 0
push 0x1007008
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xbc]
push eax
push ebx
push 0
push 0x1006ff4
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xc0]
push eax
push ebx
push 0
push 0x1006fdc
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xc4]
push eax
push ebx
push 0
push 0x1006fc8
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xb4]
push eax
push ebx
push 0
push 0x1006fb0
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xa4]
push eax
push ebx
push 0
push 0x1006fa0
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xa8]
push eax
push ebx
push 0
push 0x1006f90
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xac]
push eax
push ebx
push 0
push 0x1006f84
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xb0]
push eax
push ebx
push 0
push 0x1006f74
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xb8]
push eax
push ebx
push 0
push 0x1006f5c
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xc8]
push eax
push ebx
push 0
push 0x1006f4c
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xe4]
push eax
push ebx
push 0
push 0x1006f3c
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xcc]
push eax
push ebx
push 0
push 0x1006f2c
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xd0]
push eax
push ebx
push 0
push 0x1006f18
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xd4]
push eax
push ebx
push 0
push 0x1006f04
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xd8]
push eax
push ebx
push 0
push 0x1006ef0
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0xdc]
push eax
push ebx
push 0
push 0x1006edc
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x2d4]
push eax
push ebx
push 0
push 0x1006eb4
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x2d8]
push eax
push ebx
push 0
push 0x1006e8c
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x2dc]
push eax
push ebx
push 0
push 0x1006e74
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x8c]
push eax
push ebx
push 0
push 0x1006e5c
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x98]
push eax
push ebx
push 0
push 0x1006e3c
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
push ebx
lea eax, [edi + 0x94]
push eax
push ebx
push 0
push 0x1006e24
push dword [ebp - 4]
call esi
test eax, eax
jne 0x1020479
mov eax, dword [edi + 0x90]
neg eax
sbb eax, eax
add eax, 3
push ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push ebx
push 0
push 0x1006e10
push dword [ebp - 4]
call esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
xor eax, eax
pop edi
leave
ret 4