Function at 0x1008739
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x100d008]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
xor ebx, ebx
inc edi
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x114], ebx
call fcn.010081b4
push 0x3d
call fcn.01007c18
test eax, eax
je 0x1008a25
call fcn.010081b4
mov esi, 0x100
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 0x10c], eax
jne 0x10087b8
mov dword [0x100d684], 0x2c1
jmp 0x1008a2a
push 0x22
call fcn.01007c18
test eax, eax
je 0x10087fd
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x114], esi
call fcn.01008021
test eax, eax
je 0x10087f2
call fcn.01008136
test eax, eax
jne 0x1008969
mov dword [ebp - 0x110], edi
jmp 0x1008963
push 0x64
call fcn.01007c18
test eax, eax
je 0x100886e
mov esi, 0x100196e
xor eax, eax
mov ax, word [esi]
push eax
call fcn.01007c18
inc esi
inc esi
test eax, eax
jne 0x100882a
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x110], edi
cmp word [esi], bx
jne 0x100880d
cmp dword [ebp - 0x108], ebx
je 0x1008a11
call fcn.010081b4
push dword [ebp - 0x10c]
call fcn.010084c1
test eax, eax
je 0x1008858
call fcn.01008136
test eax, eax
jne 0x1008864
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x110], edi
push 4
pop edi
mov esi, edi
jmp 0x100897b
push 0x2d
call fcn.01007c18
test eax, eax
je 0x10088a4
call fcn.01008136
test eax, eax
jne 0x100888d
mov dword [ebp - 0x110], edi
jmp 0x1008a11
push dword [ebp - 0x120]
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1008a11
mov esi, 0x1001964
xor eax, eax
mov ax, word [esi]
push eax
call fcn.01007c18
inc esi
inc esi
test eax, eax
jne 0x10088c6
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x110], edi
cmp word [esi], bx
jne 0x10088a9
cmp dword [ebp - 0x108], ebx
je 0x1008a11
push 0x28
call fcn.01007c18
test eax, eax
je 0x10089e0
lea eax, [ebp - 0x114]
push eax
call fcn.010084c1
test eax, eax
je 0x1008901
push 0x29
call fcn.01007c18
test eax, eax
jne 0x100890d
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x110], edi
mov edi, dword [ebp - 0x114]
cmp dword [ebp - 0x108], ebx
je 0x1008a11
mov eax, dword [ebp - 0x10c]
push 0x3a
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], 0x100
call fcn.01007c18
test eax, eax
je 0x1008959
lea eax, [ebp - 0x118]
push eax
call fcn.010085fa
test eax, eax
je 0x1008959
call fcn.01008136
test eax, eax
jne 0x1008969
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x108], ebx
mov eax, dword [ebp - 0x118]
mov esi, dword [ebp - 0x114]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x108], ebx
je 0x1008a11
cmp dword [0x100d680], 0x500
jae 0x10089e8
cmp edi, 2
je 0x100899d
cmp edi, 7
jne 0x10089e8
push ebx
push ebx
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x120]
mov byte [ebp - 0x104], bl
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push dword [ebp - 0x10c]
lea eax, [ebp - 0x104]
push edi
push ebx
push eax
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x1008a03
push 3
pop edi
jmp 0x1008913
push esi
push dword [ebp - 0x10c]
push edi
push ebx
push dword [ebp - 0x120]
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1008a11
mov dword [0x100d684], 0x2c1
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x110], ebx
je 0x1008a2a
call fcn.010081e4
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010092ae
leave
ret 8