Function at 0x100c8c5
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
xor ebx, ebx
inc edi
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x114], ebx
call fcn.0100c313
push 0x3d
call fcn.0100bd68
test eax, eax
je 0x100cbaf
call fcn.0100c313
mov esi, 0x100
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x10c], eax
cmp eax, ebx
jne 0x100c946
mov dword [0x100f6a4], 0x2c1
jmp 0x100cbb4
push 0x22
call fcn.0100bd68
test eax, eax
je 0x100c98b
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x114], esi
call fcn.0100c18a
test eax, eax
je 0x100c980
call fcn.0100c295
test eax, eax
jne 0x100caf3
mov dword [ebp - 0x110], edi
jmp 0x100caed
push 0x64
call fcn.0100bd68
test eax, eax
je 0x100c9fa
mov esi, 0x10083ca
movzx eax, word [esi]
push eax
call fcn.0100bd68
inc esi
inc esi
test eax, eax
jne 0x100c9b6
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x110], edi
cmp word [esi], bx
jne 0x100c99b
cmp dword [ebp - 0x108], ebx
je 0x100cb9b
call fcn.0100c313
push dword [ebp - 0x10c]
call fcn.0100c641
test eax, eax
je 0x100c9e4
call fcn.0100c295
test eax, eax
jne 0x100c9f0
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x110], edi
push 4
pop edi
mov esi, edi
jmp 0x100cb05
push 0x2d
call fcn.0100bd68
test eax, eax
je 0x100ca30
call fcn.0100c295
test eax, eax
jne 0x100ca19
mov dword [ebp - 0x110], edi
jmp 0x100cb9b
push dword [ebp - 0x120]
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x100cb9b
mov esi, 0x10083c0
movzx eax, word [esi]
push eax
call fcn.0100bd68
inc esi
inc esi
test eax, eax
jne 0x100ca50
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x110], edi
cmp word [esi], bx
jne 0x100ca35
cmp dword [ebp - 0x108], ebx
je 0x100cb9b
push 0x28
call fcn.0100bd68
test eax, eax
je 0x100cb6a
lea eax, [ebp - 0x114]
push eax
call fcn.0100c641
test eax, eax
je 0x100ca8b
push 0x29
call fcn.0100bd68
test eax, eax
jne 0x100ca97
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x110], edi
mov edi, dword [ebp - 0x114]
cmp dword [ebp - 0x108], ebx
je 0x100cb9b
mov eax, dword [ebp - 0x10c]
push 0x3a
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], 0x100
call fcn.0100bd68
test eax, eax
je 0x100cae3
lea eax, [ebp - 0x118]
push eax
call fcn.0100c779
test eax, eax
je 0x100cae3
call fcn.0100c295
test eax, eax
jne 0x100caf3
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x108], ebx
mov eax, dword [ebp - 0x118]
mov esi, dword [ebp - 0x114]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x108], ebx
je 0x100cb9b
cmp dword [0x100f6a0], 0x500
jae 0x100cb72
cmp edi, 2
je 0x100cb27
cmp edi, 7
jne 0x100cb72
push ebx
push ebx
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x120]
mov byte [ebp - 0x104], bl
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push dword [ebp - 0x10c]
lea eax, [ebp - 0x104]
push edi
push ebx
push eax
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x100cb8d
push 3
pop edi
jmp 0x100ca9d
push esi
push dword [ebp - 0x10c]
push edi
push ebx
push dword [ebp - 0x120]
push dword [ebp - 0x11c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100cb9b
mov dword [0x100f6a4], 0x2c1
push dword [ebp - 0x10c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x110], ebx
je 0x100cbb4
call fcn.0100c343
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002af3
leave
ret 8