Function at 0x10117dd
Capabilities:
Delete registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x102a0ec]
push ebx
push esi
mov dword [ebp - 4], eax
xor eax, eax
xor esi, esi
cmp dword [ebp + 8], esi
push edi
push dword [ebp + 8]
setne al
mov dword [ebp - 0x208], esi
mov dword [ebp - 0x20c], eax
call fcn.0101168e
push esi
lea eax, [ebp - 0x208]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1001f70
mov ebx, 0x80000002
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jne 0x101185f
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push esi
push 0x1001f54
push dword [ebp - 0x208]
call edi
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x208]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1004fc0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10118a2
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push esi
push 0x1004fac
push dword [ebp - 0x208]
call edi
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x208]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1004ef0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1011a98
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push esi
push 0x1004edc
push dword [ebp - 0x208]
mov dword [ebp - 0x20c], 2
call edi
push 0xff
lea eax, [ebp - 0x204]
push eax
call fcn.01019683
test eax, eax
mov ebx, dword [sym.imp.msvcrt.dll_wcslen]
je 0x1011a00
mov dword [ebp - 0x210], esi
jmp 0x1011913
mov word [eax], 0x2c
lea eax, [ebp - 0x204]
push 0x100207c
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
cmp eax, esi
pop ecx
pop ecx
jne 0x101190e
lea eax, [ebp - 0x204]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push esi
push 0x1003d88
push dword [ebp - 0x208]
call edi
cmp dword [ebp + 8], esi
jne 0x10119f0
push esi
lea eax, [ebp - 0x210]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1004ef0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1011a0b
lea eax, [ebp - 0x204]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push esi
push 0x1003d88
push dword [ebp - 0x210]
call edi
push 0x1004ed8
push 0x100
lea eax, [ebp - 0x204]
push eax
call fcn.0100c535
lea eax, [ebp - 0x204]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push esi
push 0x1004ec8
push dword [ebp - 0x210]
call edi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1011a0b
push 0x1004ef0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp + 8], esi
mov dword [ebp - 0x20c], esi
jne 0x1011a15
mov dword [ebp - 0x20c], 1
push 4
lea eax, [ebp - 0x20c]
push eax
push 4
push esi
push 0x10016b0
push dword [ebp - 0x208]
call edi
push 0xff
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x1011a8c
cmp dword [ebp + 8], esi
lea eax, [ebp - 0x204]
je 0x1011a56
push 0x1004e90
jmp 0x1011a5b
push 0x1004e58
push 0x100
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x204]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push 1
push esi
push 0x1004e44
push dword [ebp - 0x208]
call edi
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101672d
leave
ret 4