Function at 0x101e807
Capabilities:
Set registry value

Disassembly:
push 0x88
mov eax, 0x1020def
call fcn.01017758
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x88], eax
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x70], ebx
lea edi, [ebp - 0x6c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x84], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x8c], 1
stosd dword es:[edi], eax
call fcn.0101f09c
mov edi, dword [ebp - 0x84]
mov esi, eax
lea eax, [edi + 0x10]
push eax
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x90], eax
call fcn.0101e364
push 0x100256c
lea ecx, [ebp - 0x84]
mov dword [ebp - 4], ebx
call fcn.0100f006
push 0x5c
pop eax
cmp ax, word [esi]
jne 0x101e88a
inc esi
inc esi
push esi
lea ecx, [ebp - 0x84]
call fcn.0100f006
push 2
pop eax
cmp dword [ebp + 0x10], eax
jne 0x101e8a1
mov dword [ebp - 0x80], eax
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x80]
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x94]
mov ecx, edi
call fcn.0101e6d9
cmp eax, ebx
jge 0x101e8d5
mov esi, eax
push dword [ebp - 0x84]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
call fcn.010177ac
ret 0xc
push 0x28
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x101e8f0
mov esi, 0x8007007a
jmp 0x101e8bf
cmp dword [ebp - 0x74], ebx
je 0x101e921
push dword [ebp - 0x88]
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x74]
mov ecx, edi
call fcn.0101e399
mov esi, eax
cmp esi, ebx
jge 0x101e91b
push esi
call fcn.0101debe
test al, al
jne 0x101e921
jmp 0x101e8bf
mov dword [ebp - 0x8c], ebx
cmp dword [ebp + 0x10], 2
jne 0x101e9b3
cmp dword [ebp - 0x8c], ebx
jne 0x101e938
cmp dword [ebp - 0x74], ebx
jne 0x101e9b3
mov dword [ebp - 0x78], 1
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x78], eax
je 0x101e96f
push dword [ebp - 0x88]
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x78]
mov ecx, edi
call fcn.0101e399
mov esi, eax
cmp esi, ebx
jge 0x101e97a
push esi
call fcn.0101debe
test al, al
je 0x101e8bf
inc dword [ebp - 0x78]
cmp dword [ebp - 0x78], 4
jl 0x101e93f
jmp 0x101e980
mov dword [ebp - 0x8c], ebx
cmp dword [ebp - 0x74], ebx
jne 0x101e9b3
push dword [ebp - 0x88]
mov ecx, edi
push dword [ebp - 0x94]
call fcn.0101e2f7
mov esi, eax
cmp esi, ebx
jge 0x101e9ad
push esi
call fcn.0101debe
test al, al
jne 0x101e9b3
jmp 0x101e8bf
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x7c], ebx
push dword [ebp - 0x90]
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.0101e364
push 0x10025d0
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.0100f006
push dword [ebp - 0x88]
lea eax, [ebp - 0x7c]
push eax
mov edi, 0x20019
push edi
push dword [ebp - 0x74]
mov esi, 0x80000002
push esi
call fcn.0101ee69
cmp eax, ebx
je 0x101ea1f
jle 0x101ea07
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push dword [ebp - 0x74]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x7c]
call fcn.0101dd7e
jmp 0x101e8bf
push dword [ebp - 0x88]
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x7c]
call fcn.0101eebb
cmp eax, ebx
je 0x101ea40
cmp eax, 2
je 0x101ea46
cmp eax, ebx
jg 0x101e9fd
jmp 0x101ea07
mov dword [ebp - 0x8c], ebx
cmp dword [ebp + 0x10], 1
jne 0x101eabf
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x80], ebx
push dword [ebp - 0x88]
lea eax, [ebp - 0x80]
push eax
push 2
push dword [ebp - 0x84]
mov byte [ebp - 4], 3
push esi
call fcn.0101ee69
cmp eax, ebx
je 0x101ea90
jle 0x101ea81
and eax, 0xffff
or eax, 0x80070000
lea ecx, [ebp - 0x80]
mov esi, eax
call fcn.0101dd7e
jmp 0x101ea09
push 4
lea eax, [ebp - 0x90]
push eax
push 4
push ebx
push 0x1002558
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_RegSetValueExW]
cmp eax, ebx
je 0x101eab2
jg 0x101ea77
jmp 0x101ea81
lea ecx, [ebp - 0x80]
call fcn.0101dd7e
jmp 0x101eb75
cmp dword [ebp + 0x10], ebx
jne 0x101eb75
push 0x5c
push dword [ebp - 0x84]
call sub.msvcrt.dll_wcsrchr
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x101eaf8
push dword [ebp - 0x74]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x7c]
call fcn.0101dd7e
mov esi, 0x8000ffff
jmp 0x101e8bf
xor eax, eax
mov word [ebx], ax
and dword [ebp - 0x78], eax
inc ebx
inc ebx
push dword [ebp - 0x88]
lea eax, [ebp - 0x78]
push eax
push edi
push dword [ebp - 0x84]
mov byte [ebp - 4], 4
push esi
call fcn.0101ee69
xor esi, esi
cmp eax, esi
je 0x101eb3c
cmp eax, 2
je 0x101eb42
jmp 0x101eb5f
and eax, 0xffff
or eax, 0x80070000
lea ecx, [ebp - 0x78]
jmp 0x101ea84
mov dword [ebp - 0x8c], esi
cmp dword [ebp - 0x78], esi
je 0x101eb6b
push dword [ebp - 0x88]
push ebx
push dword [ebp - 0x78]
call fcn.0101eebb
cmp eax, esi
je 0x101eb65
cmp eax, 2
je 0x101eb6b
cmp eax, esi
jg 0x101eb2a
jmp 0x101eb34
mov dword [ebp - 0x8c], esi
lea ecx, [ebp - 0x78]
call fcn.0101dd7e
xor ebx, ebx
push dword [ebp - 0x74]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [ebp - 0x7c]
call fcn.0101dd7e
cmp dword [ebp - 0x8c], ebx
je 0x101eb98
mov esi, 0x80070002
jmp 0x101e8bf
xor esi, esi
jmp 0x101e8bf