Function at 0x10223b7
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 2
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x102263e
cmp dword [ebp + 8], ebx
jne 0x10223f2
call fcn.01020b3c
test eax, eax
jne 0x1022638
push esi
push edi
push dword [ebp + 0x10]
mov byte [ebp - 0x20d], bl
push dword [ebp + 8]
call fcn.0102142b
cmp dword [ebp + 8], ebx
je 0x1022433
push dword [ebp + 0xc]
call fcn.010212bc
push dword [ebp + 0xc]
mov esi, 0x1001d20
push 1
push ebx
mov edi, 0x1001c64
mov edx, esi
mov ecx, 0x80000002
call fcn.01020c9d
jmp 0x1022521
lea eax, [ebp - 0x214]
push eax
push 3
push ebx
mov esi, 0x1001d20
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10224b2
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x208
call fcn.01020b90
test eax, eax
jne 0x10224a6
lea eax, [ebp - 0x20c]
push eax
push 0x1001c64
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x10224a6
push ebx
push 0x1001420
push 1
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 1
lea eax, [ebp - 0x218]
push eax
push 2
mov dword [ebp - 0x218], 0x19
call fcn.01021eb7
push 0x17
pop edi
push 1
push 2
lea eax, [ebp - 0x21c]
push eax
push 2
mov dword [ebp - 0x21c], edi
mov dword [ebp - 0x218], 6
call fcn.01021eb7
push 1
push 1
lea eax, [ebp - 0x218]
push eax
push 4
mov dword [ebp - 0x218], edi
call fcn.01021eb7
push edi
call fcn.01021f1f
push 0x1001f28
call fcn.01022a27
mov byte [ebp - 0x20d], 1
call fcn.01020c24
test eax, eax
jne 0x1022600
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x10225cc
cmp dword [ebp + 8], ebx
je 0x1022550
call fcn.01023afd
test al, al
jne 0x10225e5
lea eax, [ebp - 0x214]
push eax
push 3
push ebx
push esi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10225e5
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x208
call fcn.01020b90
test eax, eax
jne 0x10225be
lea eax, [ebp - 0x20c]
push eax
push 0x1001c64
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x10225be
push ebx
push 0x1001420
push 1
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10225e5
cmp dword [ebp + 8], ebx
jne 0x10225e5
push ebx
push ebx
push ebx
mov edi, 0x1001c64
mov edx, esi
mov ecx, 0x80000001
call fcn.01020c9d
push ebx
call fcn.010222a6
push dword [ebp + 8]
push 0x1001d68
call fcn.01020e8e
push ebx
call fcn.01020be9
jmp 0x1022613
push 0x1002568
push ebx
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
cmp byte [ebp - 0x20d], bl
je 0x102262b
push ebx
push ebx
push ebx
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push dword [ebp + 8]
push 0x1001c48
call fcn.01020f51
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.01023ead
leave
ret 0xc