Function at 0x100a5f20
Capabilities:
Delete registry value
Extract resource via kernel32 functions
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x1013c014]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 0
mov eax, dword [0x1014e928]
cmovne eax, dword [0x1014e92c]
cmp word [eax], 0
je 0x100a624d
push eax
push str._sSettings
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.100a4830
add esp, 0x10
mov dword [ebp - 0x21c], 0
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], 0
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x214], 0
push 0x2001f
push eax
push SysReAllocString
call fcn.10013210
test eax, eax
je 0x100a5fc7
sub esp, 8
lea eax, [ebp - 0x20c]
lea ecx, [ebp - 0x21c]
push 0x2001f
sub esp, 8
push eax
push SysReAllocString
call fcn.100380f0
mov dl, byte [ebp + 8]
push ebx
mov ebx, dword [ebp - 0x21c]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test dl, dl
jne 0x100a6046
mov esi, dword [0x1014be3c]
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
jne 0x100a5ff6
xor ecx, ecx
jmp 0x100a6028
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, eax
test edx, edx
jne 0x100a600f
xor ecx, ecx
jmp 0x100a6028
movzx eax, word [edx + 0x38]
movzx ecx, al
movzx eax, word [edx + 0x3a]
shl eax, 8
or ecx, eax
movzx eax, word [edx + 0x3e]
shl ecx, 0x10
or ecx, eax
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], ecx
push eax
push 4
push 0
push str.Version
push ebx
call edi
mov dl, byte [ebp + 8]
mov esi, dword [0x1014e914]
cmp dword [esi], 0
je 0x100a623f
add esi, 0x30
nop dword [eax + eax]
mov eax, dword [esi - 0x2c]
cmp eax, 0xfffffffe
je 0x100a622f
cmp eax, 0xffffffff
je 0x100a622f
cmp dword [esi], 0
jne 0x100a622f
mov ecx, dword [esi - 0x10]
test ecx, 0x4080
jne 0x100a622f
test cl, 0x10
je 0x100a609c
test dl, dl
je 0x100a622f
jmp 0x100a60a4
test dl, dl
jne 0x100a622f
test ecx, 0x1000
je 0x100a60bb
push dword [esi - 0x30]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x100a622f
cmp eax, 1
je 0x100a60dc
cmp eax, 2
jne 0x100a60cd
cmp dword [esi + 0x34], 0xffffffff
jne 0x100a60dc
jmp 0x100a60d7
cmp eax, 3
je 0x100a60dc
cmp eax, 4
je 0x100a60dc
cmp eax, 5
jne 0x100a6104
xor eax, eax
cmp word [esi + 8], 3
jne 0x100a60e8
mov eax, dword [esi + 0x10]
push 4
mov dword [ebp - 0x210], eax
lea eax, [ebp - 0x210]
push eax
push 4
push 0
push dword [esi - 0x30]
push ebx
call edi
mov eax, dword [esi - 0x2c]
cmp eax, 2
jne 0x100a6168
cmp dword [esi + 0x34], 0xffffffff
jne 0x100a6168
xor eax, eax
cmp word [esi + 8], 3
jne 0x100a611b
mov eax, dword [esi + 0x10]
lea ecx, [esi + 0x30]
nop
test eax, eax
je 0x100a6130
add ecx, 0x60
dec eax
cmp dword [ecx + 4], 0xffffffff
je 0x100a6120
jmp 0x100a6168
mov edx, dword [ecx]
test edx, edx
je 0x100a6168
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a6140
sub ecx, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push dword [esi - 0x30]
push ebx
call edi
mov eax, dword [esi - 0x2c]
cmp eax, 0xc
jne 0x100a62ab
cmp word [esi + 8], 8
jne 0x100a625d
mov edx, dword [esi + 0x10]
mov edi, edx
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x100a6187
sub edi, ecx
xor ecx, ecx
sar edi, 1
mov dword [ebp - 0x210], edi
test edi, edi
jle 0x100a61ba
mov eax, dword [esi + 0x10]
cmp word [eax + ecx*2], 0xa
jne 0x100a61b2
xor edx, edx
mov word [eax + ecx*2], dx
inc ecx
cmp ecx, edi
jl 0x100a61a2
mov edx, dword [esi + 0x10]
test edx, edx
je 0x100a61fe
xor edi, edi
mov ecx, edx
lea ebx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a61c5
sub ecx, ebx
sar ecx, 1
inc ecx
lea edx, [edx + ecx*2]
lea edi, [edi + ecx*2]
cmp ecx, 1
jne 0x100a61c0
mov ebx, dword [ebp - 0x21c]
push edi
push dword [esi + 0x10]
push 7
push 0
push dword [esi - 0x30]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [ebp - 0x210]
xor ecx, ecx
test edi, edi
jle 0x100a6229
lea ebx, [ecx + 0xa]
nop word [eax + eax]
mov eax, dword [esi + 0x10]
cmp word [eax + ecx*2], 0
jne 0x100a621e
mov word [eax + ecx*2], bx
inc ecx
cmp ecx, edi
jl 0x100a6210
mov ebx, dword [ebp - 0x21c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dl, byte [ebp + 8]
add esi, 0x60
cmp dword [esi - 0x30], 0
jne 0x100a6060
test ebx, ebx
je 0x100a624a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100d4906
mov esp, ebp
pop ebp
ret 4
xor edi, edi
mov edx, 0x1011f970
mov eax, edx
lea ebx, [eax + 2]
nop dword [eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100a6270
sub eax, ebx
sar eax, 1
lea ecx, [eax + 1]
lea edx, [edx + ecx*2]
lea edi, [edi + ecx*2]
cmp ecx, 1
jne 0x100a6264
mov ebx, dword [ebp - 0x21c]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1011f970
push 7
push 0
push dword [esi - 0x30]
push ebx
call edi
jmp 0x100a622f
cmp eax, 6
jl 0x100a622f
cmp word [esi + 8], 8
jne 0x100a62fd
mov edx, dword [esi + 0x10]
test edx, edx
je 0x100a622f
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100a62d0
sub ecx, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push dword [esi - 0x30]
push ebx
call edi
jmp 0x100a622f
push 2
push 0x1010ca30
push 1
push 0
push dword [esi - 0x30]
push ebx
call edi
jmp 0x100a622f