Function at 0x100f6c2e
Capabilities:
Set registry value

Disassembly:
push 0x18
mov eax, 0x101238ee
call fcn.100604ea
mov ebx, ecx
mov dword [ebp - 0x14], ebx
and dword [ebp - 0x1c], 0
cmp dword [ebx + 0x130], 0
je 0x100f6d80
call fcn.100029f0
push eax
lea ecx, [ebp - 0x10]
call fcn.1000281b
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0x12c]
mov esi, dword [eax]
cmp esi, eax
je 0x100f6d10
mov ecx, dword [esi + 0x10]
sub ecx, 0x10
call fcn.10001ef7
mov ebx, eax
lea ecx, [ebx + 0x10]
mov dword [ebp - 0x24], ecx
mov byte [ebp - 4], 1
push dword [ecx - 0xc]
push ecx
lea ecx, [ebp - 0x10]
call fcn.10008b1c
push 1
push 0x1013c6b8
lea ecx, [ebp - 0x10]
call fcn.10008b1c
mov edi, dword [ebp - 0x10]
mov ecx, ebx
cmp dword [edi - 0xc], 0x1388
jg 0x100f6d06
xor eax, eax
mov byte [ebp - 4], al
call fcn.10002a86
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
je 0x100f6cdf
mov eax, dword [esi + 4]
jmp 0x100f6cd5
cmp esi, dword [eax + 8]
jne 0x100f6cdb
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100f6ccb
mov esi, eax
jmp 0x100f6cf5
mov esi, eax
mov ecx, dword [esi]
cmp byte [ecx + 0xd], 0
jne 0x100f6cf5
mov eax, dword [ecx]
mov esi, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x100f6ce9
mov ebx, dword [ebp - 0x14]
cmp esi, dword [ebx + 0x12c]
jne 0x100f6c73
jmp 0x100f6d13
call fcn.10002a86
mov ebx, dword [ebp - 0x14]
jmp 0x100f6d13
mov edi, dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 0x20006
xor eax, eax
push eax
push str.Software360safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100f6d78
mov edx, dword [ebp - 0x18]
test edx, edx
je 0x100f6d78
test edi, edi
je 0x100f6d71
mov ecx, edi
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x1c]
jne 0x100f6d48
sub ecx, esi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edi
push 1
xor eax, eax
push eax
push str.lstKOVN
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [edi - 0x10]
call fcn.10002a86
lea ecx, [ebx + 0x134]
call fcn.10085a1f
test eax, eax
je 0x100f6e65
call fcn.10085a1f
mov edi, eax
mov eax, 0x3e8
mov dword [ebp - 0x10], edi
cmp edi, eax
jle 0x100f6dab
mov edi, eax
mov dword [ebp - 0x10], eax
mov esi, edi
shl esi, 4
push 0x10190228
push esi
mov dword [ebp - 0x24], esi
call fcn.10038dc0
mov ebx, eax
mov dword [ebp - 0x20], ebx
pop ecx
pop ecx
test ebx, ebx
je 0x100f6e5e
push esi
xor eax, eax
push eax
push ebx
call fcn.1003e610
add esp, 0xc
xor ecx, ecx
test edi, edi
jle 0x100f6e1c
mov esi, ebx
mov ebx, ecx
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x14]
push ebx
lea ecx, [ecx + 0x134]
call fcn.100859fa
test eax, eax
je 0x100f6e09
mov edi, dword [ebp - 0x18]
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x18]
inc ebx
add esi, 0x10
mov dword [ebp - 0x18], esi
cmp ebx, edi
jl 0x100f6de7
mov ebx, dword [ebp - 0x20]
xor ecx, ecx
mov esi, dword [ebp - 0x24]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ecx
push eax
push 0x20006
push ecx
push str.Software360safe360Scan
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100f6e5e
cmp dword [ebp - 0x14], eax
je 0x100f6e5e
push esi
push ebx
push 3
push eax
push str.lstKOHx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.10038d3b
pop ecx
call fcn.100604b3
ret