Function at 0x100b654
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x1019214]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x120], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
inc edi
xor ebx, ebx
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x108], edi
mov dword [ebp - 0x10c], ebx
call fcn.0100b05f
push 0x3d
call fcn.0100ab94
test eax, eax
je 0x100b93a
call fcn.0100b05f
mov esi, 0x100
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [ebp - 0x110], eax
jne 0x100b6cd
mov dword [0x1019678], 0x84
jmp 0x100b93f
push 0x22
call fcn.0100ab94
test eax, eax
je 0x100b712
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
push eax
mov dword [ebp - 0x114], esi
call fcn.0100ae8a
test eax, eax
je 0x100b707
call fcn.0100afe1
test eax, eax
jne 0x100b87e
mov dword [ebp - 0x10c], edi
jmp 0x100b878
push 0x64
call fcn.0100ab94
test eax, eax
je 0x100b783
mov esi, 0x1001aae
xor eax, eax
mov ax, word [esi]
push eax
call fcn.0100ab94
inc esi
inc esi
test eax, eax
jne 0x100b73f
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], edi
cmp word [esi], bx
jne 0x100b722
cmp dword [ebp - 0x108], ebx
je 0x100b926
call fcn.0100b05f
push dword [ebp - 0x110]
call fcn.0100b37e
test eax, eax
je 0x100b76d
call fcn.0100afe1
test eax, eax
jne 0x100b779
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], edi
push 4
pop edi
mov esi, edi
jmp 0x100b890
push 0x2d
call fcn.0100ab94
test eax, eax
je 0x100b7b9
call fcn.0100afe1
test eax, eax
jne 0x100b7a2
mov dword [ebp - 0x10c], edi
jmp 0x100b926
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x100b926
mov esi, 0x1001aa4
xor eax, eax
mov ax, word [esi]
push eax
call fcn.0100ab94
inc esi
inc esi
test eax, eax
jne 0x100b7db
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], edi
cmp word [esi], bx
jne 0x100b7be
cmp dword [ebp - 0x108], ebx
je 0x100b926
push 0x28
call fcn.0100ab94
test eax, eax
je 0x100b8f5
lea eax, [ebp - 0x114]
push eax
call fcn.0100b37e
test eax, eax
je 0x100b816
push 0x29
call fcn.0100ab94
test eax, eax
jne 0x100b822
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x10c], edi
mov edi, dword [ebp - 0x114]
cmp dword [ebp - 0x108], ebx
je 0x100b926
mov eax, dword [ebp - 0x110]
push 0x3a
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], 0x100
call fcn.0100ab94
test eax, eax
je 0x100b86e
lea eax, [ebp - 0x118]
push eax
call fcn.0100b4e7
test eax, eax
je 0x100b86e
call fcn.0100afe1
test eax, eax
jne 0x100b87e
mov dword [ebp - 0x10c], 1
mov dword [ebp - 0x108], ebx
mov eax, dword [ebp - 0x118]
mov esi, dword [ebp - 0x114]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x108], ebx
je 0x100b926
cmp dword [0x1019674], 0x500
jae 0x100b8fd
cmp edi, 2
je 0x100b8b2
cmp edi, 7
jne 0x100b8fd
push ebx
push ebx
push 0x100
lea eax, [ebp - 0x104]
push eax
push 0xffffffffffffffff
push dword [ebp - 0x11c]
mov byte [ebp - 0x104], bl
push ebx
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
push dword [ebp - 0x110]
lea eax, [ebp - 0x104]
push edi
push ebx
push eax
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x100b918
push 3
pop edi
jmp 0x100b828
push esi
push dword [ebp - 0x110]
push edi
push ebx
push dword [ebp - 0x11c]
push dword [ebp - 0x120]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x100b926
mov dword [0x1019678], 0x84
push dword [ebp - 0x110]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x10c], ebx
je 0x100b93f
call fcn.0100b08f
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010167d4
leave
ret 8