Function at 0x100e96a9
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Get file attributes
Get startup folder
Persist via run registry key
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
sub esp, 0x250
lea ebp, [esp - 4]
mov eax, dword [0x101f6410]
xor eax, ebp
mov dword [ebp + 0x250], eax
push 0x78
mov eax, 0x1018fa0d
call fcn.10145d80
mov eax, ecx
lea ecx, [eax + 0x2c]
mov dword [ebp - 0x28], eax
call fcn.100e832e
mov eax, dword [0x101f3028]
mov dword [ebp - 0x30], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], eax
push fcn.10003b75
push 0x10004013
push 4
xor edi, edi
push 4
lea eax, [ebp - 0x40]
inc edi
push eax
mov byte [ebp - 4], 1
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], 0x80
mov dword [ebp - 0x54], 0x81
call fcn.101480c3
mov byte [ebp - 4], 2
lea esi, [ebp - 0x40]
mov dword [ebp - 0x10], 4
push 0x800
mov ecx, esi
call fcn.1000401e
add esi, 4
dec dword [ebp - 0x10]
jne 0x100e972a
push edi
push 7
push ebx
lea ecx, [ebp - 0x40]
call fcn.1000401e
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push eax
push ebx
call esi
push edi
push 0x18
push ebx
lea ecx, [ebp - 0x3c]
call fcn.1000401e
push eax
push ebx
call esi
push edi
push 0x1a
push ebx
lea ecx, [ebp - 0x38]
call fcn.1000401e
push eax
push ebx
call esi
push edi
push 0x23
push ebx
lea ecx, [ebp - 0x34]
call fcn.1000401e
push eax
push ebx
call esi
mov eax, dword [0x101f3028]
mov dword [ebp - 0x14], eax
mov edi, str.BaiduBaiduToolbarNoRun
push edi
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 3
call fcn.1001107f
push 0xffffffffffffffff
lea ecx, [ebp - 0x38]
call fcn.100041f7
push dword [ebp - 0x38]
mov esi, str._s_bar.tmp
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.10004662
add esp, 0xc
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.100041f7
push dword [ebp - 0x14]
call fcn.1011cc25
pop ecx
push edi
lea ecx, [ebp - 0x34]
call fcn.1001107f
push 0xffffffffffffffff
lea ecx, [ebp - 0x34]
call fcn.100041f7
push dword [ebp - 0x38]
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.10004662
add esp, 0xc
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.100041f7
push dword [ebp - 0x14]
call fcn.1011cc25
pop ecx
xor edi, edi
lea esi, [ebp + edi - 0x40]
push dword [esi]
lea eax, [ebp - 0x30]
push str._s.
push eax
call fcn.10004662
add esp, 0xc
lea eax, [ebp]
push eax
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x10], eax
je 0x100e990d
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x30], 0x64
jge 0x100e9904
lea eax, [ebp + 0x2c]
push 0x101a7204
push eax
call fcn.1014631e
test eax, eax
pop ecx
pop ecx
je 0x100e98ef
lea eax, [ebp + 0x2c]
push 0x101a71fc
push eax
call fcn.1014631e
test eax, eax
pop ecx
pop ecx
je 0x100e98ef
lea eax, [ebp + 0x2c]
push str.desktop.ini
push eax
call fcn.1014631e
test eax, eax
pop ecx
pop ecx
je 0x100e98ef
lea eax, [ebp + 0x2c]
push eax
push dword [esi]
lea eax, [ebp - 0x24]
push 0x101a1d40
push eax
call fcn.10004662
add esp, 0x10
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100e98ef
test al, 0x10
jne 0x100e98ef
test al, 1
je 0x100e98bf
and eax, 0xfffffffe
push eax
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
lea eax, [ebp + 0x2c]
push eax
push dword [ebp + edi - 0x60]
lea ecx, [ebp - 0x6c]
call fcn.100e8527
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x6c]
push eax
add ecx, 0x2c
mov byte [ebp - 4], 4
call fcn.100e9633
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 3
call fcn.100e7f49
lea eax, [ebp]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100e9838
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FindClose]
add edi, 4
cmp edi, 0x10
jl 0x100e9808
push 2
pop eax
mov edi, fcn.10003b75
push edi
push 0x10004013
push eax
mov dword [ebp - 0x84], eax
push 4
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x80], 0x82
mov dword [ebp - 0x7c], 3
mov dword [ebp - 0x78], 0x83
call fcn.101480c3
push str.SoftwareMicrosoftWindowsCurrentVersionRun
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 5
mov dword [ebp - 0x68], SysReAllocString
mov dword [ebp - 0x64], reloc.OLEAUT32.dll_SysReAllocString
call fcn.1000425b
push str.SoftwareBaiduBaiduBarNoRun
lea ecx, [ebp - 0x4c]
call fcn.1000425b
lea eax, [ebp - 0x84]
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x50]
mov eax, dword [ebp - 0x20]
push dword [ebp + eax*4 - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100e9a8e
mov eax, dword [0x101f3028]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x28]
cmp dword [esi + 0x30], 0x64
mov byte [ebp - 4], 7
mov dword [ebp - 0x2c], ebx
je 0x100e9a75
push 0x104
lea ecx, [ebp - 0x18]
call fcn.1000401e
mov edi, 0x800
push edi
lea ecx, [ebp - 0x1c]
call fcn.1000401e
lea eax, [ebp - 0x70]
push eax
push ebx
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x74], 0x104
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x44], ebx
call fcn.1000401e
push eax
lea eax, [ebp - 0x44]
push eax
push ebx
lea eax, [ebp - 0x74]
push eax
push ebx
lea ecx, [ebp - 0x18]
call fcn.1000401e
push eax
push dword [ebp - 0x2c]
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x100e9a70
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x44], 1
jne 0x100e9a66
push 0xffffffffffffffff
lea ecx, [ebp - 0x1c]
call fcn.100041f7
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.100041f7
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x18]
lea ecx, [ebp - 0x5c]
push dword [eax]
call fcn.100e8527
lea eax, [ebp - 0x5c]
push eax
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 8
call fcn.100e9633
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 7
call fcn.100e7f49
cmp dword [esi + 0x30], 0x64
jne 0x100e99c1
mov edi, fcn.10003b75
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x1c]
call fcn.10003b75
lea ecx, [ebp - 0x18]
call fcn.10003b75
inc dword [ebp - 0x20]
add dword [ebp - 0x10], 8
cmp dword [ebp - 0x20], 2
jl 0x100e9986
push edi
push 2
push 4
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 3
call fcn.10148198
lea ecx, [ebp - 0x14]
call fcn.10003b75
push edi
push 4
push 4
lea eax, [ebp - 0x40]
push eax
mov byte [ebp - 4], 1
call fcn.10148198
lea ecx, [ebp - 0x24]
call fcn.10003b75
lea ecx, [ebp - 0x30]
call fcn.10003b75
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x250]
xor ecx, ebp
call fcn.10145d71
add ebp, 0x254
leave
ret