Function at 0x1009303
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes
Get installed programs
Persist via app paths registry key
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x13c8
call fcn.0100d410
mov eax, dword [0x101203c]
push esi
push edi
push 1
push 0x1001cb0
mov dword [ebp - 4], eax
call fcn.0100cbd8
xor eax, eax
push 0x41
pop ecx
lea edi, [ebp - 0x414]
rep stosd dword es:[edi], eax
mov eax, dword [0x1016c8c]
dec eax
dec eax
jne 0x100a23c
push ebx
xor ebx, ebx
cmp dword [0x1016ca0], ebx
je 0x100a22f
cmp dword [0x1016ca4], ebx
je 0x100a22f
lea eax, [ebp - 0x1058]
push eax
push 0x20019
push ebx
push 0x10054b8
mov esi, 0x80000002
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100a23b
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x105c]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x1005484
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100a221
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x1068]
push eax
push ebx
push 0x1005504
push dword [ebp - 0x1058]
mov edi, 0x104
mov dword [ebp - 0x1048], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a215
cmp dword [ebp - 0x1068], 2
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
jne 0x100942f
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x720]
push eax
call esi
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 4
jmp 0x1009438
mov eax, dword [ebp - 0x1048]
add eax, 0xfffffffb
mov dword [ebp - 0x1054], eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100a215
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x1068]
push eax
push ebx
push 0x10053e4
push dword [ebp - 0x1058]
mov dword [ebp - 0x1048], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a215
cmp dword [ebp - 0x1068], 2
jne 0x10094b8
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push eax
call esi
push edi
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x61c]
push eax
call esi
cmp byte [ebp - 0x61c], bl
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1050], ebx
je 0x100a215
mov eax, dword [ebp - 0x104c]
cmp byte [eax], 0x5c
jne 0x10094ff
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x1050], eax
push dword [ebp - 0x104c]
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], bl
mov dword [ebp - 0x104c], eax
jne 0x10094e7
cmp dword [ebp - 0x1050], ebx
je 0x100a215
mov ecx, 0x1001ca4
mov dword [ebp - 0x110c], ecx
mov dword [ebp - 0x10cc], ecx
mov ecx, 0x10166cc
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x10b8], ecx
mov dword [ebp - 0x10b0], ecx
lea ecx, [ebp - 0x310]
lea eax, [ebp - 0xb30]
mov dword [ebp - 0x1138], eax
mov dword [ebp - 0x13c4], ecx
mov dword [ebp - 0x13bc], ecx
lea eax, [ebp - 0x20c]
mov ecx, edx
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x1128], eax
lea eax, [ebp - 0x310]
mov dword [ebp - 0x13b4], ecx
mov dword [ebp - 0x13ac], ecx
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x1120], eax
mov dword [ebp - 0x1118], eax
mov dword [ebp - 0x1110], eax
mov dword [ebp - 0x1108], eax
mov eax, 0x10165c8
mov dword [ebp - 0x13a4], ecx
mov dword [ebp - 0x139c], ecx
mov dword [ebp - 0x137c], ecx
mov ecx, edx
mov byte [ebp - 0x310], bl
mov byte [ebp - 0xb30], bl
mov byte [ebp - 0x20c], bl
mov byte [ebp - 0x108], bl
mov byte [ebp - 0x518], bl
mov dword [ebp - 0x113c], 0x1001c98
mov dword [ebp - 0x1134], 0x1001c90
mov dword [ebp - 0x112c], 0x1001c88
mov dword [ebp - 0x1124], 0x10014a8
mov dword [ebp - 0x111c], 0x1001c7c
mov dword [ebp - 0x1114], 0x1001c70
mov dword [ebp - 0x1104], 0x1001c60
mov dword [ebp - 0x1100], eax
mov dword [ebp - 0x10fc], 0x1001c54
mov dword [ebp - 0x10f8], eax
mov dword [ebp - 0x10f4], 0x1001c44
mov dword [ebp - 0x10f0], edx
mov dword [ebp - 0x10ec], 0x1001c38
mov dword [ebp - 0x10e8], edx
mov dword [ebp - 0x10e4], 0x1001c2c
mov dword [ebp - 0x10e0], edx
mov dword [ebp - 0x10dc], 0x1001c24
mov dword [ebp - 0x10d8], edx
mov dword [ebp - 0x10d4], 0x1001c98
mov dword [ebp - 0x10d0], eax
mov dword [ebp - 0x10c8], eax
mov dword [ebp - 0x10c4], 0x1001c70
mov dword [ebp - 0x10c0], eax
mov dword [ebp - 0x10bc], 0x10014a8
mov dword [ebp - 0x10b4], 0x1001c7c
mov dword [ebp - 0x13c8], 0x1001c18
mov dword [ebp - 0x13c0], 0x1001c0c
mov dword [ebp - 0x13b8], 0x1001c00
mov dword [ebp - 0x13b0], 0x1001bf4
mov dword [ebp - 0x13a8], 0x1001be8
mov dword [ebp - 0x13a0], 0x1001bd8
mov dword [ebp - 0x1398], 0x1001bc8
mov dword [ebp - 0x1394], eax
mov dword [ebp - 0x1390], 0x1001bbc
mov dword [ebp - 0x138c], eax
mov dword [ebp - 0x1388], 0x1001bac
mov dword [ebp - 0x1384], eax
mov dword [ebp - 0x1380], 0x1001ba0
mov dword [ebp - 0x1378], 0x1001b90
mov dword [ebp - 0x1374], ecx
mov dword [ebp - 0x1370], 0x1001b84
mov dword [ebp - 0x136c], ecx
mov dword [ebp - 0x1368], 0x1001b78
mov dword [ebp - 0x1364], ecx
mov dword [ebp - 0x1360], 0x1001b6c
mov dword [ebp - 0x135c], ecx
mov dword [ebp - 0x1358], 0x1001b60
mov dword [ebp - 0x131c], eax
lea eax, [ebp - 0x518]
mov dword [ebp - 0x1354], ecx
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x1314], eax
mov dword [ebp - 0x130c], eax
mov dword [ebp - 0x1304], eax
mov dword [ebp - 0x12fc], eax
mov dword [ebp - 0x12f4], eax
mov dword [ebp - 0x12ec], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x1350], 0x1001b54
mov dword [ebp - 0x134c], ecx
mov dword [ebp - 0x1348], 0x1001b48
mov dword [ebp - 0x1344], ecx
mov dword [ebp - 0x1340], 0x1001b3c
mov dword [ebp - 0x133c], ecx
mov dword [ebp - 0x1338], 0x1001b2c
mov dword [ebp - 0x1334], ecx
mov dword [ebp - 0x1330], 0x1001b1c
mov dword [ebp - 0x132c], ecx
mov dword [ebp - 0x1328], 0x1001b10
mov dword [ebp - 0x1324], 0x10169d8
mov dword [ebp - 0x1320], 0x1001b04
mov dword [ebp - 0x1318], 0x1001af8
mov dword [ebp - 0x1310], 0x1001ae8
mov dword [ebp - 0x1308], 0x1001adc
mov dword [ebp - 0x1300], 0x1001acc
mov dword [ebp - 0x12f8], 0x1001abc
mov dword [ebp - 0x12f0], 0x1001aac
mov dword [ebp - 0x12e8], 0x1001a9c
mov dword [ebp - 0x12e4], eax
mov dword [ebp - 0x12e0], 0x1001a7c
mov dword [ebp - 0x12dc], eax
mov dword [ebp - 0x12d8], 0x1001a68
mov dword [ebp - 0x12d4], eax
mov dword [ebp - 0x12d0], 0x1001a50
mov dword [ebp - 0x12cc], eax
mov dword [ebp - 0x12c8], 0x1001a40
mov dword [ebp - 0x12c4], eax
mov dword [ebp - 0x12c0], 0x1001a34
mov dword [ebp - 0x12bc], eax
mov dword [ebp - 0x12b8], 0x1001a20
mov dword [ebp - 0x12b4], eax
mov dword [ebp - 0x12b0], 0x1001a14
mov dword [ebp - 0x12ac], eax
mov dword [ebp - 0x12a8], 0x10019fc
mov dword [ebp - 0x12a4], eax
mov dword [ebp - 0x12a0], 0x10019ec
mov dword [ebp - 0x129c], eax
mov dword [ebp - 0x1298], 0x10019dc
mov dword [ebp - 0x1294], eax
mov dword [ebp - 0x1290], 0x10019d4
mov dword [ebp - 0x128c], eax
mov dword [ebp - 0x1288], 0x10019bc
mov dword [ebp - 0x1284], eax
mov dword [ebp - 0x1280], 0x10019a8
mov dword [ebp - 0x127c], eax
mov dword [ebp - 0x1278], 0x100199c
mov dword [ebp - 0x1274], eax
mov dword [ebp - 0x1270], 0x1001984
mov dword [ebp - 0x126c], eax
mov dword [ebp - 0x1268], 0x1001964
mov dword [ebp - 0x1264], eax
mov dword [ebp - 0x1260], 0x1001950
mov dword [ebp - 0x125c], eax
mov dword [ebp - 0x1258], 0x1001944
mov dword [ebp - 0x1254], eax
mov dword [ebp - 0x1250], 0x1001928
mov dword [ebp - 0x124c], eax
mov dword [ebp - 0x1248], 0x100191c
mov dword [ebp - 0x1244], eax
mov dword [ebp - 0x1240], 0x1001910
mov dword [ebp - 0x123c], eax
mov dword [ebp - 0x1238], 0x1001904
mov dword [ebp - 0x1234], eax
mov dword [ebp - 0x1230], 0x10018f0
mov dword [ebp - 0x122c], eax
mov dword [ebp - 0x1228], 0x10018e0
mov dword [ebp - 0x1224], eax
mov dword [ebp - 0x1220], 0x10018d0
mov ecx, 0x1001894
mov dword [ebp - 0x121c], eax
mov dword [ebp - 0x1214], eax
mov dword [ebp - 0x120c], eax
mov dword [ebp - 0x1204], eax
mov dword [ebp - 0x11fc], eax
mov dword [ebp - 0x11f4], eax
mov dword [ebp - 0x11ec], eax
mov dword [ebp - 0x11e4], eax
mov dword [ebp - 0x11dc], eax
mov eax, 0x1005530
mov dword [ebp - 0x10a8], ecx
mov dword [ebp - 0x109c], ecx
mov ecx, 0x1001854
mov dword [ebp - 0x10ac], eax
mov dword [ebp - 0x10a0], eax
mov edx, 0x10022cc
mov dword [ebp - 0x1094], eax
mov dword [ebp - 0x1090], ecx
mov dword [ebp - 0x1088], eax
mov dword [ebp - 0x1084], ecx
mov ecx, 0x1001810
mov dword [ebp - 0x107c], eax
mov dword [ebp - 0x11d8], eax
mov dword [ebp - 0x11cc], eax
mov dword [ebp - 0x11c0], eax
mov dword [ebp - 0x11b4], eax
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x119c], eax
mov dword [ebp - 0x1190], eax
mov dword [ebp - 0x1184], eax
mov dword [ebp - 0x1178], eax
mov dword [ebp - 0x116c], eax
mov dword [ebp - 0x1160], eax
mov dword [ebp - 0x1154], eax
mov dword [ebp - 0x1148], eax
lea eax, [ebp - 0x518]
sub eax, dword [ebp - 0x1050]
mov dword [ebp - 0x1098], edx
mov dword [ebp - 0x1080], edx
mov edx, 0x10017c8
mov dword [ebp - 0x11c8], ecx
mov dword [ebp - 0x11bc], ecx
mov dword [ebp - 0x11b0], ecx
mov dword [ebp - 0x11a4], ecx
mov ecx, 0x10017a0
mov dword [ebp - 0x1218], 0x1001790
mov dword [ebp - 0x1210], 0x1001784
mov dword [ebp - 0x1208], 0x1001770
mov dword [ebp - 0x1200], 0x1001768
mov dword [ebp - 0x11f8], 0x1001744
mov dword [ebp - 0x11f0], 0x1001734
mov dword [ebp - 0x11e8], 0x1001728
mov dword [ebp - 0x11e0], 0x100171c
mov dword [ebp - 0x10a4], 0x100257c
mov dword [ebp - 0x108c], 0x100257c
mov dword [ebp - 0x1078], edx
mov dword [ebp - 0x1074], ebx
mov dword [ebp - 0x11d4], 0x10016c8
mov dword [ebp - 0x11d0], 0x10016b8
mov dword [ebp - 0x11c4], 0x10016ac
mov dword [ebp - 0x11b8], 0x100169c
mov dword [ebp - 0x11ac], 0x1001684
mov dword [ebp - 0x11a0], 0x100554c
mov dword [ebp - 0x1198], ecx
mov dword [ebp - 0x1194], 0x1001678
mov dword [ebp - 0x118c], 0x100164c
mov dword [ebp - 0x1188], 0x1001644
mov dword [ebp - 0x1180], ecx
mov dword [ebp - 0x117c], 0x100163c
mov dword [ebp - 0x1174], 0x1001614
mov dword [ebp - 0x1170], ebx
mov dword [ebp - 0x1168], 0x10015ec
mov dword [ebp - 0x1164], ebx
mov dword [ebp - 0x115c], 0x10015bc
mov dword [ebp - 0x1158], ebx
mov dword [ebp - 0x1150], 0x100158c
mov dword [ebp - 0x114c], ebx
mov dword [ebp - 0x1144], edx
mov dword [ebp - 0x1140], ebx
push eax
push 0x10057b0
push dword [ebp - 0x1050]
call esi
push ebx
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
push dword [ebp - 0x105c]
push dword [ebp - 0x1058]
call fcn.0100691f
cmp dword [0x1016bf8], 1
jne 0x1009d6d
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
push ebx
push 0x10054f0
push dword [ebp - 0x1058]
mov dword [ebp - 0x1048], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1009d6d
cmp byte [ebp - 0x414], bl
lea eax, [ebp - 0x414]
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1050], ebx
je 0x1009d6d
mov eax, dword [ebp - 0x104c]
cmp byte [eax], 0x5c
jne 0x1009cdd
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x1050], eax
push dword [ebp - 0x104c]
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], bl
mov dword [ebp - 0x104c], eax
jne 0x1009cc5
cmp dword [ebp - 0x1050], ebx
je 0x1009d6d
push dword [ebp - 0x1050]
lea eax, [ebp - 0x61c]
push eax
push 0x100247c
lea eax, [ebp - 0x928]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push edi
lea eax, [ebp - 0x928]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x928]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x928]
push eax
push 1
push ebx
push 0x10054f0
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push edi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x824]
push eax
call esi
push edi
push 0x10057cc
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatBuffA]
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x104c], edi
sub dword [ebp - 0x104c], eax
push dword [ebp - 0x104c]
lea eax, [ebp + eax - 0x824]
push 0x1005914
push eax
mov dword [ebp - 0x1070], eax
call esi
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov dword [ebp - 0x1048], eax
lea eax, [ebp - 0x61c]
push eax
push 1
push ebx
push 0x10053e4
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov dword [ebp - 0x1048], eax
lea eax, [ebp - 0x824]
push eax
push 1
push ebx
push 0x1005504
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0xb30]
push eax
lea eax, [ebp - 0x310]
push eax
push 0xf
call fcn.0100900f
cmp dword [0x1016bf8], 1
mov dword [ebp - 0x1050], eax
jne 0x1009eb2
test al, 1
je 0x1009e6a
push edi
lea eax, [ebp - 0x310]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test byte [ebp - 0x1050], 2
je 0x1009e82
push edi
lea eax, [ebp - 0xb30]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test byte [ebp - 0x1050], 4
je 0x1009e9a
push edi
lea eax, [ebp - 0x518]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test byte [ebp - 0x1050], 8
je 0x1009eb2
push edi
lea eax, [ebp - 0x108]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push edi
push 0x10166cc
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, edi
sub ecx, eax
push ecx
mov dword [ebp - 0x1048], eax
lea eax, [ebp + eax - 0x20c]
push eax
push 0x40a
push dword [0x1016cac]
call dword [sym.imp.USER32.dll_LoadStringA]
cmp dword [0x1016bf8], 1
jne 0x1009f0a
push edi
lea eax, [ebp - 0x20c]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 1
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [ebp - 0x1054]
mov ecx, edi
sub ecx, eax
push ecx
push 0x1005904
lea eax, [ebp + eax - 0x720]
push eax
call esi
push dword [ebp - 0x104c]
push 0x1005904
push dword [ebp - 0x1070]
call esi
push 1
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
xor esi, esi
cmp esi, 0x12
mov dword [ebp - 0x1048], ebx
jae 0x1009fcd
mov dword [ebp - 0x104c], ebx
cmp dword [ebp - 0x104c], 5
jge 0x1009fcd
push dword [ebp + esi*8 - 0x113c]
mov eax, dword [ebp - 0x1048]
push dword [ebp + esi*8 - 0x1138]
inc dword [ebp - 0x1048]
mov ecx, 0x514
sub ecx, dword [ebp - 0x1048]
push 0x1005970
lea eax, [ebp + eax - 0x1044]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add dword [ebp - 0x1048], eax
add esp, 0x14
inc esi
inc dword [ebp - 0x104c]
cmp esi, 0x12
jb 0x1009f76
mov eax, dword [ebp - 0x1048]
push 2
mov byte [ebp + eax - 0x1044], bl
push 0x10057bc
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x1044]
push eax
call dword [0x1016ca0]
cmp esi, 0x12
jb 0x1009f65
xor esi, esi
cmp esi, 0x3e
mov dword [ebp - 0x1048], ebx
jae 0x100a068
mov dword [ebp - 0x104c], ebx
cmp dword [ebp - 0x104c], 5
jge 0x100a068
push dword [ebp + esi*8 - 0x13c8]
mov eax, dword [ebp - 0x1048]
push dword [ebp + esi*8 - 0x13c4]
inc dword [ebp - 0x1048]
mov ecx, 0x514
sub ecx, dword [ebp - 0x1048]
push 0x1005970
lea eax, [ebp + eax - 0x1044]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add dword [ebp - 0x1048], eax
add esp, 0x14
inc esi
inc dword [ebp - 0x104c]
cmp esi, 0x3e
jb 0x100a011
mov eax, dword [ebp - 0x1048]
push 2
mov byte [ebp + eax - 0x1044], bl
push 0x10057b0
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x1044]
push eax
call dword [0x1016ca0]
cmp esi, 0x3e
jb 0x100a000
cmp dword [0x1016bf8], 1
mov dword [ebp - 0x1064], ebx
mov dword [ebp - 0x1060], ebx
je 0x100a0ea
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x1064]
push eax
push 0x2001f
push ebx
push 0x1005540
push dword [ebp - 0x1058]
call esi
lea eax, [ebp - 0x1060]
push eax
push 0x2001f
push ebx
push 0x1005540
push dword [ebp - 0x105c]
call esi
jmp 0x100a102
mov eax, dword [ebp - 0x1058]
mov dword [ebp - 0x1064], eax
mov eax, dword [ebp - 0x105c]
mov dword [ebp - 0x1060], eax
cmp dword [ebp - 0x1064], ebx
je 0x100a155
lea esi, [ebp - 0x10a8]
mov dword [ebp - 0x1054], 5
push 0x1009
push dword [esi + 4]
push dword [esi]
push dword [esi - 4]
push dword [ebp - 0x1064]
push ebx
push ebx
call dword [0x1016ca4]
add esi, 0xc
dec dword [ebp - 0x1054]
jne 0x100a11a
cmp dword [0x1016bf8], 1
je 0x100a155
push dword [ebp - 0x1064]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1060], ebx
je 0x100a1a8
lea esi, [ebp - 0x11d4]
mov dword [ebp - 0x1054], 0xd
push 0x1009
push dword [esi + 4]
push dword [esi]
push dword [esi - 4]
push dword [ebp - 0x1060]
push ebx
push ebx
call dword [0x1016ca4]
add esi, 0xc
dec dword [ebp - 0x1054]
jne 0x100a16d
cmp dword [0x1016bf8], 1
je 0x100a1a8
push dword [ebp - 0x1060]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x106c]
push eax
push ebx
call fcn.0100c68d
cmp dword [ebp - 0x106c], 1
je 0x100a1c7
cmp dword [ebp - 0x106c], 2
jne 0x100a215
push dword [0x1016be4]
mov esi, 0x10169d8
push esi
push 0x1005970
lea eax, [ebp - 0x414]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
cmp dword [ebp - 0x106c], 2
mov eax, 0x1005860
je 0x100a1fc
mov eax, 0x100587c
push ebx
push 0xd
push ebx
push 0x10167d0
push esi
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [0x1016c94]
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x1058]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100a23b
push 1
push 0x1001540
call fcn.0100cbd8
pop ebx
push 1
push 0x1001520
call fcn.0100cbd8
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0100d058
leave
ret