Function at 0x101091d0
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1854
call fcn.101f99e0
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x183c], ecx
push 0x800
push eax
mov dword [ebp - 0x180c], eax
lea eax, [ebp - 0x1004]
push eax
call sub.msvcrt.dll_memset
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x800
lea eax, [ebp - 0x1804]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x20019
push 0x800
lea eax, [ebp - 0x1004]
push eax
push 1
push str.Download_Directory
push str.SOFTWAREMicrosoftInternet_Explorer
push SysReAllocString
call fcn.10176900
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea eax, [ebp - 0x804]
add esp, 0x40
push eax
push 0
push 0
push 0x20
push 0
call esi
lea eax, [ebp - 0x1804]
push eax
push 0
push 0
push 6
push 0
call esi
lea ecx, [ebp - 0x1854]
mov dword [ebp - 0x1854], 0
mov dword [ebp - 0x1850], 0
mov dword [ebp - 0x184c], 0xffffffff
call fcn.10008220
push 0x20019
push str.Environment
lea eax, [ebp - 0x1854]
push SysReAllocString
push eax
mov ecx, eax
call fcn.1000a260
push str.TEMP
lea eax, [ebp - 0x1854]
push eax
lea eax, [ebp - 0x1824]
push eax
call fcn.10060900
mov edi, dword [ebp - 0x1850]
add esp, 0xc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x1840], 0
test edi, edi
je 0x1010935a
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x10109313
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x41
call fcn.10003680
add esp, 4
push 0
push 0
test eax, eax
je 0x10109338
lea ecx, [ebp - 0x1840]
push ecx
push 0
push str.TEMP
push edi
call eax
jmp 0x10109349
lea eax, [ebp - 0x1840]
push eax
push 0
push str.TEMP
push edi
call ebx
mov edi, eax
test esi, esi
je 0x10109356
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x101093bb
mov edi, dword [ebp - 0x1854]
test edi, edi
je 0x101093bb
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1010937a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x41
call fcn.10003680
add esp, 4
push 0
push 0
test eax, eax
je 0x1010939f
lea ecx, [ebp - 0x1840]
push ecx
push 0
push str.TEMP
push edi
call eax
jmp 0x101093b0
lea eax, [ebp - 0x1840]
push eax
push 0
push str.TEMP
push edi
call ebx
test esi, esi
je 0x101093bb
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
or ebx, 0xffffffff
cmp dword [ebp - 0x1840], 2
jne 0x10109405
push dword [ebp - 0x1824]
lea eax, [ebp - 0x1808]
push eax
call fcn.10008d60
add esp, 8
lea ecx, [ebp - 0x1824]
push eax
call fcn.10002790
mov edx, dword [ebp - 0x1808]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109405
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x10214d08
lea eax, [ebp - 0x1854]
mov dword [ebp - 0x1844], 0
push eax
lea eax, [ebp - 0x1820]
push eax
call fcn.10060900
mov edi, dword [ebp - 0x1850]
add esp, 0xc
test edi, edi
je 0x10109495
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1010944a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x41
call fcn.10003680
add esp, 4
push 0
push 0
test eax, eax
je 0x1010946f
lea ecx, [ebp - 0x1844]
push ecx
push 0
push 0x10214d08
push edi
call eax
jmp 0x10109484
lea eax, [ebp - 0x1844]
push eax
push 0
push 0x10214d08
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test esi, esi
je 0x10109491
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x101094fa
mov edi, dword [ebp - 0x1854]
test edi, edi
je 0x101094fa
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101094b5
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x41
call fcn.10003680
add esp, 4
push 0
push 0
test eax, eax
je 0x101094da
lea ecx, [ebp - 0x1844]
push ecx
push 0
push 0x10214d08
push edi
call eax
jmp 0x101094ef
lea eax, [ebp - 0x1844]
push eax
push 0
push 0x10214d08
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test esi, esi
je 0x101094fa
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x1844], 2
jne 0x10109541
push dword [ebp - 0x1820]
lea eax, [ebp - 0x1808]
push eax
call fcn.10008d60
add esp, 8
lea ecx, [ebp - 0x1820]
push eax
call fcn.10002790
mov edx, dword [ebp - 0x1808]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109541
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x1824]
cmp dword [esi - 0xc], 0
je 0x101095b0
push 1
lea eax, [ebp - 0x1808]
push eax
lea ecx, [ebp - 0x1824]
call fcn.1000a000
mov ecx, 0x10202944
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1010958e
test dx, dx
je 0x1010958a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1010958e
add eax, 4
add ecx, 4
test dx, dx
jne 0x10109568
xor ecx, ecx
jmp 0x10109593
sbb ecx, ecx
or ecx, 1
mov eax, 1
mov dword [ebp - 0x180c], eax
test ecx, ecx
je 0x101095b6
mov byte [ebp - 0x180d], al
mov dword [ebp - 0x180c], eax
jmp 0x101095bd
mov eax, dword [ebp - 0x180c]
mov byte [ebp - 0x180d], 0
test al, 1
je 0x101095e7
mov edx, dword [ebp - 0x1808]
and eax, 0xfffffffe
mov dword [ebp - 0x180c], eax
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x101095e7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x180d], 0
je 0x1010967c
mov eax, dword [esi - 0xc]
mov edi, 0x10202944
push 1
sub edi, esi
mov dword [ebp - 0x1808], eax
push 0x10202944
sar edi, 1
call fcn.101e6fd0
mov ecx, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
add esp, 8
mov dword [ebp - 0x1818], eax
add eax, dword [ebp - 0x1808]
sub ecx, eax
or edx, ecx
jge 0x10109644
push eax
lea ecx, [ebp - 0x1824]
call fcn.10003310
mov esi, dword [ebp - 0x1824]
mov eax, dword [ebp - 0x1808]
lea ecx, [esi + edi*2]
cmp edi, eax
jbe 0x10109656
mov ecx, 0x10202944
mov edi, dword [ebp - 0x1818]
lea eax, [esi + eax*2]
push edi
push ecx
push edi
push eax
call fcn.10008010
mov eax, dword [ebp - 0x1808]
add esp, 0x10
add eax, edi
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov edi, dword [ebp - 0x1820]
cmp dword [edi - 0xc], 0
je 0x101096e8
mov eax, dword [ebp - 0x180c]
lea ecx, [ebp - 0x1820]
or eax, 2
mov dword [ebp - 0x180c], eax
lea eax, [ebp - 0x1818]
push 1
push eax
call fcn.1000a000
mov ecx, 0x10202944
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x101096d8
test dx, dx
je 0x101096d4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x101096d8
add eax, 4
add ecx, 4
test dx, dx
jne 0x101096b2
xor eax, eax
jmp 0x101096dd
sbb eax, eax
or eax, 1
mov byte [ebp - 0x180d], 1
test eax, eax
jne 0x101096ef
mov byte [ebp - 0x180d], 0
mov eax, dword [ebp - 0x180c]
test al, 2
je 0x1010971f
mov edx, dword [ebp - 0x1818]
and eax, 0xfffffffd
mov dword [ebp - 0x180c], eax
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010971f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x180d], 0
je 0x101097b4
mov eax, dword [edi - 0xc]
mov esi, 0x10202944
push 1
sub esi, edi
mov dword [ebp - 0x1808], eax
push 0x10202944
sar esi, 1
call fcn.101e6fd0
mov ecx, dword [edi - 8]
mov edx, 1
sub edx, dword [edi - 4]
add esp, 8
mov dword [ebp - 0x1818], eax
add eax, dword [ebp - 0x1808]
sub ecx, eax
or edx, ecx
jge 0x1010977c
push eax
lea ecx, [ebp - 0x1820]
call fcn.10003310
mov edi, dword [ebp - 0x1820]
mov eax, dword [ebp - 0x1808]
lea ecx, [edi + esi*2]
cmp esi, eax
jbe 0x1010978e
mov ecx, 0x10202944
mov esi, dword [ebp - 0x1818]
lea eax, [edi + eax*2]
push esi
push ecx
push esi
push eax
call fcn.10008010
mov eax, dword [ebp - 0x1808]
add esp, 0x10
add eax, esi
xor ecx, ecx
mov dword [edi - 0xc], eax
mov word [edi + eax*2], cx
mov eax, dword [ebp - 0x183c]
add eax, 0x6e4
push eax
lea eax, [ebp - 0x182c]
push eax
call fcn.10008d60
add esp, 8
lea eax, [ebp - 0x1818]
lea ecx, [ebp - 0x182c]
push 1
push eax
call fcn.1000a000
mov ecx, 0x10202944
mov eax, dword [eax]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10109816
test dx, dx
je 0x10109812
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10109816
add eax, 4
add ecx, 4
test dx, dx
jne 0x101097f0
xor esi, esi
jmp 0x1010981b
sbb esi, esi
or esi, 1
mov edx, dword [ebp - 0x1818]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109838
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x101098f0
mov eax, dword [ebp - 0x182c]
mov ecx, 0x10202944
sub ecx, eax
mov dword [ebp - 0x1808], 0x10202944
sar ecx, 1
push 1
mov esi, dword [eax - 0xc]
push 0x10202944
mov dword [ebp - 0x1820], ecx
mov dword [ebp - 0x1818], esi
call fcn.101e6fd0
mov ecx, dword [ebp - 0x182c]
add esi, eax
mov dword [ebp - 0x181c], eax
add esp, 8
mov eax, 1
mov edx, dword [ecx - 8]
sub eax, dword [ecx - 4]
sub edx, esi
or eax, edx
jge 0x101098a8
push esi
lea ecx, [ebp - 0x182c]
call fcn.10003310
mov ecx, dword [ebp - 0x182c]
mov eax, dword [ebp - 0x1818]
mov edx, dword [ebp - 0x1820]
cmp edx, eax
ja 0x101098c1
lea edx, [ecx + edx*2]
mov dword [ebp - 0x1808], edx
mov edx, dword [ebp - 0x181c]
lea eax, [ecx + eax*2]
push edx
push dword [ebp - 0x1808]
push edx
push eax
call fcn.10008010
mov eax, dword [ebp - 0x182c]
add esp, 0x10
xor ecx, ecx
mov dword [eax - 0xc], esi
mov eax, dword [ebp - 0x182c]
mov word [eax + esi*2], cx
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x10109906
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x1d
call fcn.10003680
add esp, 4
push edi
test eax, eax
je 0x10109919
call eax
jmp 0x1010991f
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov dword [ebp - 0x1808], eax
test esi, esi
je 0x10109930
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x1808], 0
jne 0x1010a37a
push dword [ebp - 0x182c]
push edi
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x1010a37a
push 0x20019
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1838], 0
push str.TEMP
mov dword [ebp - 0x1834], 0
mov dword [ebp - 0x1830], 0
call fcn.10002490
push ecx
mov ecx, esp
push str.Environment
call fcn.10002490
push SysReAllocString
lea eax, [ebp - 0x1838]
push eax
lea eax, [ebp - 0x181c]
push eax
call fcn.100da240
mov edx, dword [ebp - 0x181c]
add esp, 0x1c
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x101099cb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x20019
push 1
push ecx
mov ecx, esp
push 0x10214d08
call fcn.10002490
push ecx
mov ecx, esp
push str.Environment
call fcn.10002490
push SysReAllocString
lea eax, [ebp - 0x1838]
push eax
lea eax, [ebp - 0x181c]
push eax
call fcn.100da240
mov edx, dword [ebp - 0x181c]
add esp, 0x1c
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109a24
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
cmp dword [edi - 0xc], 0
mov dword [ebp - 0x1808], eax
mov eax, dword [ebp - 0x180c]
jne 0x10109a75
or eax, 0xc
lea ecx, [ebp - 0x1814]
push 0x10202940
mov dword [ebp - 0x180c], eax
call fcn.10002490
push eax
lea eax, [ebp - 0x1828]
push 0x9cbc
push eax
call fcn.100053d0
add esp, 0xc
jmp 0x10109a8a
or eax, 0x10
lea ecx, [ebp - 0x1820]
push edi
mov dword [ebp - 0x180c], eax
call fcn.10002490
mov esi, dword [eax]
lea ecx, [ebp - 0x1818]
push 0x10202940
call fcn.10002490
push eax
lea eax, [ebp - 0x181c]
push 0x9c65
push eax
call fcn.100053d0
push esi
push dword [eax]
lea eax, [ebp - 0x1808]
push eax
call fcn.10002cb0
mov edx, dword [ebp - 0x181c]
add esp, 0x18
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109add
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1818]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109afa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x180c]
test cl, 0x10
je 0x10109b31
mov edx, dword [ebp - 0x1820]
and ecx, 0xffffffef
mov dword [ebp - 0x180c], ecx
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109b31
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x180c]
test cl, 8
je 0x10109b62
mov edx, dword [ebp - 0x1828]
and ecx, 0xfffffff7
mov dword [ebp - 0x180c], ecx
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109b62
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x180c]
test cl, 4
je 0x10109b84
mov edx, dword [ebp - 0x1814]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109b84
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x2807
lea ecx, [ebp - 0x181c]
call fcn.10002490
push 0x10202940
lea ecx, [ebp - 0x1828]
mov esi, dword [eax]
call fcn.10002490
push eax
lea eax, [ebp - 0x1814]
push 0x9c64
push eax
call fcn.100053d0
add esp, 0xc
mov ebx, dword [eax]
push 1
push 0
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
mov ecx, dword [ebp - 0x183c]
lea eax, [ebp - 0x1838]
push 0
push 0xffffffffffffffff
push 4
push eax
push 0
push 0
push 0x10202940
push esi
mov esi, dword [ebp - 0x1808]
push esi
push ebx
call fcn.100cd930
mov edx, dword [ebp - 0x1814]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109c45
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1828]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109c62
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x181c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109c7f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10109c96
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1838]
call fcn.1002a3c0
mov esi, dword [ebp - 0x1824]
push ecx
lea eax, [ebp - 0x1004]
mov ecx, esp
push eax
call fcn.10002490
push ecx
lea eax, [ebp - 0x804]
mov ecx, esp
push eax
call fcn.10002490
mov ecx, dword [ebp - 0x183c]
call fcn.10108c40
test eax, eax
je 0x10109ec6
push 0x20019
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1838], 0
push str.Download_Directory
mov dword [ebp - 0x1834], 0
mov dword [ebp - 0x1830], 0
call fcn.10002490
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftInternet_Explorer
call fcn.10002490
push SysReAllocString
lea eax, [ebp - 0x1838]
push eax
lea eax, [ebp - 0x1814]
push eax
call fcn.100da240
mov edx, dword [ebp - 0x1814]
add esp, 0x1c
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109d4f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x2807
lea ecx, [ebp - 0x1824]
call fcn.10002490
push 0x10202940
lea ecx, [ebp - 0x1820]
mov eax, dword [eax]
mov dword [ebp - 0x1814], eax
call fcn.10002490
push eax
lea eax, [ebp - 0x1808]
push 0x2772
push eax
call fcn.100053d0
add esp, 0xc
lea ecx, [ebp - 0x1818]
mov eax, dword [eax]
push 0x10202940
mov dword [ebp - 0x1828], eax
call fcn.10002490
push eax
lea eax, [ebp - 0x181c]
push 0x2771
push eax
call fcn.100053d0
add esp, 0xc
mov ebx, dword [eax]
push 1
push 0
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
mov ecx, dword [ebp - 0x183c]
lea eax, [ebp - 0x1838]
push 0
push 0xffffffffffffffff
push 4
push eax
push 0
push 0
push 0x10202940
push dword [ebp - 0x1814]
push dword [ebp - 0x1828]
push ebx
call fcn.100cd930
mov edx, dword [ebp - 0x181c]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109e47
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1818]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109e64
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1808]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109e81
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1820]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109e9e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1824]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109ebb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1838]
call fcn.1002a3c0
push ecx
lea eax, [ebp - 0x1804]
mov ecx, esp
push eax
call fcn.10002490
push ecx
lea eax, [ebp - 0x804]
mov ecx, esp
push eax
call fcn.10002490
mov ecx, dword [ebp - 0x183c]
call fcn.10108ee0
test eax, eax
je 0x1010a0e5
push 0x20019
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1838], 0
push str.Favorites
mov dword [ebp - 0x1834], 0
mov dword [ebp - 0x1830], 0
call fcn.10002490
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.10002490
push SysReAllocString
lea eax, [ebp - 0x1838]
push eax
lea eax, [ebp - 0x1814]
push eax
call fcn.100da240
mov edx, dword [ebp - 0x1814]
add esp, 0x1c
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10109f6e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x2807
lea ecx, [ebp - 0x1824]
call fcn.10002490
push 0x10202940
lea ecx, [ebp - 0x1820]
mov eax, dword [eax]
mov dword [ebp - 0x1814], eax
call fcn.10002490
push eax
lea eax, [ebp - 0x1808]
push 0x2774
push eax
call fcn.100053d0
add esp, 0xc
lea ecx, [ebp - 0x1818]
mov eax, dword [eax]
push 0x10202940
mov dword [ebp - 0x1828], eax
call fcn.10002490
push eax
lea eax, [ebp - 0x181c]
push 0x2773
push eax
call fcn.100053d0
add esp, 0xc
mov ebx, dword [eax]
push 1
push 0
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
mov ecx, dword [ebp - 0x183c]
lea eax, [ebp - 0x1838]
push 0
push 0xffffffffffffffff
push 4
push eax
push 0
push 0
push 0x10202940
push dword [ebp - 0x1814]
push dword [ebp - 0x1828]
push ebx
call fcn.100cd930
mov edx, dword [ebp - 0x181c]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a066
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1818]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a083
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1808]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a0a0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1820]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a0bd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1824]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a0da
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1838]
call fcn.1002a3c0
push ecx
lea eax, [ebp - 0x1004]
mov ecx, esp
push eax
call fcn.10002490
push ecx
lea eax, [ebp - 0x1804]
mov ecx, esp
push eax
call fcn.10002490
push ecx
lea eax, [ebp - 0x804]
mov ecx, esp
push eax
call fcn.10002490
mov ecx, dword [ebp - 0x183c]
call fcn.10108410
test eax, eax
je 0x1010a313
push 0x20019
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1838], 0
push str.Cache
mov dword [ebp - 0x1834], 0
mov dword [ebp - 0x1830], 0
call fcn.10002490
push ecx
mov ecx, esp
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
call fcn.10002490
push SysReAllocString
lea eax, [ebp - 0x1838]
push eax
lea eax, [ebp - 0x1814]
push eax
call fcn.100da240
mov edx, dword [ebp - 0x1814]
add esp, 0x1c
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a19c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x2807
lea ecx, [ebp - 0x1824]
call fcn.10002490
push 0x10202940
lea ecx, [ebp - 0x1820]
mov eax, dword [eax]
mov dword [ebp - 0x1814], eax
call fcn.10002490
push eax
lea eax, [ebp - 0x1808]
push 0x275e
push eax
call fcn.100053d0
add esp, 0xc
lea ecx, [ebp - 0x1818]
mov eax, dword [eax]
push 0x10202940
mov dword [ebp - 0x1828], eax
call fcn.10002490
push eax
lea eax, [ebp - 0x181c]
push 0x275d
push eax
call fcn.100053d0
add esp, 0xc
mov ebx, dword [eax]
push 1
push 0
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
mov ecx, dword [ebp - 0x183c]
lea eax, [ebp - 0x1838]
push 0
push 0xffffffffffffffff
push 4
push eax
push 0
push 0
push 0x10202940
push dword [ebp - 0x1814]
push dword [ebp - 0x1828]
push ebx
call fcn.100cd930
mov edx, dword [ebp - 0x181c]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a294
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1818]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a2b1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1808]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a2ce
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1820]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a2eb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1824]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a308
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1838]
call fcn.1002a3c0
mov edx, dword [ebp - 0x182c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a330
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
mov eax, ebx
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1010a347
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x1010a35c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1854]
call fcn.10008220
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1010a390
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x1d
call fcn.10003680
add esp, 4
push dword [ebp - 0x1824]
test eax, eax
je 0x1010a3a8
call eax
jmp 0x1010a3ae
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
mov dword [ebp - 0x1808], eax
test esi, esi
je 0x1010a3bf
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x1808], 0
jne 0x10109ca1
push dword [ebp - 0x182c]
mov esi, dword [ebp - 0x1824]
push esi
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x10109ca7
push 0x20019
push 1
push ecx
mov ecx, esp
mov dword [ebp - 0x1838], 0
push str.TEMP
mov dword [ebp - 0x1834], 0
mov dword [ebp - 0x1830], 0
call fcn.10002490
push ecx
mov ecx, esp
push str.Environment
call fcn.10002490
push SysReAllocString
lea eax, [ebp - 0x1838]
push eax
lea eax, [ebp - 0x1814]
push eax
call fcn.100da240
mov edx, dword [ebp - 0x1814]
add esp, 0x1c
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a460
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x20019
push 1
push ecx
mov ecx, esp
push 0x10214d08
call fcn.10002490
push ecx
mov ecx, esp
push str.Environment
call fcn.10002490
push SysReAllocString
lea eax, [ebp - 0x1838]
push eax
lea eax, [ebp - 0x1814]
push eax
call fcn.100da240
mov edx, dword [ebp - 0x1814]
add esp, 0x1c
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a4b9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
cmp dword [esi - 0xc], 0
mov dword [ebp - 0x1808], eax
mov eax, dword [ebp - 0x180c]
jne 0x1010a50a
or eax, 0x60
lea ecx, [ebp - 0x1820]
push 0x10202940
mov dword [ebp - 0x180c], eax
call fcn.10002490
push eax
lea eax, [ebp - 0x1818]
push 0x9cbc
push eax
call fcn.100053d0
add esp, 0xc
jmp 0x1010a521
or eax, 0x80
lea ecx, [ebp - 0x181c]
push esi
mov dword [ebp - 0x180c], eax
call fcn.10002490
mov ebx, dword [eax]
lea ecx, [ebp - 0x1828]
push 0x10202940
call fcn.10002490
push eax
lea eax, [ebp - 0x1814]
push 0x9c65
push eax
call fcn.100053d0
push ebx
push dword [eax]
lea eax, [ebp - 0x1808]
push eax
call fcn.10002cb0
mov edx, dword [ebp - 0x1814]
or ebx, 0xffffffff
add esp, 0x18
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a577
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1828]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a594
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x180c]
test cl, cl
jns 0x1010a5cd
mov edx, dword [ebp - 0x181c]
and ecx, 0xffffff7f
mov dword [ebp - 0x180c], ecx
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a5cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x180c]
test cl, 0x40
je 0x1010a5fe
mov edx, dword [ebp - 0x1818]
and ecx, 0xffffffbf
mov dword [ebp - 0x180c], ecx
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a5fe
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x180c]
test cl, 0x20
je 0x1010a620
mov edx, dword [ebp - 0x1820]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a620
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x2807
lea ecx, [ebp - 0x1818]
call fcn.10002490
push 0x10202940
lea ecx, [ebp - 0x181c]
mov eax, dword [eax]
mov dword [ebp - 0x1814], eax
call fcn.10002490
push eax
lea eax, [ebp - 0x1828]
push 0x9c64
push eax
call fcn.100053d0
add esp, 0xc
mov ebx, dword [eax]
push 1
push 0
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
mov ecx, dword [ebp - 0x183c]
lea eax, [ebp - 0x1838]
push 0
push 0xffffffffffffffff
push 4
push eax
push 0
push 0
push 0x10202940
push dword [ebp - 0x1814]
push dword [ebp - 0x1808]
push ebx
call fcn.100cd930
mov edx, dword [ebp - 0x1828]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a6eb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x181c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a708
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1818]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a725
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1808]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1010a742
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1838]
call fcn.1002a3c0
jmp 0x10109ca7