Function at 0x102a788
Capabilities:
Get common file path
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x410], esi
mov dword [ebp - 0x414], esi
call fcn.01028286
push 0x100
lea eax, [ebp - 0x40c]
push eax
push 0x7f
push dword [0x1047500]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x102acff
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x102acfe
push 0x10044b0
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x418], esi
call fcn.01032aa3
test eax, eax
jne 0x102a889
mov eax, dword [ebp - 0x418]
mov ecx, eax
shr ecx, 0x10
cmp cx, 5
jne 0x102a849
cmp ax, 1
jne 0x102a849
inc eax
mov dword [ebp - 0x418], eax
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
lea eax, [ebp - 0x40c]
push eax
push 0x1004498
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.01028b64
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
push 0xff
lea eax, [ebp - 0x40c]
push eax
call fcn.01028a67
push ebx
push 0x103
lea eax, [ebp - 0x20c]
push eax
push 3
call fcn.01028bdb
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x102a977
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x10043e0
push 0x80000002
mov dword [ebp - 0x414], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102a918
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102a8e6
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x10043cc
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call ebx
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x10043e0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102a991
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102a943
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x10043cc
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call ebx
jmp 0x102a991
push 0x103
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.01028bdb
test eax, eax
je 0x102acfd
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1004140
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102a9ee
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102a9bc
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1004120
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call ebx
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x10023f8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102aa7a
lea eax, [ebp - 0x40c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102aa19
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x40c]
push eax
push 1
push esi
push esi
push dword [ebp - 0x410]
call edi
lea eax, [ebp - 0x20c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x102aa48
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x10043cc
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call ebx
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x10023f8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102aad7
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102aaa5
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x10043cc
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call ebx
lea eax, [ebp - 0x410]
push eax
push 2
push esi
push 0x1004310
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102ab30
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102aafe
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
test esp, esi
std
invalid
call dword [eax + 0x6a]
add dword [esi + 0x68], edx
int3
inc ebx
add byte [ecx], al
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call ebx
cmp dword [ebp - 0x414], esi
jne 0x102ab53
push 0x103
lea eax, [ebp - 0x20c]
push eax
push 2
call fcn.01028bdb
test eax, eax
je 0x102ac15
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1004258
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102abb0
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102ab7e
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x10043cc
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call ebx
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1004258
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102ac0d
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102abdb
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x10043cc
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call ebx
cmp dword [ebp - 0x414], esi
jne 0x102ac30
push 0x103
lea eax, [ebp - 0x20c]
push eax
push 1
call fcn.01028bdb
test eax, eax
je 0x102acfd
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x10041a0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102aca0
push 2
push 0x1002d58
push 1
push esi
push esi
push dword [ebp - 0x410]
call edi
lea eax, [ebp - 0x20c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x102ac6e
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x10043cc
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call ebx
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x10041a0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102acfd
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102accb
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x10043cc
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call ebx
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.01031a01
leave
ret 4