Function at 0x104ff4a
Capabilities:
Get common file path
Persist via run registry key
Set current directory
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc58
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
mov esi, dword [ebx + 0x18]
push edi
xor edi, edi
cmp dword [ebp + 8], 3
mov dword [ebp - 0xc40], ebx
mov dword [ebp - 0xc38], esi
je 0x104ff9d
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x104ff9d
push eax
call fcn.010561eb
test eax, eax
je 0x104ff9d
mov ecx, ebx
call fcn.0104fe2d
mov edi, eax
test edi, edi
jl 0x10506ef
test esi, esi
jne 0x104ffab
mov eax, 0x80004003
jmp 0x10506ef
push esi
call fcn.010561eb
test eax, eax
jne 0x104ffbf
mov eax, 0x80070002
jmp 0x10506ef
mov eax, dword [ebx + 0x2c]
cmp eax, 1
je 0x105035c
jle 0x1050352
cmp eax, 4
jle 0x10502c0
cmp eax, 5
je 0x105017e
cmp eax, 6
jne 0x1050352
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, 0x1008570
test eax, eax
je 0x105002a
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010358a6
test eax, eax
jl 0x105002a
lea eax, [ebp - 0x20c]
push eax
call fcn.010561eb
test eax, eax
jne 0x105006e
push 0x103
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1050168
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010358a6
test eax, eax
jl 0x1050168
lea eax, [ebp - 0x20c]
push eax
call fcn.010561eb
test eax, eax
je 0x1050168
cmp dword [ebp + 0x10], 0
push 0x2c
pop ecx
je 0x105007c
mov ecx, 0x22c
mov eax, dword [ebx + 0x14]
test eax, eax
jne 0x1050088
mov eax, 0x1001e44
push ecx
push eax
push dword [ebp - 0xc38]
lea eax, [ebp - 0x20c]
push eax
push 0x1008510
lea eax, [ebp - 0xc34]
push 0x208
push eax
call fcn.0103592d
add esp, 0x1c
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push dword [ebp - 0xc38]
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.01035831
lea eax, [ebp - 0x824]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x10500eb
xor ecx, ecx
mov word [eax], cx
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x824]
push eax
call ebx
mov eax, dword [ebp - 0xc40]
mov esi, 0xffff
push esi
push dword [eax + 0x3c]
lea eax, [ebp - 0xc34]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0105983a
test eax, eax
je 0x1050124
xor edi, edi
jmp 0x105013e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1050133
push 0x57
pop eax
test eax, eax
jle 0x105013c
and eax, esi
or eax, 0x80070000
mov edi, eax
lea eax, [ebp - 0x414]
push eax
call ebx
test edi, edi
jl 0x10506d0
call fcn.010567c9
test eax, eax
je 0x10506d0
push 0
push 0x10084f4
jmp 0x10502aa
push 0x10084a0
push 2
mov edi, 0x80070002
call fcn.01055c50
jmp 0x10506d0
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, 0x1008570
test eax, eax
je 0x10501a8
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010358a6
lea eax, [ebp - 0x20c]
push eax
call fcn.010561eb
test eax, eax
jne 0x10501f0
push 0x103
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10501dc
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010358a6
lea eax, [ebp - 0x20c]
push eax
call fcn.010561eb
test eax, eax
je 0x1050168
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x208
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.01035831
cmp dword [ebp + 8], 3
lea eax, [ebp - 0x61c]
jne 0x105021c
push 0x1008448
jmp 0x1050221
push 0x10083e0
push esi
push eax
call fcn.010358a6
push dword [ebp - 0xc38]
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.010358a6
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x1050250
push eax
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.010358a6
mov esi, 0xffff
push esi
push dword [ebx + 0x3c]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0105983a
test eax, eax
je 0x1050274
xor edi, edi
jmp 0x1050296
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1050283
push 0x57
pop eax
test eax, eax
jle 0x105028c
and eax, esi
or eax, 0x80070000
mov edi, eax
test edi, edi
jl 0x10506d0
call fcn.010567c9
test eax, eax
je 0x10506d0
push 0
push 0x10083c0
push 8
mov ecx, 0x10746c8
call fcn.01058b32
mov edi, 0xd2af9
jmp 0x10506d0
lea ecx, [ebp - 0xc58]
call fcn.01060550
push 1
mov ecx, 0x10746c8
call fcn.01058aff
cmp dword [ebp + 8], 3
mov eax, dword [ebx + 0x84]
mov dword [ebp - 0xc4c], eax
mov eax, 0x10083ac
je 0x10502f1
mov eax, dword [ebx + 0x14]
push dword [ebp + 0x10]
lea ecx, [ebp - 0xc58]
push eax
push esi
call fcn.01063701
mov edi, eax
test edi, edi
jge 0x1050342
cmp byte [ebx + 0x60], 0
je 0x1050328
or dword [0x1074660], 4
push esi
push 0x1008360
push 2
call fcn.01055c8a
add esp, 0xc
xor edi, edi
jmp 0x1050342
mov dword [0x1074668], edi
mov eax, dword [ebx + 0x84]
mov eax, dword [eax + 0x40]
add eax, dword [0x1072c60]
mov dword [0x1074664], eax
lea ecx, [ebp - 0xc58]
call fcn.0106056f
jmp 0x10506d0
mov edi, 0x80004005
jmp 0x10506d0
push esi
push 0x207
lea eax, [ebp - 0x61c]
push eax
mov dword [ebp - 0xc3c], 1
call fcn.01035831
push 0x100835c
mov esi, 0x208
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.010358a6
mov eax, dword [ebx + 0x14]
test eax, eax
je 0x10503a4
push eax
push esi
lea eax, [ebp - 0x61c]
push eax
call fcn.010358a6
mov ecx, dword [ebx + 0x84]
push 0
call fcn.0104d154
mov ecx, 0x186a0
test edx, edx
ja 0x10503c5
jb 0x10503c0
cmp eax, ecx
jae 0x10503c5
mov ecx, 0x2710
xor edx, edx
div ecx
mov dword [0x1074674], eax
cmp eax, 0x64
jbe 0x10503e1
push 0xa
xor edx, edx
pop ecx
div ecx
mov dword [0x1074674], eax
jmp 0x10503ee
push 0x14
pop ecx
cmp eax, ecx
jae 0x10503ee
mov dword [0x1074674], ecx
push 0x100833c
push dword [ebp - 0xc38]
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1050428
push 0x64
mov dword [0x107466c], 1
mov esi, 0x1f4
call fcn.0105508f
mov eax, dword [0x1072c64]
mov dword [ebp - 0xc3c], eax
jmp 0x1050449
push dword [0x1074674]
and dword [0x107466c], 0
mov esi, 0x1388
call fcn.0105508f
push 0x26ec
call fcn.010552a2
push 0x104c227
push esi
push 0x2f00
push dword [0x10746bc]
call dword [sym.imp.USER32.dll_SetTimer]
cmp dword [ebp - 0xc3c], 0
je 0x10504ae
mov esi, 0xffff
push esi
push dword [ebx + 0x3c]
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0xc38]
call fcn.0105983a
test eax, eax
je 0x105048f
xor edi, edi
jmp 0x1050589
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x105049e
push 0x57
pop eax
test eax, eax
jle 0x10504a7
and eax, esi
or eax, 0x80070000
mov edi, eax
jmp 0x1050589
push 0x100833c
push dword [ebp - 0xc38]
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1050574
xor eax, eax
push eax
lea ecx, [ebp - 0xc3c]
push ecx
push eax
push 3
push eax
push eax
push eax
push 0x1002568
push 0x80000001
mov dword [ebp - 0xc3c], eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1050564
mov esi, 0x104
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01058c4e
test eax, eax
je 0x1050558
push 0x100831c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010358a6
test eax, eax
jl 0x1050558
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1050529
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push 0x10082fc
push dword [ebp - 0xc3c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10082bc
push 4
call fcn.01055c8a
pop ecx
pop ecx
jmp 0x1050589
push dword [ebp - 0xc38]
push 0x1008250
push 2
call fcn.01055c8a
add esp, 0xc
xor esi, esi
cmp dword [0x107466c], esi
je 0x1050597
push 0x64
jmp 0x105059d
push dword [0x1074674]
call fcn.0105522c
push 0x2f00
push dword [0x10746bc]
call dword [sym.imp.USER32.dll_KillTimer]
cmp edi, esi
jge 0x10505db
cmp byte [ebx + 0x60], 0
je 0x10505db
push dword [ebp - 0xc38]
or dword [0x1074660], 1
push 0x1008200
push 2
call fcn.01055c8a
add esp, 0xc
xor edi, edi
cmp dword [ebx + 0x5c], esi
je 0x1050639
cmp edi, 0x80070bc2
jne 0x10505f0
push esi
mov ecx, 0x10746c8
jmp 0x1050651
cmp edi, 0x8007f901
jne 0x10505fc
xor edi, edi
jmp 0x1050662
cmp edi, 0x8007f02a
jne 0x105060b
mov edi, 0xc00d2afb
jmp 0x1050662
cmp edi, esi
jl 0x105061d
push 1
mov ecx, 0x10746c8
call fcn.01058aff
jmp 0x1050662
mov dword [0x1074668], edi
mov eax, dword [ebx + 0x84]
mov eax, dword [eax + 0x40]
add eax, dword [0x1072c60]
mov dword [0x1074664], eax
jmp 0x1050662
cmp edi, esi
jl 0x1050662
mov esi, 0x10746c8
mov ecx, esi
call fcn.0105684f
test eax, eax
je 0x1050662
push 0
mov ecx, esi
push 0x10081e4
push 8
call fcn.01058b32
mov edi, 0xd2af9
push edi
push dword [ebp - 0xc38]
call fcn.0104d282
test eax, eax
jne 0x1050687
or dword [0x1074660], 2
push 0x1008190
push 2
call fcn.01055c8a
pop ecx
pop ecx
mov esi, dword [sym.imp.msvcrt.dll_wcsstr]
push 0x100817c
push dword [ebp - 0xc38]
call esi
pop ecx
pop ecx
test eax, eax
jne 0x10506b3
push 0x1008160
push dword [ebp - 0xc38]
call esi
pop ecx
pop ecx
test eax, eax
je 0x10506d0
test edi, edi
jl 0x10506c9
xor eax, eax
cmp edi, 0xd2af9
setne al
mov dword [0x1072c64], eax
jmp 0x10506d0
and dword [0x1072c64], 0
push edi
push 0x100812c
push 4
call fcn.01055c8a
mov ecx, dword [ebp - 0xc40]
add esp, 0xc
push 0
call fcn.0104f068
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047480
leave
ret 0xc