Function at 0x100d555
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x17f8
call fcn.0100f7c0
mov eax, dword [0x1017048]
push ebx
xor ebx, ebx
cmp byte [0x1018a21], bl
mov dword [ebp - 4], eax
je 0x100d587
xor eax, eax
cmp byte [0x1018a20], bl
sete al
jmp 0x100ea4b
push 0x1006b00
mov byte [0x1018a21], 1
call fcn.0100f591
lea eax, [ebp - 0x17ec]
mov dword [ebp - 0x17f8], eax
pop ecx
mov dword [ebp - 0x17f4], 0xa
mov dword [ebp - 0x173c], ebx
xor eax, eax
mov ecx, dword [ebp - 0x17f8]
mov dword [ecx + eax*4], ebx
inc eax
cmp eax, dword [ebp - 0x17f4]
jl 0x100d5b7
lea eax, [ebp - 0x1780]
mov dword [ebp - 0x178c], eax
mov dword [ebp - 0x1788], 0xa
mov dword [ebp - 0x1724], ebx
xor eax, eax
mov ecx, dword [ebp - 0x178c]
mov dword [ecx + eax*4], ebx
inc eax
cmp eax, dword [ebp - 0x1788]
jl 0x100d5e7
lea eax, [ebp - 0x17b4]
mov dword [ebp - 0x17c0], eax
mov dword [ebp - 0x17bc], 0xa
mov dword [ebp - 0x1728], ebx
xor eax, eax
mov ecx, dword [ebp - 0x17c0]
mov dword [ecx + eax*4], ebx
inc eax
cmp eax, dword [ebp - 0x17bc]
jl 0x100d617
push esi
push edi
push 0xa
mov dword [ebp - 0x1750], 0x1006af0
mov dword [ebp - 0x174c], 0x1006ae4
mov dword [ebp - 0x1748], 0x1006ad8
xor esi, esi
pop edi
push ebx
lea eax, [ebp - 0x1728]
push eax
lea eax, [ebp - 0x17c0]
push eax
push dword [ebp + esi*4 - 0x1750]
mov dword [ebp - 0x17b8], edi
call fcn.0100a5a6
add esp, 0x10
test al, al
je 0x100d6c8
inc esi
cmp esi, 3
jb 0x100d64e
xor eax, eax
mov word [ebp - 0xe90], bx
mov ecx, 0x81
lea edi, [ebp - 0xe8e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, 0x104
push esi
lea eax, [ebp - 0xe90]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x100d712
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1006a50
call fcn.0100f591
mov byte [0x1018a20], 1
jmp 0x100d74e
cmp dword [ebp - 0x17bc], edi
mov byte [0x1018a20], 1
jle 0x100d6e3
push dword [ebp - 0x17c0]
call fcn.0100f5fc
pop ecx
cmp dword [ebp - 0x1788], edi
jle 0x100d6f7
push dword [ebp - 0x178c]
call fcn.0100f5fc
pop ecx
cmp dword [ebp - 0x17f4], edi
jle 0x100d70b
push dword [ebp - 0x17f8]
call fcn.0100f5fc
pop ecx
xor al, al
jmp 0x100ea49
lea eax, [ebp - 0xe90]
push eax
call fcn.0100f572
cmp word [ebp + eax*2 - 0xe92], 0x5c
pop ecx
je 0x100d73d
lea eax, [ebp - 0xe90]
push 0x1003e4c
push eax
call fcn.0100f6b4
pop ecx
pop ecx
lea eax, [ebp - 0xe90]
push 0x1006a3c
push eax
call fcn.0100f6b4
pop ecx
pop ecx
lea ecx, [ebp - 0x1700]
mov dword [ebp - 0x1700], ebx
call fcn.01008658
push eax
push 0x20019
push ebx
push 0x1003178
push 0x80000002
call fcn.01008692
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add esp, 0x14
cmp eax, ebx
jne 0x100ded0
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1718]
push eax
lea eax, [ebp - 0x878]
push eax
mov dword [ebp - 0x1714], ebx
push ebx
jmp 0x100de60
lea eax, [ebp - 0x878]
push eax
push 0x1005784
lea eax, [ebp - 0x12a0]
push esi
push eax
call fcn.0100a0db
mov eax, dword [ebp - 0x1700]
add esp, 0x10
lea ecx, [ebp - 0x1720]
mov dword [ebp - 0x1720], ebx
mov dword [ebp - 0x1710], eax
call fcn.01008658
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x12a0]
push eax
push dword [ebp - 0x1710]
call fcn.01008692
add esp, 0x14
cmp eax, ebx
je 0x100d816
cmp eax, 2
je 0x100d816
push eax
lea eax, [ebp - 0x878]
push eax
push 0x10069a8
jmp 0x100d907
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x172c]
push eax
lea eax, [ebp - 0x14a8]
push eax
mov dword [ebp - 0x1710], ebx
push ebx
jmp 0x100d8dd
lea eax, [ebp - 0x14a8]
push eax
push 0x1003ebc
lea eax, [ebp - 0xc88]
push esi
push eax
call fcn.0100a0db
mov eax, dword [ebp - 0x1720]
add esp, 0x10
lea ecx, [ebp - 0x1708]
mov dword [ebp - 0x1708], ebx
mov dword [ebp - 0x16fc], eax
call fcn.01008658
push eax
push 0x20019
push ebx
lea eax, [ebp - 0xc88]
push eax
push dword [ebp - 0x16fc]
call fcn.01008692
add esp, 0x14
cmp eax, ebx
je 0x100d98e
push eax
lea eax, [ebp - 0x878]
push eax
lea eax, [ebp - 0xc88]
push eax
push 0x1006920
call fcn.0100f591
add esp, 0x10
mov byte [0x1018a20], 1
lea ecx, [ebp - 0x1708]
call fcn.01008676
inc dword [ebp - 0x1710]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x172c]
push eax
lea eax, [ebp - 0x14a8]
push eax
push dword [ebp - 0x1710]
push dword [ebp - 0x1720]
mov dword [ebp - 0x172c], esi
call edi
cmp eax, ebx
je 0x100d834
cmp eax, 0x103
je 0x100d916
push eax
lea eax, [ebp - 0x878]
push eax
push 0x10068a8
call fcn.0100f591
add esp, 0xc
mov byte [0x1018a20], 1
lea eax, [ebp - 0x878]
push eax
push 0x100576c
lea eax, [ebp - 0x12a0]
push esi
push eax
call fcn.0100a0db
mov eax, dword [ebp - 0x1700]
add esp, 0x10
lea ecx, [ebp - 0x1734]
mov dword [ebp - 0x1734], ebx
mov dword [ebp - 0x1710], eax
call fcn.01008658
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x12a0]
push eax
push dword [ebp - 0x1710]
call fcn.01008692
add esp, 0x14
cmp eax, ebx
je 0x100dcb7
cmp eax, 2
je 0x100de2c
push eax
lea eax, [ebp - 0x878]
push eax
push 0x1006810
jmp 0x100de1d
lea eax, [ebp - 0x1730]
push eax
lea eax, [ebp - 0x17c4]
push eax
lea eax, [ebp - 0x170c]
push eax
push ebx
push 0x10067e8
push dword [ebp - 0x1708]
mov dword [ebp - 0x1730], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100d8b4
cmp dword [ebp - 0x170c], 4
jne 0x100d9dd
cmp dword [ebp - 0x17c4], 1
jne 0x100d8b4
xor eax, eax
mov word [ebp - 0x1098], bx
mov ecx, 0x81
lea edi, [ebp - 0x1096]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x1004b2c
mov dword [ebp - 0x1750], eax
mov dword [ebp - 0x174c], 0x10067c0
mov dword [ebp - 0x1748], ebx
lea edi, [ebp - 0x1750]
lea ecx, [ebp - 0x1730]
push ecx
lea ecx, [ebp - 0x1098]
push ecx
lea ecx, [ebp - 0x170c]
push ecx
push ebx
push eax
push dword [ebp - 0x1708]
mov dword [ebp - 0x1730], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100da50
cmp dword [ebp - 0x170c], 1
je 0x100da59
add edi, 4
mov eax, dword [edi]
cmp eax, ebx
jne 0x100da16
cmp word [ebp - 0x1098], bx
je 0x100daa4
push 0xa
pop eax
mov dword [ebp - 0x17b8], eax
mov dword [ebp - 0x1784], eax
lea eax, [ebp - 0x1728]
push eax
lea eax, [ebp - 0x17c0]
push eax
lea eax, [ebp - 0x1724]
push eax
lea eax, [ebp - 0x178c]
push eax
lea eax, [ebp - 0x1098]
push eax
call fcn.0100a629
add esp, 0x14
test al, al
je 0x100de85
cmp byte [0x1018810], bl
jne 0x100dca1
cmp word [ebp - 0xe90], bx
je 0x100dca1
lea eax, [ebp - 0x14a8]
push eax
push 0x10067a4
lea eax, [ebp - 0xc88]
push esi
push eax
call fcn.0100a0db
mov edi, dword [ebp - 0x1720]
add esp, 0x10
lea ecx, [ebp - 0x1704]
mov dword [ebp - 0x1704], ebx
call fcn.01008658
push eax
push 0x20019
push ebx
lea eax, [ebp - 0xc88]
push eax
push edi
call fcn.01008692
add esp, 0x14
cmp eax, ebx
je 0x100db2d
cmp eax, 2
je 0x100dc96
push eax
lea eax, [ebp - 0x878]
push eax
lea eax, [ebp - 0xc88]
push eax
push 0x1006920
jmp 0x100dc87
lea eax, [ebp - 0xe90]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.0100f6e7
lea eax, [ebp - 0x25c]
push eax
call fcn.0100f572
add esp, 0xc
cmp word [ebp + eax*2 - 0x25e], 0x5c
je 0x100db6d
lea eax, [ebp - 0x25c]
push 0x1003e4c
push eax
call fcn.0100f6b4
pop ecx
pop ecx
lea eax, [ebp - 0x25c]
push 0x5c
push eax
call fcn.0100f67b
pop ecx
pop ecx
mov edi, eax
lea eax, [ebp - 0x1730]
push eax
lea eax, [ebp - 0x1098]
push eax
lea eax, [ebp - 0x170c]
push eax
push ebx
lea eax, [ebp - 0x1744]
push eax
lea eax, [ebp - 0x16b0]
inc edi
push eax
inc edi
mov dword [ebp - 0x16fc], ebx
push ebx
jmp 0x100dc48
inc dword [ebp - 0x16fc]
cmp word [ebp - 0x1098], bx
je 0x100dc18
cmp dword [ebp - 0x170c], 1
jne 0x100dc18
lea eax, [ebp - 0x1098]
push eax
push edi
call fcn.0100f6e7
push 0xa
pop eax
mov dword [ebp - 0x17b8], eax
mov dword [ebp - 0x1784], eax
lea eax, [ebp - 0x1728]
push eax
lea eax, [ebp - 0x17c0]
push eax
lea eax, [ebp - 0x1724]
push eax
lea eax, [ebp - 0x178c]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.0100a629
add esp, 0x1c
test al, al
je 0x100dea2
inc dword [ebp - 0x16fc]
lea eax, [ebp - 0x1730]
push eax
lea eax, [ebp - 0x1098]
push eax
lea eax, [ebp - 0x170c]
push eax
push ebx
lea eax, [ebp - 0x1744]
push eax
lea eax, [ebp - 0x16b0]
push eax
push dword [ebp - 0x16fc]
push dword [ebp - 0x1704]
mov dword [ebp - 0x1744], esi
mov dword [ebp - 0x1730], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebx
je 0x100dbb1
cmp eax, 0x103
je 0x100dc96
push eax
lea eax, [ebp - 0x878]
push eax
lea eax, [ebp - 0xc88]
push eax
push 0x1006738
call fcn.0100f591
add esp, 0x10
mov byte [0x1018a20], 1
lea ecx, [ebp - 0x1704]
call fcn.01008676
lea ecx, [ebp - 0x1708]
call fcn.01008676
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x100d8bf
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x171c]
push eax
lea eax, [ebp - 0xa80]
push eax
mov dword [ebp - 0x1710], ebx
push ebx
jmp 0x100ddf3
mov eax, dword [ebp - 0x1734]
lea ecx, [ebp - 0x16fc]
mov dword [ebp - 0x16fc], ebx
mov dword [ebp - 0x1754], eax
call fcn.01008658
push eax
push 0x20019
push ebx
lea eax, [ebp - 0xa80]
push eax
push dword [ebp - 0x1754]
call fcn.01008692
add esp, 0x14
cmp eax, ebx
je 0x100dd3a
push eax
lea eax, [ebp - 0x878]
push eax
lea eax, [ebp - 0xa80]
push eax
push 0x1006688
call fcn.0100f591
add esp, 0x10
mov byte [0x1018a20], 1
jmp 0x100ddca
lea eax, [ebp - 0x1738]
push eax
lea eax, [ebp - 0x12a0]
push eax
lea eax, [ebp - 0x170c]
push eax
push ebx
push 0x1004b2c
push dword [ebp - 0x16fc]
mov dword [ebp - 0x1738], 0x208
mov word [ebp - 0x12a0], bx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100ddca
cmp dword [ebp - 0x170c], 1
jne 0x100ddca
cmp word [ebp - 0x12a0], bx
je 0x100ddca
push 0xa
pop eax
mov dword [ebp - 0x17b8], eax
mov dword [ebp - 0x1784], eax
lea eax, [ebp - 0x1728]
push eax
lea eax, [ebp - 0x17c0]
push eax
lea eax, [ebp - 0x1724]
push eax
lea eax, [ebp - 0x178c]
push eax
lea eax, [ebp - 0x12a0]
push eax
call fcn.0100a629
add esp, 0x14
test al, al
je 0x100deb6
lea ecx, [ebp - 0x16fc]
call fcn.01008676
inc dword [ebp - 0x1710]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x171c]
push eax
lea eax, [ebp - 0xa80]
push eax
push dword [ebp - 0x1710]
push dword [ebp - 0x1734]
mov dword [ebp - 0x171c], esi
call edi
cmp eax, ebx
je 0x100dcd5
cmp eax, 0x103
je 0x100de2c
push eax
lea eax, [ebp - 0x878]
push eax
push 0x1006610
call fcn.0100f591
mov byte [0x1018a20], 1
add esp, 0xc
lea ecx, [ebp - 0x1734]
call fcn.01008676
lea ecx, [ebp - 0x1720]
call fcn.01008676
inc dword [ebp - 0x1714]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1718]
push eax
lea eax, [ebp - 0x878]
push eax
push dword [ebp - 0x1714]
push dword [ebp - 0x1700]
mov dword [ebp - 0x1718], esi
call edi
cmp eax, ebx
je 0x100d7a6
cmp eax, 0x103
je 0x100dee9
push eax
push 0x10065b8
jmp 0x100dedb
mov byte [0x1018a20], 1
lea ecx, [ebp - 0x1708]
call fcn.01008676
lea ecx, [ebp - 0x1720]
jmp 0x100e533
lea ecx, [ebp - 0x1704]
mov byte [0x1018a20], 1
call fcn.01008676
jmp 0x100de8c
lea ecx, [ebp - 0x16fc]
mov byte [0x1018a20], 1
call fcn.01008676
lea ecx, [ebp - 0x1734]
jmp 0x100de92
cmp eax, 2
je 0x100dee9
push eax
push 0x1006538
call fcn.0100f591
pop ecx
pop ecx
mov byte [0x1018a20], 1
lea ecx, [ebp - 0x1700]
call fcn.01008658
push eax
push 0x20019
push ebx
push 0x1001988
push 0x80000002
call fcn.01008692
add esp, 0x14
cmp eax, ebx
jne 0x100e115
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1718]
push eax
lea eax, [ebp - 0xa80]
push eax
mov dword [ebp - 0x171c], ebx
push ebx
jmp 0x100dfb5
mov eax, dword [ebp - 0x1700]
lea ecx, [ebp - 0x1708]
mov dword [ebp - 0x1708], ebx
mov dword [ebp - 0x1738], eax
call fcn.01008658
push eax
push 0x20019
push ebx
lea eax, [ebp - 0xa80]
push eax
push dword [ebp - 0x1738]
call fcn.01008692
add esp, 0x14
cmp eax, ebx
je 0x100dfe1
push eax
lea eax, [ebp - 0xa80]
push eax
push 0x1006490
call fcn.0100f591
add esp, 0xc
mov byte [0x1018a20], 1
lea ecx, [ebp - 0x1708]
call fcn.01008676
inc dword [ebp - 0x171c]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1718]
push eax
lea eax, [ebp - 0xa80]
push eax
push dword [ebp - 0x171c]
push dword [ebp - 0x1700]
mov dword [ebp - 0x1718], esi
call edi
cmp eax, ebx
je 0x100df33
cmp eax, 0x103
je 0x100e12e
push eax
push 0x10063f8
jmp 0x100e120
lea eax, [ebp - 0x1714]
push eax
lea eax, [ebp - 0x1754]
push eax
lea eax, [ebp - 0x170c]
push eax
push ebx
push 0x10067e8
push dword [ebp - 0x1708]
mov dword [ebp - 0x1714], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100df8c
cmp dword [ebp - 0x170c], 4
jne 0x100e030
cmp dword [ebp - 0x1754], 1
jne 0x100df8c
xor eax, eax
mov word [ebp - 0x25c], bx
mov ecx, 0x81
lea edi, [ebp - 0x25a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x1004b2c
mov dword [ebp - 0x1750], eax
mov dword [ebp - 0x174c], 0x10067c0
mov dword [ebp - 0x1748], ebx
lea edi, [ebp - 0x1750]
lea ecx, [ebp - 0x1714]
push ecx
lea ecx, [ebp - 0x25c]
push ecx
lea ecx, [ebp - 0x170c]
push ecx
push ebx
push eax
push dword [ebp - 0x1708]
mov dword [ebp - 0x1714], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100e0a3
cmp dword [ebp - 0x170c], 1
je 0x100e0ac
add edi, 4
mov eax, dword [edi]
cmp eax, ebx
jne 0x100e069
cmp word [ebp - 0x25c], bx
jne 0x100e0bd
lea ecx, [ebp - 0x1708]
jmp 0x100e105
push 0xa
pop eax
mov dword [ebp - 0x17b8], eax
mov dword [ebp - 0x1784], eax
lea eax, [ebp - 0x1728]
push eax
lea eax, [ebp - 0x17c0]
push eax
lea eax, [ebp - 0x1724]
push eax
lea eax, [ebp - 0x178c]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.0100a629
add esp, 0x14
test al, al
lea ecx, [ebp - 0x1708]
je 0x100e52c
call fcn.01008676
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x100df97
cmp eax, 2
je 0x100e12e
push eax
push 0x1006370
call fcn.0100f591
pop ecx
pop ecx
mov byte [0x1018a20], 1
lea ecx, [ebp - 0x1700]
call fcn.01008658
push eax
push 0x20019
push ebx
push 0x1004a18
push 0x80000002
call fcn.01008692
add esp, 0x14
cmp eax, ebx
jne 0x100e377
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1710]
push eax
lea eax, [ebp - 0xc88]
push eax
mov dword [ebp - 0x172c], ebx
push ebx
jmp 0x100e347
mov eax, dword [ebp - 0x1700]
lea ecx, [ebp - 0x1704]
mov dword [ebp - 0x1704], ebx
mov dword [ebp - 0x1738], eax
call fcn.01008658
push eax
push 0x20019
push ebx
lea eax, [ebp - 0xc88]
push eax
push dword [ebp - 0x1738]
call fcn.01008692
add esp, 0x14
cmp eax, ebx
je 0x100e1e1
push eax
lea eax, [ebp - 0xc88]
push eax
push 0x10062d0
call fcn.0100f591
add esp, 0xc
lea ecx, [ebp - 0x1704]
mov byte [0x1018a20], 1
call fcn.01008676
jmp 0x100e329
xor eax, eax
mov edx, 0x81
mov word [ebp - 0x25c], bx
mov ecx, edx
lea edi, [ebp - 0x25a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0xa80], bx
mov ecx, edx
lea edi, [ebp - 0xa7e]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1714]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x170c]
push eax
push ebx
lea eax, [ebp - 0x1718]
push eax
lea eax, [ebp - 0xa80]
push eax
push ebx
push dword [ebp - 0x1704]
mov dword [ebp - 0x171c], ebx
mov dword [ebp - 0x1714], 0x208
mov dword [ebp - 0x1718], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebx
jne 0x100e2f5
push 0xa
pop edi
inc dword [ebp - 0x171c]
lea eax, [ebp - 0x1728]
push eax
lea eax, [ebp - 0x17c0]
push eax
lea eax, [ebp - 0x1724]
push eax
lea eax, [ebp - 0x178c]
push eax
lea eax, [ebp - 0x25c]
push eax
mov dword [ebp - 0x17b8], edi
mov dword [ebp - 0x1784], edi
call fcn.0100a629
add esp, 0x14
test al, al
je 0x100e36c
lea eax, [ebp - 0x1714]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x170c]
push eax
push ebx
lea eax, [ebp - 0x1718]
push eax
lea eax, [ebp - 0xa80]
push eax
push dword [ebp - 0x171c]
mov dword [ebp - 0x1718], esi
push dword [ebp - 0x1704]
mov dword [ebp - 0x1714], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebx
je 0x100e262
cmp eax, 0x103
je 0x100e318
push eax
lea eax, [ebp - 0xc88]
push eax
push 0x1006228
call fcn.0100f591
add esp, 0xc
mov byte [0x1018a20], 1
lea ecx, [ebp - 0x1704]
call fcn.01008676
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x172c]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1710]
push eax
lea eax, [ebp - 0xc88]
push eax
push dword [ebp - 0x172c]
push dword [ebp - 0x1700]
mov dword [ebp - 0x1710], esi
call edi
cmp eax, ebx
je 0x100e178
cmp eax, 0x103
je 0x100e390
push eax
push 0x1006170
jmp 0x100e382
lea ecx, [ebp - 0x1704]
jmp 0x100e52c
cmp eax, 2
je 0x100e390
push eax
push 0x10060c8
call fcn.0100f591
pop ecx
pop ecx
mov byte [0x1018a20], 1
lea ecx, [ebp - 0x1700]
call fcn.01008658
push eax
push 0x20019
push ebx
push 0x1004cb0
push 0x80000002
call fcn.01008692
add esp, 0x14
cmp eax, ebx
jne 0x100e53d
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 0x13
pop ecx
xor eax, eax
push ebx
mov word [ebp - 0x54], bx
lea edi, [ebp - 0x52]
rep stosd dword es:[edi], eax
push ebx
push ebx
stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x1714]
push eax
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x1718], ebx
push ebx
jmp 0x100e4fd
mov edi, dword [ebp - 0x1700]
lea ecx, [ebp - 0x16fc]
mov dword [ebp - 0x16fc], ebx
call fcn.01008658
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x54]
push eax
push edi
call fcn.01008692
add esp, 0x14
cmp eax, ebx
je 0x100e43a
push eax
lea eax, [ebp - 0x54]
push eax
push 0x1006030
call fcn.0100f591
add esp, 0xc
mov byte [0x1018a20], 1
jmp 0x100e4d7
xor eax, eax
mov word [ebp - 0x25c], bx
mov ecx, 0x81
lea edi, [ebp - 0x25a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1738]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x170c]
push eax
push ebx
push 0x1004b2c
push dword [ebp - 0x16fc]
mov dword [ebp - 0x1738], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100e4d7
cmp dword [ebp - 0x170c], 1
jne 0x100e4d7
cmp word [ebp - 0x25c], bx
je 0x100e4d7
push 0xa
pop eax
mov dword [ebp - 0x17b8], eax
mov dword [ebp - 0x1784], eax
lea eax, [ebp - 0x1728]
push eax
lea eax, [ebp - 0x17c0]
push eax
lea eax, [ebp - 0x1724]
push eax
lea eax, [ebp - 0x178c]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.0100a629
add esp, 0x14
test al, al
je 0x100e526
lea ecx, [ebp - 0x16fc]
call fcn.01008676
inc dword [ebp - 0x1718]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1714]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x1718]
push dword [ebp - 0x1700]
mov dword [ebp - 0x1714], 0x28
call esi
cmp eax, ebx
je 0x100e3ed
cmp eax, 0x103
je 0x100e556
push eax
push 0x1005f90
jmp 0x100e548
lea ecx, [ebp - 0x16fc]
mov byte [0x1018a20], 1
call fcn.01008676
jmp 0x100e97f
cmp eax, 2
je 0x100e556
push eax
push 0x1005ef8
call fcn.0100f591
pop ecx
pop ecx
mov byte [0x1018a20], 1
cmp word [ebp - 0xe90], bx
mov esi, 0x1004584
je 0x100e5f4
push 0xa
pop edi
push 1
lea eax, [ebp - 0x173c]
push eax
lea eax, [ebp - 0x17f8]
push eax
lea eax, [ebp - 0xe90]
push eax
mov dword [ebp - 0x17f0], edi
call fcn.0100a5a6
add esp, 0x10
test al, al
je 0x100e8b5
lea eax, [ebp - 0xe90]
push eax
lea eax, [ebp - 0x670]
push eax
call fcn.0100f6e7
lea eax, [ebp - 0x670]
push 0x5c
push eax
call fcn.0100f67b
add esp, 0x10
cmp eax, ebx
je 0x100e5f4
push esi
push eax
call fcn.0100f6e7
push 1
lea eax, [ebp - 0x173c]
push eax
lea eax, [ebp - 0x17f8]
push eax
lea eax, [ebp - 0x670]
push eax
mov dword [ebp - 0x17f0], edi
call fcn.0100a5a6
add esp, 0x18
test al, al
je 0x100e8b5
push 0x209
lea eax, [ebp - 0x670]
push eax
push 0x1004590
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x100e64d
lea eax, [ebp - 0x670]
push esi
push eax
call fcn.0100f6b4
push 1
lea eax, [ebp - 0x173c]
push eax
lea eax, [ebp - 0x17f8]
push eax
lea eax, [ebp - 0x670]
push eax
mov dword [ebp - 0x17f0], 0xa
call fcn.0100a5a6
add esp, 0x18
test al, al
je 0x100e8b5
lea eax, [ebp - 0x1740]
push eax
mov word [ebp - 0x670], bx
mov dword [ebp - 0x1740], ebx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x100e6fc
lea eax, [ebp - 0x1758]
push eax
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x100e6ea
lea eax, [ebp - 0x670]
push eax
push dword [ebp - 0x1758]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x100e6d8
lea eax, [ebp - 0x670]
push eax
call fcn.0100f572
cmp word [ebp + eax*2 - 0x672], 0x5c
pop ecx
je 0x100e6c5
lea eax, [ebp - 0x670]
push 0x1003e4c
push eax
call fcn.0100f6b4
pop ecx
pop ecx
lea eax, [ebp - 0x670]
push 0x100455c
push eax
call fcn.0100f6b4
pop ecx
pop ecx
mov eax, dword [ebp - 0x1740]
push dword [ebp - 0x1758]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x1740]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 0x1740], ebx
cmp word [ebp - 0x670], bx
je 0x100e736
push 1
lea eax, [ebp - 0x173c]
push eax
lea eax, [ebp - 0x17f8]
push eax
lea eax, [ebp - 0x670]
push eax
mov dword [ebp - 0x17f0], 0xa
call fcn.0100a5a6
add esp, 0x10
test al, al
je 0x100e8b5
cmp dword [ebp - 0x1724], ebx
je 0x100e7bd
xor edi, edi
cmp dword [ebp - 0x1724], ebx
jbe 0x100e7bd
mov eax, dword [ebp - 0x178c]
push 0x5c
push dword [eax + edi*4]
call fcn.0100f67b
cmp eax, ebx
pop ecx
pop ecx
je 0x100e7b4
mov ecx, dword [ebp - 0x178c]
mov ecx, dword [ecx + edi*4]
sub eax, ecx
sar eax, 1
mov esi, eax
push esi
push ecx
lea eax, [ebp - 0x670]
push eax
call fcn.0100f8ec
push 1
lea eax, [ebp - 0x173c]
push eax
lea eax, [ebp - 0x17f8]
push eax
lea eax, [ebp - 0x670]
push eax
mov word [ebp + esi*2 - 0x670], bx
mov dword [ebp - 0x17f0], 0xa
call fcn.0100a5a6
add esp, 0x1c
test al, al
je 0x100e8b5
inc edi
cmp edi, dword [ebp - 0x1724]
jb 0x100e748
cmp dword [ebp - 0x173c], ebx
mov dword [ebp - 0x1704], ebx
jbe 0x100e97f
cmp dword [ebp - 0x1728], ebx
mov dword [ebp - 0x16fc], ebx
jbe 0x100e967
mov eax, dword [ebp - 0x17f8]
mov ecx, dword [ebp - 0x1704]
push dword [eax + ecx*4]
lea eax, [ebp - 0x670]
push eax
call fcn.0100f6e7
lea eax, [ebp - 0x670]
push eax
call fcn.0100f572
add esp, 0xc
cmp word [ebp + eax*2 - 0x670], 0x5c
je 0x100e829
lea eax, [ebp - 0x670]
push 0x1003e4c
push eax
call fcn.0100f6b4
pop ecx
pop ecx
lea eax, [ebp - 0x670]
push 0x1005ef4
push eax
call fcn.0100f6b4
lea eax, [ebp - 0x670]
push 0x2a
push eax
call fcn.0100f67b
mov ecx, dword [ebp - 0x16fc]
mov edi, eax
mov eax, dword [ebp - 0x17c0]
push dword [eax + ecx*4]
lea eax, [ebp - 0x670]
push eax
call fcn.0100f6b4
add esp, 0x18
lea eax, [ebp - 0x16f8]
push eax
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100e8c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x100e94f
cmp eax, 3
je 0x100e94f
push eax
lea eax, [ebp - 0x670]
push eax
push 0x1005e78
call fcn.0100f591
add esp, 0xc
jmp 0x100e94f
mov byte [0x1018a20], 1
jmp 0x100e97f
test byte [ebp - 0x16f8], 0x10
jne 0x100e916
lea eax, [ebp - 0x16cc]
push eax
push edi
call fcn.0100f6e7
push ebx
lea eax, [ebp - 0x178c]
push eax
lea eax, [ebp - 0x670]
push eax
mov dword [ebp - 0x1784], 0xa
call fcn.0100a553
add esp, 0x14
test al, al
jne 0x100e916
lea eax, [ebp - 0x670]
push ebx
push eax
call fcn.0100a93f
test al, al
pop ecx
pop ecx
jne 0x100e916
mov byte [0x1018a20], 1
lea eax, [ebp - 0x16f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, ebx
jne 0x100e8c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x100e948
push eax
lea eax, [ebp - 0x670]
push eax
push 0x1005df0
call fcn.0100f591
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
inc dword [ebp - 0x16fc]
mov eax, dword [ebp - 0x16fc]
cmp eax, dword [ebp - 0x1728]
jb 0x100e7e1
inc dword [ebp - 0x1704]
mov eax, dword [ebp - 0x1704]
cmp eax, dword [ebp - 0x173c]
jb 0x100e7cf
xor esi, esi
cmp dword [ebp - 0x17bc], ebx
jle 0x100e9a6
mov eax, dword [ebp - 0x17c0]
mov eax, dword [eax + esi*4]
cmp eax, ebx
je 0x100e99d
push eax
call fcn.0100f876
pop ecx
inc esi
cmp esi, dword [ebp - 0x17bc]
jl 0x100e989
xor esi, esi
cmp dword [ebp - 0x1788], ebx
jle 0x100e9cd
mov eax, dword [ebp - 0x178c]
mov eax, dword [eax + esi*4]
cmp eax, ebx
je 0x100e9c4
push eax
call fcn.0100f876
pop ecx
inc esi
cmp esi, dword [ebp - 0x1788]
jl 0x100e9b0
xor esi, esi
cmp dword [ebp - 0x17f4], ebx
jle 0x100e9f4
mov eax, dword [ebp - 0x17f8]
mov eax, dword [eax + esi*4]
cmp eax, ebx
je 0x100e9eb
push eax
call fcn.0100f876
pop ecx
inc esi
cmp esi, dword [ebp - 0x17f4]
jl 0x100e9d7
cmp byte [0x1018a20], bl
lea ecx, [ebp - 0x1700]
sete bl
call fcn.01008676
cmp dword [ebp - 0x17bc], 0xa
jle 0x100ea1d
push dword [ebp - 0x17c0]
call fcn.0100f5fc
pop ecx
cmp dword [ebp - 0x1788], 0xa
jle 0x100ea32
push dword [ebp - 0x178c]
call fcn.0100f5fc
pop ecx
cmp dword [ebp - 0x17f4], 0xa
jle 0x100ea47
push dword [ebp - 0x17f8]
call fcn.0100f5fc
pop ecx
mov al, bl
pop edi
pop esi
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0100f0dc
leave
ret