Function at 0x10092e3
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes
Get installed programs
Persist via app paths registry key
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x13c8
call fcn.0100d3f0
mov eax, dword [0x101203c]
push esi
push edi
push 1
push 0x1001cb0
mov dword [ebp - 4], eax
call fcn.0100cbb8
xor eax, eax
push 0x41
pop ecx
lea edi, [ebp - 0x414]
rep stosd dword es:[edi], eax
mov eax, dword [0x1016c8c]
dec eax
dec eax
jne 0x100a21c
push ebx
xor ebx, ebx
cmp dword [0x1016ca0], ebx
je 0x100a20f
cmp dword [0x1016ca4], ebx
je 0x100a20f
lea eax, [ebp - 0x1058]
push eax
push 0x20019
push ebx
push 0x1005494
mov esi, 0x80000002
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100a21b
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x105c]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x1005460
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100a201
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x1068]
push eax
push ebx
push 0x10054e0
push dword [ebp - 0x1058]
mov edi, 0x104
mov dword [ebp - 0x1048], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a1f5
cmp dword [ebp - 0x1068], 2
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
jne 0x100940f
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x720]
push eax
call esi
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 4
jmp 0x1009418
mov eax, dword [ebp - 0x1048]
add eax, 0xfffffffb
mov dword [ebp - 0x1054], eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100a1f5
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x1068]
push eax
push ebx
push 0x10053c0
push dword [ebp - 0x1058]
mov dword [ebp - 0x1048], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a1f5
cmp dword [ebp - 0x1068], 2
jne 0x1009498
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push eax
call esi
push edi
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x61c]
push eax
call esi
cmp byte [ebp - 0x61c], bl
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1050], ebx
je 0x100a1f5
mov eax, dword [ebp - 0x104c]
cmp byte [eax], 0x5c
jne 0x10094df
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x1050], eax
push dword [ebp - 0x104c]
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], bl
mov dword [ebp - 0x104c], eax
jne 0x10094c7
cmp dword [ebp - 0x1050], ebx
je 0x100a1f5
mov ecx, 0x1001ca4
mov dword [ebp - 0x110c], ecx
mov dword [ebp - 0x10cc], ecx
mov ecx, 0x10166cc
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x10b8], ecx
mov dword [ebp - 0x10b0], ecx
lea ecx, [ebp - 0x310]
lea eax, [ebp - 0xb30]
mov dword [ebp - 0x1138], eax
mov dword [ebp - 0x13c4], ecx
mov dword [ebp - 0x13bc], ecx
lea eax, [ebp - 0x20c]
mov ecx, edx
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x1128], eax
lea eax, [ebp - 0x310]
mov dword [ebp - 0x13b4], ecx
mov dword [ebp - 0x13ac], ecx
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x1120], eax
mov dword [ebp - 0x1118], eax
mov dword [ebp - 0x1110], eax
mov dword [ebp - 0x1108], eax
mov eax, 0x10165c8
mov dword [ebp - 0x13a4], ecx
mov dword [ebp - 0x139c], ecx
mov dword [ebp - 0x137c], ecx
mov ecx, edx
mov byte [ebp - 0x310], bl
mov byte [ebp - 0xb30], bl
mov byte [ebp - 0x20c], bl
mov byte [ebp - 0x108], bl
mov byte [ebp - 0x518], bl
mov dword [ebp - 0x113c], 0x1001c98
mov dword [ebp - 0x1134], 0x1001c90
mov dword [ebp - 0x112c], 0x1001c88
mov dword [ebp - 0x1124], 0x10014a8
mov dword [ebp - 0x111c], 0x1001c7c
mov dword [ebp - 0x1114], 0x1001c70
mov dword [ebp - 0x1104], 0x1001c60
mov dword [ebp - 0x1100], eax
mov dword [ebp - 0x10fc], 0x1001c54
mov dword [ebp - 0x10f8], eax
mov dword [ebp - 0x10f4], 0x1001c44
mov dword [ebp - 0x10f0], edx
mov dword [ebp - 0x10ec], 0x1001c38
mov dword [ebp - 0x10e8], edx
mov dword [ebp - 0x10e4], 0x1001c2c
mov dword [ebp - 0x10e0], edx
mov dword [ebp - 0x10dc], 0x1001c24
mov dword [ebp - 0x10d8], edx
mov dword [ebp - 0x10d4], 0x1001c98
mov dword [ebp - 0x10d0], eax
mov dword [ebp - 0x10c8], eax
mov dword [ebp - 0x10c4], 0x1001c70
mov dword [ebp - 0x10c0], eax
mov dword [ebp - 0x10bc], 0x10014a8
mov dword [ebp - 0x10b4], 0x1001c7c
mov dword [ebp - 0x13c8], 0x1001c18
mov dword [ebp - 0x13c0], 0x1001c0c
mov dword [ebp - 0x13b8], 0x1001c00
mov dword [ebp - 0x13b0], 0x1001bf4
mov dword [ebp - 0x13a8], 0x1001be8
mov dword [ebp - 0x13a0], 0x1001bd8
mov dword [ebp - 0x1398], 0x1001bc8
mov dword [ebp - 0x1394], eax
mov dword [ebp - 0x1390], 0x1001bbc
mov dword [ebp - 0x138c], eax
mov dword [ebp - 0x1388], 0x1001bac
mov dword [ebp - 0x1384], eax
mov dword [ebp - 0x1380], 0x1001ba0
mov dword [ebp - 0x1378], 0x1001b90
mov dword [ebp - 0x1374], ecx
mov dword [ebp - 0x1370], 0x1001b84
mov dword [ebp - 0x136c], ecx
mov dword [ebp - 0x1368], 0x1001b78
mov dword [ebp - 0x1364], ecx
mov dword [ebp - 0x1360], 0x1001b6c
mov dword [ebp - 0x135c], ecx
mov dword [ebp - 0x1358], 0x1001b60
mov dword [ebp - 0x131c], eax
lea eax, [ebp - 0x518]
mov dword [ebp - 0x1354], ecx
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x1314], eax
mov dword [ebp - 0x130c], eax
mov dword [ebp - 0x1304], eax
mov dword [ebp - 0x12fc], eax
mov dword [ebp - 0x12f4], eax
mov dword [ebp - 0x12ec], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x1350], 0x1001b54
mov dword [ebp - 0x134c], ecx
mov dword [ebp - 0x1348], 0x1001b48
mov dword [ebp - 0x1344], ecx
mov dword [ebp - 0x1340], 0x1001b3c
mov dword [ebp - 0x133c], ecx
mov dword [ebp - 0x1338], 0x1001b2c
mov dword [ebp - 0x1334], ecx
mov dword [ebp - 0x1330], 0x1001b1c
mov dword [ebp - 0x132c], ecx
mov dword [ebp - 0x1328], 0x1001b10
mov dword [ebp - 0x1324], 0x10169d8
mov dword [ebp - 0x1320], 0x1001b04
mov dword [ebp - 0x1318], 0x1001af8
mov dword [ebp - 0x1310], 0x1001ae8
mov dword [ebp - 0x1308], 0x1001adc
mov dword [ebp - 0x1300], 0x1001acc
mov dword [ebp - 0x12f8], 0x1001abc
mov dword [ebp - 0x12f0], 0x1001aac
mov dword [ebp - 0x12e8], 0x1001a9c
mov dword [ebp - 0x12e4], eax
mov dword [ebp - 0x12e0], 0x1001a7c
mov dword [ebp - 0x12dc], eax
mov dword [ebp - 0x12d8], 0x1001a68
mov dword [ebp - 0x12d4], eax
mov dword [ebp - 0x12d0], 0x1001a50
mov dword [ebp - 0x12cc], eax
mov dword [ebp - 0x12c8], 0x1001a40
mov dword [ebp - 0x12c4], eax
mov dword [ebp - 0x12c0], 0x1001a34
mov dword [ebp - 0x12bc], eax
mov dword [ebp - 0x12b8], 0x1001a20
mov dword [ebp - 0x12b4], eax
mov dword [ebp - 0x12b0], 0x1001a14
mov dword [ebp - 0x12ac], eax
mov dword [ebp - 0x12a8], 0x10019fc
mov dword [ebp - 0x12a4], eax
mov dword [ebp - 0x12a0], 0x10019ec
mov dword [ebp - 0x129c], eax
mov dword [ebp - 0x1298], 0x10019dc
mov dword [ebp - 0x1294], eax
mov dword [ebp - 0x1290], 0x10019d4
mov dword [ebp - 0x128c], eax
mov dword [ebp - 0x1288], 0x10019bc
mov dword [ebp - 0x1284], eax
mov dword [ebp - 0x1280], 0x10019a8
mov dword [ebp - 0x127c], eax
mov dword [ebp - 0x1278], 0x100199c
mov dword [ebp - 0x1274], eax
mov dword [ebp - 0x1270], 0x1001984
mov dword [ebp - 0x126c], eax
mov dword [ebp - 0x1268], 0x1001964
mov dword [ebp - 0x1264], eax
mov dword [ebp - 0x1260], 0x1001950
mov dword [ebp - 0x125c], eax
mov dword [ebp - 0x1258], 0x1001944
mov dword [ebp - 0x1254], eax
mov dword [ebp - 0x1250], 0x1001928
mov dword [ebp - 0x124c], eax
mov dword [ebp - 0x1248], 0x100191c
mov dword [ebp - 0x1244], eax
mov dword [ebp - 0x1240], 0x1001910
mov dword [ebp - 0x123c], eax
mov dword [ebp - 0x1238], 0x1001904
mov dword [ebp - 0x1234], eax
mov dword [ebp - 0x1230], 0x10018f0
mov dword [ebp - 0x122c], eax
mov dword [ebp - 0x1228], 0x10018e0
mov dword [ebp - 0x1224], eax
mov dword [ebp - 0x1220], 0x10018d0
mov ecx, 0x1001894
mov dword [ebp - 0x121c], eax
mov dword [ebp - 0x1214], eax
mov dword [ebp - 0x120c], eax
mov dword [ebp - 0x1204], eax
mov dword [ebp - 0x11fc], eax
mov dword [ebp - 0x11f4], eax
mov dword [ebp - 0x11ec], eax
mov dword [ebp - 0x11e4], eax
mov dword [ebp - 0x11dc], eax
mov eax, 0x100550c
mov dword [ebp - 0x10a8], ecx
mov dword [ebp - 0x109c], ecx
mov ecx, 0x1001854
mov dword [ebp - 0x10ac], eax
mov dword [ebp - 0x10a0], eax
mov edx, 0x10022c4
mov dword [ebp - 0x1094], eax
mov dword [ebp - 0x1090], ecx
mov dword [ebp - 0x1088], eax
mov dword [ebp - 0x1084], ecx
mov ecx, 0x1001810
mov dword [ebp - 0x107c], eax
mov dword [ebp - 0x11d8], eax
mov dword [ebp - 0x11cc], eax
mov dword [ebp - 0x11c0], eax
mov dword [ebp - 0x11b4], eax
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x119c], eax
mov dword [ebp - 0x1190], eax
mov dword [ebp - 0x1184], eax
mov dword [ebp - 0x1178], eax
mov dword [ebp - 0x116c], eax
mov dword [ebp - 0x1160], eax
mov dword [ebp - 0x1154], eax
mov dword [ebp - 0x1148], eax
lea eax, [ebp - 0x518]
sub eax, dword [ebp - 0x1050]
mov dword [ebp - 0x1098], edx
mov dword [ebp - 0x1080], edx
mov edx, 0x10017c8
mov dword [ebp - 0x11c8], ecx
mov dword [ebp - 0x11bc], ecx
mov dword [ebp - 0x11b0], ecx
mov dword [ebp - 0x11a4], ecx
mov ecx, 0x10017a0
mov dword [ebp - 0x1218], 0x1001790
mov dword [ebp - 0x1210], 0x1001784
mov dword [ebp - 0x1208], 0x1001770
mov dword [ebp - 0x1200], 0x1001768
mov dword [ebp - 0x11f8], 0x1001744
mov dword [ebp - 0x11f0], 0x1001734
mov dword [ebp - 0x11e8], 0x1001728
mov dword [ebp - 0x11e0], 0x100171c
mov dword [ebp - 0x10a4], 0x1002574
mov dword [ebp - 0x108c], 0x1002574
mov dword [ebp - 0x1078], edx
mov dword [ebp - 0x1074], ebx
mov dword [ebp - 0x11d4], 0x10016c8
mov dword [ebp - 0x11d0], 0x10016b8
mov dword [ebp - 0x11c4], 0x10016ac
mov dword [ebp - 0x11b8], 0x100169c
mov dword [ebp - 0x11ac], 0x1001684
mov dword [ebp - 0x11a0], 0x1005528
mov dword [ebp - 0x1198], ecx
mov dword [ebp - 0x1194], 0x1001678
mov dword [ebp - 0x118c], 0x100164c
mov dword [ebp - 0x1188], 0x1001644
mov dword [ebp - 0x1180], ecx
mov dword [ebp - 0x117c], 0x100163c
mov dword [ebp - 0x1174], 0x1001614
mov dword [ebp - 0x1170], ebx
mov dword [ebp - 0x1168], 0x10015ec
mov dword [ebp - 0x1164], ebx
mov dword [ebp - 0x115c], 0x10015bc
mov dword [ebp - 0x1158], ebx
mov dword [ebp - 0x1150], 0x100158c
mov dword [ebp - 0x114c], ebx
mov dword [ebp - 0x1144], edx
mov dword [ebp - 0x1140], ebx
push eax
push 0x100578c
push dword [ebp - 0x1050]
call esi
push ebx
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
push dword [ebp - 0x105c]
push dword [ebp - 0x1058]
call fcn.010068ff
cmp dword [0x1016bf8], 1
jne 0x1009d4d
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
push ebx
push 0x10054cc
push dword [ebp - 0x1058]
mov dword [ebp - 0x1048], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1009d4d
cmp byte [ebp - 0x414], bl
lea eax, [ebp - 0x414]
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1050], ebx
je 0x1009d4d
mov eax, dword [ebp - 0x104c]
cmp byte [eax], 0x5c
jne 0x1009cbd
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x1050], eax
push dword [ebp - 0x104c]
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], bl
mov dword [ebp - 0x104c], eax
jne 0x1009ca5
cmp dword [ebp - 0x1050], ebx
je 0x1009d4d
push dword [ebp - 0x1050]
lea eax, [ebp - 0x61c]
push eax
push 0x1002474
lea eax, [ebp - 0x928]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push edi
lea eax, [ebp - 0x928]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x928]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x928]
push eax
push 1
push ebx
push 0x10054cc
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push edi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x824]
push eax
call esi
push edi
push 0x10057a8
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatBuffA]
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x104c], edi
sub dword [ebp - 0x104c], eax
push dword [ebp - 0x104c]
lea eax, [ebp + eax - 0x824]
push 0x10058f0
push eax
mov dword [ebp - 0x1070], eax
call esi
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov dword [ebp - 0x1048], eax
lea eax, [ebp - 0x61c]
push eax
push 1
push ebx
push 0x10053c0
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov dword [ebp - 0x1048], eax
lea eax, [ebp - 0x824]
push eax
push 1
push ebx
push 0x10054e0
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0xb30]
push eax
lea eax, [ebp - 0x310]
push eax
push 0xf
call fcn.01008fef
cmp dword [0x1016bf8], 1
mov dword [ebp - 0x1050], eax
jne 0x1009e92
test al, 1
je 0x1009e4a
push edi
lea eax, [ebp - 0x310]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test byte [ebp - 0x1050], 2
je 0x1009e62
push edi
lea eax, [ebp - 0xb30]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test byte [ebp - 0x1050], 4
je 0x1009e7a
push edi
lea eax, [ebp - 0x518]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test byte [ebp - 0x1050], 8
je 0x1009e92
push edi
lea eax, [ebp - 0x108]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push edi
push 0x10166cc
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, edi
sub ecx, eax
push ecx
mov dword [ebp - 0x1048], eax
lea eax, [ebp + eax - 0x20c]
push eax
push 0x40a
push dword [0x1016cac]
call dword [sym.imp.USER32.dll_LoadStringA]
cmp dword [0x1016bf8], 1
jne 0x1009eea
push edi
lea eax, [ebp - 0x20c]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 1
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [ebp - 0x1054]
mov ecx, edi
sub ecx, eax
push ecx
push 0x10058e0
lea eax, [ebp + eax - 0x720]
push eax
call esi
push dword [ebp - 0x104c]
push 0x10058e0
push dword [ebp - 0x1070]
call esi
push 1
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
xor esi, esi
cmp esi, 0x12
mov dword [ebp - 0x1048], ebx
jae 0x1009fad
mov dword [ebp - 0x104c], ebx
cmp dword [ebp - 0x104c], 5
jge 0x1009fad
push dword [ebp + esi*8 - 0x113c]
mov eax, dword [ebp - 0x1048]
push dword [ebp + esi*8 - 0x1138]
inc dword [ebp - 0x1048]
mov ecx, 0x514
sub ecx, dword [ebp - 0x1048]
push 0x100594c
lea eax, [ebp + eax - 0x1044]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add dword [ebp - 0x1048], eax
add esp, 0x14
inc esi
inc dword [ebp - 0x104c]
cmp esi, 0x12
jb 0x1009f56
mov eax, dword [ebp - 0x1048]
push 2
mov byte [ebp + eax - 0x1044], bl
push 0x1005798
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x1044]
push eax
call dword [0x1016ca0]
cmp esi, 0x12
jb 0x1009f45
xor esi, esi
cmp esi, 0x3e
mov dword [ebp - 0x1048], ebx
jae 0x100a048
mov dword [ebp - 0x104c], ebx
cmp dword [ebp - 0x104c], 5
jge 0x100a048
push dword [ebp + esi*8 - 0x13c8]
mov eax, dword [ebp - 0x1048]
push dword [ebp + esi*8 - 0x13c4]
inc dword [ebp - 0x1048]
mov ecx, 0x514
sub ecx, dword [ebp - 0x1048]
push 0x100594c
lea eax, [ebp + eax - 0x1044]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add dword [ebp - 0x1048], eax
add esp, 0x14
inc esi
inc dword [ebp - 0x104c]
cmp esi, 0x3e
jb 0x1009ff1
mov eax, dword [ebp - 0x1048]
push 2
mov byte [ebp + eax - 0x1044], bl
push 0x100578c
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x1044]
push eax
call dword [0x1016ca0]
cmp esi, 0x3e
jb 0x1009fe0
cmp dword [0x1016bf8], 1
mov dword [ebp - 0x1064], ebx
mov dword [ebp - 0x1060], ebx
je 0x100a0ca
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x1064]
push eax
push 0x2001f
push ebx
push 0x100551c
push dword [ebp - 0x1058]
call esi
lea eax, [ebp - 0x1060]
push eax
push 0x2001f
push ebx
push 0x100551c
push dword [ebp - 0x105c]
call esi
jmp 0x100a0e2
mov eax, dword [ebp - 0x1058]
mov dword [ebp - 0x1064], eax
mov eax, dword [ebp - 0x105c]
mov dword [ebp - 0x1060], eax
cmp dword [ebp - 0x1064], ebx
je 0x100a135
lea esi, [ebp - 0x10a8]
mov dword [ebp - 0x1054], 5
push 0x1009
push dword [esi + 4]
push dword [esi]
push dword [esi - 4]
push dword [ebp - 0x1064]
push ebx
push ebx
call dword [0x1016ca4]
add esi, 0xc
dec dword [ebp - 0x1054]
jne 0x100a0fa
cmp dword [0x1016bf8], 1
je 0x100a135
push dword [ebp - 0x1064]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1060], ebx
je 0x100a188
lea esi, [ebp - 0x11d4]
mov dword [ebp - 0x1054], 0xd
push 0x1009
push dword [esi + 4]
push dword [esi]
push dword [esi - 4]
push dword [ebp - 0x1060]
push ebx
push ebx
call dword [0x1016ca4]
add esi, 0xc
dec dword [ebp - 0x1054]
jne 0x100a14d
cmp dword [0x1016bf8], 1
je 0x100a188
push dword [ebp - 0x1060]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x106c]
push eax
push ebx
call fcn.0100c66d
cmp dword [ebp - 0x106c], 1
je 0x100a1a7
cmp dword [ebp - 0x106c], 2
jne 0x100a1f5
push dword [0x1016be4]
mov esi, 0x10169d8
push esi
push 0x100594c
lea eax, [ebp - 0x414]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
cmp dword [ebp - 0x106c], 2
mov eax, 0x100583c
je 0x100a1dc
mov eax, 0x1005858
push ebx
push 0xd
push ebx
push 0x10167d0
push esi
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [0x1016c94]
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x1058]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100a21b
push 1
push 0x1001540
call fcn.0100cbb8
pop ebx
push 1
push 0x1001520
call fcn.0100cbb8
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0100d038
leave
ret