Function at 0x10608c7
Capabilities:
Check if file exists
Check os version
Create directory
Get common file path
Get disk size
Get file attributes
Link many functions at runtime
Persist via run registry key
Query or enumerate registry value
Read .ini file
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2360
call fcn.010720e0
mov eax, dword [0x1080bec]
push ebx
push esi
push 6
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov eax, dword [ebp + 0xc]
mov dword [0x1085d38], eax
lea eax, [ebp - 0x2338]
xor ebx, ebx
push eax
mov dword [ebp - 0x2338], ebx
call fcn.01060745
test eax, eax
jne 0x1060910
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
jmp 0x1060916
mov eax, dword [ebp - 0x2338]
movzx eax, ax
sub eax, 0x404
mov ecx, 0x400
je 0x1060968
sub eax, 0xd
je 0x106095c
dec eax
je 0x1060950
sub eax, 0x3f2
je 0x1060944
sub eax, ecx
je 0x1060968
sub eax, ecx
je 0x1060944
mov dword [0x1085d08], ebx
jmp 0x1060972
mov dword [0x1085d08], 0x86
jmp 0x1060972
mov dword [0x1085d08], 0x81
jmp 0x1060972
mov dword [0x1085d08], 0x80
jmp 0x1060972
mov dword [0x1085d08], 0x88
mov dword [0x1085d24], ebx
mov dword [0x1085d20], ebx
mov dword [0x1085d04], ebx
mov dword [0x1085d90], ebx
mov dword [0x1085d98], ebx
mov dword [0x1085d9c], 1
call sub.NMSUPP.dll_BhGetLastError
push 0x104
mov esi, 0x1085af0
push esi
push dword [0x1085d0c]
mov dword [0x1085d88], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1061559
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcsrchr]
cmp eax, ebx
pop ecx
pop ecx
je 0x10609d5
mov word [eax], bx
push edi
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
push esi
mov esi, 0x10858e8
push esi
call edi
push 0x102aa00
push esi
call dword [sym.imp.msvcrt.dll_wcscat]
push 0x102a9dc
push 0x10856e0
call edi
add esp, 0x18
lea eax, [ebp - 0x234c]
push eax
push 1
push ebx
push 0x1004610
push Ordinal_4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov esi, 0x1084a88
jne 0x1060aba
lea eax, [ebp - 0x2338]
push eax
push esi
lea eax, [ebp - 0x233c]
push eax
push ebx
push 0x10045f8
push dword [ebp - 0x234c]
mov dword [ebp - 0x2338], 0x208
mov word [0x1084c90], bx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x2344], eax
mov eax, dword [ebp - 0x2338]
shr eax, 1
push esi
mov word [eax*2 + 0x1084a88], bx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp - 0x2344], ebx
jne 0x1060a90
cmp dword [ebp - 0x233c], 1
jne 0x1060a90
cmp eax, 0xffffffff
je 0x1060a90
test al, 0x10
jne 0x1060aa7
push esi
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x1060aa7
mov word [0x1084a88], bx
push dword [ebp - 0x234c]
mov word [0x1084c8e], bx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
mov esi, 0x10852c8
push esi
push 0x102a5b0
push 0x1003cb4
push 0x10020e0
call fcn.010508c1
test eax, eax
je 0x1060ae9
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1060b58
push 0x1084a88
call dword [sym.imp.msvcrt.dll_wcslen]
test eax, eax
pop ecx
je 0x1060b00
push 0x1084a88
jmp 0x1060b05
push 0x1085af0
push esi
call edi
pop ecx
pop ecx
push 0x14b0
call fcn.0106bcca
cmp eax, ebx
je 0x1060b50
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
push eax
call edi
push esi
mov dword [ebp - 0x2344], eax
call edi
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2344]
add ecx, eax
cmp ecx, 0x103
jae 0x1060b50
push 0x14b0
call fcn.0106bcca
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor eax, eax
mov word [ebp - 0x620], bx
mov ecx, 0x82
lea edi, [ebp - 0x61e]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x620]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1060b98
lea eax, [ebp - 0x620]
push eax
push 0x1084a88
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
push esi
push 0x10850b8
call edi
push esi
push 0x1084ea8
call edi
push esi
push 0x1084c98
call edi
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x1085af0
mov esi, 0x10854d8
push esi
call edi
push 0x102a9c4
push esi
call dword [sym.imp.msvcrt.dll_wcscat]
push 0x1005b08
push 0x10833f0
call edi
add esp, 0x18
call sub.NMAPI.dll_EnumProtocols
test eax, eax
jne 0x1060c09
push 0x1487
call fcn.0106bcca
push eax
push ebx
call fcn.0106bdb1
xor eax, eax
jmp 0x1061558
push 0x1085af0
push 0x14b2
call fcn.0106bcca
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
push 0x80
push 0x1083430
lea eax, [ebp - 0x414]
push eax
push 0x1489
call fcn.0106bcca
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push eax
push 0x102a738
call edi
call sub.NMAPI.dll_CreateAddressDatabase
cmp eax, ebx
mov dword [0x1085d50], eax
je 0x1060c02
push 0x1083430
push eax
call fcn.0104e583
mov dword [0x10845a0], 6
call sub.NMAPI.dll_CreateAddressDatabase
push dword [0x1085d50]
mov dword [0x1085d54], eax
push eax
call fcn.0105fb0c
push dword [0x1085d50]
push dword [0x1085d54]
call fcn.0106035d
push esi
push 0x200
lea eax, [ebp - 0xa20]
push eax
push ebx
push ebx
push 0x1005c30
call edi
test eax, eax
je 0x1060dc4
cmp word [ebp - 0xa20], bx
lea eax, [ebp - 0xa20]
jmp 0x1060db8
push esi
push 0x200
lea eax, [ebp - 0x414]
push eax
push ebx
push dword [ebp - 0x233c]
push 0x1005c30
call edi
test eax, eax
je 0x1060d9e
push 0x184
call sub.NMSUPP.dll_AllocMemory
mov edi, eax
cmp edi, ebx
je 0x1060c02
movzx eax, word [0x1085d5c]
inc word [0x1085d5c]
mov dword [eax*4 + 0x10837a0], edi
lea eax, [ebp - 0x414]
push 0x10032a0
push eax
call dword [sym.imp.msvcrt.dll_wcstok]
cmp eax, ebx
pop ecx
pop ecx
je 0x1060d3b
push eax
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push 0x10032a0
push ebx
call dword [sym.imp.msvcrt.dll_wcstok]
cmp eax, ebx
pop ecx
pop ecx
je 0x1060d5a
push eax
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
mov word [edi + 0x140], bx
jmp 0x1060d7f
push eax
call fcn.0106bfa0
movzx ecx, word [edi + 0x140]
mov word [edi + ecx*2 + 0x142], ax
inc word [edi + 0x140]
push 0x102a9b8
push ebx
call dword [sym.imp.msvcrt.dll_wcstok]
cmp eax, ebx
pop ecx
pop ecx
jne 0x1060d63
and byte [edi + 0x182], 0xfe
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [ebp - 0x233c]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x233c]
lea eax, [ecx + eax*2 + 2]
cmp word [eax], bx
mov dword [ebp - 0x233c], eax
jne 0x1060ccd
push esi
push 0x200
lea eax, [ebp - 0xa20]
push eax
push ebx
push ebx
push 0x1005c60
call edi
test eax, eax
je 0x1060eeb
cmp word [ebp - 0xa20], bx
lea eax, [ebp - 0xa20]
jmp 0x1060edf
push esi
push 0x200
lea eax, [ebp - 0x414]
push eax
push ebx
push dword [ebp - 0x233c]
push 0x1005c60
call edi
test eax, eax
je 0x1060ec5
push 0x184
call sub.NMSUPP.dll_AllocMemory
mov edi, eax
cmp edi, ebx
je 0x1060c02
movzx eax, word [0x1085d5c]
inc word [0x1085d5c]
mov dword [eax*4 + 0x10837a0], edi
lea eax, [ebp - 0x414]
push 0x10032a0
push eax
call dword [sym.imp.msvcrt.dll_wcstok]
cmp eax, ebx
pop ecx
pop ecx
je 0x1060e62
push eax
push edi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push 0x10032a0
push ebx
call dword [sym.imp.msvcrt.dll_wcstok]
cmp eax, ebx
pop ecx
pop ecx
je 0x1060e81
push eax
lea eax, [edi + 0x40]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
mov word [edi + 0x140], bx
jmp 0x1060ea6
push eax
call fcn.0106bfa0
movzx ecx, word [edi + 0x140]
mov word [edi + ecx*2 + 0x142], ax
inc word [edi + 0x140]
push 0x102a9b8
push ebx
call dword [sym.imp.msvcrt.dll_wcstok]
cmp eax, ebx
pop ecx
pop ecx
jne 0x1060e8a
or byte [edi + 0x182], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [ebp - 0x233c]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x233c]
lea eax, [ecx + eax*2 + 2]
cmp word [eax], bx
mov dword [ebp - 0x233c], eax
jne 0x1060df4
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x1085af0
push 0x102a988
push 0x1084878
mov dword [0x1085d30], ebx
call edi
push 0x1085af0
push 0x102a958
push 0x1084668
call edi
xor eax, eax
inc eax
add esp, 0x18
push 0x400
mov dword [0x1085d74], eax
mov dword [0x1085d78], eax
mov dword [0x1085d7c], eax
mov dword [0x1085d80], eax
mov dword [0x1085d4c], eax
lea eax, [ebp - 0x2220]
push eax
push 0x102a5c8
push 0x1652
mov dword [0x1085d40], ebx
mov word [0x10845b8], bx
mov dword [0x1084638], ebx
mov dword [0x108463c], ebx
mov dword [0x1084640], ebx
mov dword [0x1084644], ebx
mov dword [0x1085d3c], ebx
mov dword [0x1085d44], ebx
mov dword [0x1085d48], ebx
mov dword [0x1085d8c], ebx
mov byte [0x1084648], bl
call fcn.0106bcca
push eax
push 0x10020e0
call fcn.010508c1
test eax, eax
je 0x1061054
lea eax, [ebp - 0x2220]
push eax
mov dword [ebp - 0x2338], 0x400
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
push 0x41
mov dword [0x1085d4c], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x414]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x414]
push eax
call fcn.0106071f
xor edi, edi
inc edi
cmp eax, edi
jne 0x1061040
lea eax, [ebp - 0x414]
push 0x1004468
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x2348]
push eax
lea eax, [ebp - 0x2340]
push eax
lea eax, [ebp - 0x2360]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1061040
mov ecx, dword [ebp - 0x2360]
mov eax, dword [ebp - 0x235c]
shrd ecx, eax, 0x14
shr eax, 0x14
mov eax, 0x400
cmp ecx, eax
jbe 0x1061046
mov ecx, eax
jmp 0x1061046
mov ecx, dword [ebp - 0x2338]
cmp dword [0x1085d4c], ecx
jbe 0x1061054
mov dword [0x1085d4c], edi
push 0x10020e0
call fcn.0105f2d1
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [0x1085d34], eax
lea eax, [ebp - 0x2334]
push eax
mov dword [ebp - 0x2334], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x1061092
push ebx
push ebx
push ebx
jmp 0x10610a4
push dword [ebp - 0x2328]
push dword [ebp - 0x232c]
push dword [ebp - 0x2330]
push 0x148c
call fcn.0106bcca
push eax
mov edi, 0x10815c8
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0x102a94c
push 0x102a940
push edi
push 0x1492
call fcn.0106bcca
push eax
push 0x1081888
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push esi
push ebx
push 0x102a92c
push 0x102a914
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0xb2ec
push 8
mov dword [ebp - 0x233c], eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [0x10808ac]
mov dword [ecx + 4], eax
mov eax, dword [0x10808ac]
cmp dword [eax + 4], ebx
je 0x1060c02
mov ecx, 0xb01
mov word [eax], cx
xor eax, eax
mov edx, dword [0x10808ac]
mov edx, dword [edx + 4]
mov esi, dword [eax + 0x10784a0]
mov dword [eax + edx], esi
mov edx, dword [0x10808ac]
mov edx, dword [edx + 4]
mov esi, dword [eax + 0x10784a4]
mov dword [edx + eax + 4], esi
mov edx, dword [0x10808ac]
mov esi, dword [eax + 0x10784a8]
mov edx, dword [edx + 4]
mov dword [edx + eax + 8], esi
add eax, 0xc
dec ecx
jne 0x106112f
cmp dword [ebp - 0x233c], ebx
je 0x1061394
mov esi, 0x102a904
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, 0x3e8
cmp dword [ebp - 0x233c], eax
movsd dword es:[edi], dword [esi]
jbe 0x1061198
mov dword [ebp - 0x233c], eax
cmp dword [ebp - 0x233c], ebx
mov dword [ebp - 0x2338], ebx
jbe 0x106136e
mov edi, dword [sym.imp.msvcrt.dll_wcschr]
push 0xa
lea eax, [ebp - 0xe]
push eax
push dword [ebp - 0x2338]
call dword [sym.imp.msvcrt.dll__itow]
add esp, 0xc
push 0x10854d8
push 0x400
lea eax, [ebp - 0x1a20]
push eax
push 0x1002088
lea eax, [ebp - 0x14]
push eax
push 0x102a914
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x106134e
lea eax, [ebp - 0x1220]
push eax
lea eax, [ebp - 0x2344]
push eax
lea eax, [ebp - 0x1a20]
push 0x102a8f4
push eax
mov dword [ebp - 0x2344], ebx
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x10
cmp eax, 2
jl 0x106134e
lea eax, [ebp - 0x1220]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
cmp eax, ebx
pop ecx
je 0x1061247
lea ecx, [ebp + eax*2 - 0x1222]
cmp word [ecx], 0x2c
jne 0x1061247
mov word [ecx], bx
dec eax
cmp eax, 6
jb 0x1061256
push 6
pop eax
mov word [ebp - 0x1214], bx
mov ecx, dword [ebp - 0x2344]
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 0x2358], ecx
call sub.NMSUPP.dll_AllocMemory
cmp eax, ebx
mov dword [ebp - 0x2354], eax
je 0x1060c02
lea ecx, [ebp - 0x1220]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x1a20]
push 0x2c
push eax
mov dword [ebp - 0x2350], ebx
call edi
add esp, 0x10
cmp eax, ebx
je 0x10612df
inc eax
inc eax
je 0x10612df
push 0x2c
push eax
call edi
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x10612df
inc esi
inc esi
je 0x10612df
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
call sub.NMSUPP.dll_AllocMemory
cmp eax, ebx
mov dword [ebp - 0x2350], eax
je 0x1060c02
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
mov eax, dword [0x10808ac]
movzx ecx, word [eax]
push 0x106ccb3
mov dword [ebp - 0x235c], ecx
push 0xc
lea ecx, [ebp - 0x235c]
push ecx
push dword [eax + 4]
lea eax, [ebp - 0x2358]
push eax
call dword [sym.imp.msvcrt.dll__lfind]
add esp, 0x14
cmp eax, ebx
jne 0x1061334
mov ecx, dword [0x10808ac]
xor edx, edx
mov dx, word [ecx]
cmp dx, 0xee9
jae 0x1061354
mov esi, dword [ecx + 4]
movzx eax, dx
lea eax, [eax + eax*2]
inc edx
lea eax, [esi + eax*4]
mov word [ecx], dx
mov ecx, dword [ebp - 0x2358]
mov dword [eax], ecx
mov ecx, dword [ebp - 0x2354]
mov dword [eax + 4], ecx
mov ecx, dword [ebp - 0x2350]
mov dword [eax + 8], ecx
mov ecx, dword [0x10808ac]
inc dword [ebp - 0x2338]
mov eax, dword [ebp - 0x2338]
cmp eax, dword [ebp - 0x233c]
jb 0x10611b0
jmp 0x1061374
mov ecx, dword [0x10808ac]
mov ax, word [ecx]
cmp ax, 0xb01
je 0x1061394
push 0x106ccb3
movzx eax, ax
push 0xc
push eax
push dword [ecx + 4]
call dword [sym.imp.msvcrt.dll_qsort]
add esp, 0x10
cmp word [0x1085d58], bx
mov dword [ebp - 0x2338], ebx
jbe 0x106141f
mov esi, dword [sym.imp.msvcrt.dll_wcschr]
mov dword [ebp - 0x2344], 0x10852c8
movzx eax, word [ebp - 0x2338]
mov edi, dword [eax*4 + 0x1083fa0]
push 0x5c
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x10613e4
inc dword [ebp - 0x2338]
mov ax, word [ebp - 0x2338]
cmp ax, word [0x1085d58]
jb 0x10613b3
jmp 0x106141f
push 0x3a
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x10613f9
mov dword [ebp - 0x2344], 0x10852cc
push 0x5c
push edi
call dword [sym.imp.msvcrt.dll_wcsrchr]
mov esi, eax
sub esi, edi
sar esi, 1
inc esi
push esi
push edi
mov edi, dword [ebp - 0x2344]
push edi
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0x14
mov word [edi + esi*2], bx
push 0x366
push 0x102a8c4
push 0x102a8a0
lea eax, [ebp - 0x614]
push 0x1001f40
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [0x1083710], ebx
xor eax, eax
mov edi, 0x1083714
stosd dword es:[edi], eax
add esp, 0x14
push 0x805a
stosw word es:[edi], ax
call fcn.0106bcca
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
push eax
push 0x1083726
call edi
pop ecx
pop ecx
mov esi, 0x1083610
push 0x805b
mov dword [0x1083766], ebx
mov dword [0x108376a], esi
call fcn.0106bcca
push eax
push esi
call edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop ecx
pop ecx
push 0x102a88c
mov dword [0x1081a88], ebx
mov dword [0x1081ae4], ebx
mov dword [0x1082c18], ebx
call edi
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2338], eax
je 0x10614e8
push 0x102a874
push eax
call esi
push 0x102a85c
push dword [ebp - 0x2338]
mov dword [0x1085da4], eax
call esi
push dword [ebp - 0x2338]
mov dword [0x1085da8], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [0x1085da4], ebx
je 0x10614f8
cmp dword [0x1085da8], ebx
jne 0x1061534
push 0x102a848
call edi
cmp eax, ebx
mov dword [ebp - 0x2338], eax
je 0x1061534
push 0x102a82c
push eax
call esi
push 0x102a810
push dword [ebp - 0x2338]
mov dword [0x1085da4], eax
call esi
push dword [ebp - 0x2338]
mov dword [0x1085da8], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x1001edc
call edi
mov edi, eax
cmp edi, ebx
je 0x1061555
push 0x102a7f4
push edi
call esi
push edi
mov dword [0x1085dac], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
inc eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01070ac3
leave
ret 8