Function at 0x101b0ee
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
push 0x1003bc0
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], ebx
call fcn.01018dd9
mov esi, eax
cmp esi, ebx
jge 0x101b151
mov eax, dword [0x102e010]
cmp eax, 0x102e010
je 0x101b14a
test dword [eax + 0x9c], 0x800
je 0x101b14a
cmp byte [eax + 0x99], 2
jb 0x101b14a
push esi
push 0x1001b34
push 0x27
push dword [eax + 0x94]
push dword [eax + 0x90]
call fcn.010164b8
mov eax, esi
jmp 0x101b3a7
mov ecx, dword [ebp - 0x14]
push edi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], 0x1003bb0
mov dword [ebp - 0x20], ebx
call fcn.0101ab3e
mov edi, eax
cmp edi, ebx
mov esi, 0x80000000
jl 0x101b1ec
cmp dword [0x102e46c], ebx
je 0x101b1ec
mov al, byte [0x102e470]
cmp byte [0x102e435], bl
je 0x101b19b
cmp al, 4
jae 0x101b1c9
cmp al, bl
jmp 0x101b1c7
cmp al, 4
jae 0x101b1a3
cmp al, bl
jne 0x101b1ec
mov ecx, dword [0x102e45c]
and ecx, esi
xor eax, eax
or eax, ecx
je 0x101b1ec
mov ecx, dword [0x102e464]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x102e460]
jne 0x101b1ec
cmp eax, ecx
jne 0x101b1ec
push dword [ebp - 4]
push 0x102e5b4
push 0x10012b4
push 0x1001328
push dword [0x102e444]
push dword [0x102e440]
call fcn.0101809a
cmp edi, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], bl
jl 0x101b2b3
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
call fcn.0101a45d
cmp eax, ebx
jle 0x101b22a
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 8], eax
jl 0x101b2b0
push dword [ebp - 0x18]
mov ecx, dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 0x20]
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.0101f8c4
cmp eax, ebx
mov dword [ebp - 8], eax
jge 0x101b2b0
push dword [ebp - 0xc]
call fcn.0102afb2
pop ecx
mov ecx, dword [ebp - 0x10]
cmp ecx, ebx
je 0x101b276
push 3
call fcn.0101996e
push dword [ebp - 4]
call fcn.0102afb2
pop ecx
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x101b2b0
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
sete al
movzx eax, al
push eax
push 0x100280c
push ebx
push ebx
push ebx
push 0x1003ae0
push dword [0x102e5ac]
push 4
call fcn.0102c428
mov edi, dword [ebp - 8]
push 0x1003bc0
call fcn.0102b35d
cmp edi, ebx
jl 0x101b335
cmp dword [0x102e46c], ebx
je 0x101b3a4
mov al, byte [0x102e470]
cmp byte [0x102e435], bl
je 0x101b2e2
cmp al, 4
jae 0x101b320
cmp al, bl
jmp 0x101b31a
cmp al, 4
jae 0x101b2ee
cmp al, bl
jne 0x101b3a4
mov ecx, dword [0x102e45c]
and ecx, esi
xor eax, eax
or eax, ecx
je 0x101b3a4
mov ecx, dword [0x102e464]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x102e460]
jne 0x101b3a4
cmp eax, ecx
jne 0x101b3a4
push edi
push dword [ebp - 4]
push 0x102e5b4
push 0x10012b4
push 0x1001378
jmp 0x101b393
cmp dword [0x102e46c], ebx
je 0x101b3a4
mov al, byte [0x102e470]
cmp byte [0x102e435], bl
je 0x101b352
cmp al, 2
jae 0x101b380
cmp al, bl
jmp 0x101b37e
cmp al, 2
jae 0x101b35a
cmp al, bl
jne 0x101b3a4
mov ecx, dword [0x102e45c]
and ecx, esi
xor eax, eax
or eax, ecx
je 0x101b3a4
mov ecx, dword [0x102e464]
mov eax, ecx
xor edx, edx
and eax, esi
cmp edx, dword [0x102e460]
jne 0x101b3a4
cmp eax, ecx
jne 0x101b3a4
push edi
push dword [ebp - 4]
push 0x102e5b4
push 0x10012b4
push 0x1001388
push dword [0x102e444]
push dword [0x102e440]
call fcn.01018160
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x14