Function at 0x1002415
Capabilities:
Get common file path
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x1004008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
cmp dword [ebp + 8], 2
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x428], 0x104
jne 0x1002510
mov ebx, dword [sym.imp.msvcrt.dll__stricmp]
push 0x1001964
push dword [edi + 4]
call ebx
pop ecx
pop ecx
test eax, eax
jne 0x10024fc
lea eax, [ebp - 0x418]
push eax
push 0x2001f
push esi
push 0x1001948
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10024e7
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
pop ebx
push ebx
lea eax, [ebp - 0x424]
push eax
push ebx
push esi
push 0x1001934
push dword [ebp - 0x418]
mov dword [ebp - 0x424], esi
call edi
push ebx
lea eax, [ebp - 0x424]
push eax
push ebx
push esi
push 0x1001908
push dword [ebp - 0x418]
call edi
push esi
push esi
push 1
push esi
push 0x10018f8
push dword [ebp - 0x418]
call edi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002827
push 0x10018d0
push esi
push 2
call fcn.01001ab3
add esp, 0xc
jmp 0x1002827
push 0x10018cc
push dword [edi + 4]
call ebx
pop ecx
pop ecx
test eax, eax
je 0x1002827
push 0x10018b8
push 3
push 2
call fcn.01001ab3
mov ebx, 0x208
push ebx
lea eax, [ebp - 0x20c]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x100188c
lea eax, [ebp - 0x448]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x448]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x440]
push eax
mov edi, 0x100002
push edi
lea eax, [ebp - 0x41c]
push eax
mov dword [ebp - 0x440], 0x18
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x434], esi
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x42c], esi
call dword [sym.imp.ntdll.dll_NtOpenEvent]
cmp eax, esi
jge 0x10025e1
cmp eax, 0xc0000034
jne 0x10025d3
push esi
push esi
lea eax, [ebp - 0x440]
push eax
push edi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.ntdll.dll_NtCreateEvent]
cmp eax, 0x40000000
je 0x10025be
cmp eax, 0xc0000035
jne 0x10025d3
lea eax, [ebp - 0x440]
push eax
push edi
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.ntdll.dll_NtOpenEvent]
cmp eax, esi
jge 0x10025e1
push 0x1001880
jmp 0x10024ec
push 0x493e0
push dword [ebp - 0x41c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x41c]
mov edi, eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp edi, esi
je 0x100260e
push 0x1001868
jmp 0x10024ec
push 0x1001850
push 3
push 2
call fcn.01001ab3
add esp, 0xc
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.01001cbc
cmp eax, esi
je 0x1002646
push eax
push 0x100181c
call fcn.01001ab3
add esp, 8
jmp 0x1002829
call fcn.01001dde
cmp eax, esi
jne 0x1002829
call fcn.01001c77
xor edi, edi
inc edi
cmp eax, esi
jne 0x1002666
call fcn.010022a1
jmp 0x1002673
cmp eax, edi
jne 0x10026d7
call fcn.01002f65
test eax, eax
jne 0x10026d7
push ebx
lea eax, [ebp - 0x414]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1001808
push ebx
lea eax, [ebp - 0x414]
push eax
call fcn.01001e8e
push esi
push 0x1001804
push 0x10017e8
push esi
lea eax, [ebp - 0x414]
push eax
push esi
call sub.NETAPI32.dll_NetJoinDomain
cmp eax, esi
jne 0x10026c6
push 0x10017cc
push 3
push 2
call fcn.01001ab3
add esp, 0xc
jmp 0x10026d7
push eax
push 0x10017a8
push esi
push 2
call fcn.01001ab3
add esp, 0x10
call fcn.01001c77
test eax, eax
jne 0x10026e5
call fcn.01001f26
push 0x100178c
push 3
push 2
call fcn.01001ab3
add esp, 0xc
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.USERENV.dll_GetDefaultUserProfileDirectoryW]
cmp eax, edi
jne 0x1002810
push 0x1001774
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01001ec9
push edi
push 0x1001750
call fcn.01001ab9
push edi
push 0x1001728
call fcn.01001ab9
lea eax, [ebp - 0x20c]
push eax
mov edi, 0x100171c
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
cmp eax, esi
jne 0x10027f6
lea eax, [ebp - 0x418]
push eax
mov ebx, 0xf003f
push ebx
push esi
push edi
push 0x80000002
mov dword [ebp - 0x420], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x10027d7
cmp dword [ebp - 0x418], esi
je 0x10027d7
push esi
lea eax, [ebp - 0x420]
push eax
push esi
push ebx
push esi
push esi
push esi
push 0x1001704
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x420], esi
je 0x10027bc
push dword [ebp - 0x420]
call ebx
jmp 0x10027cd
push esi
push 0x10016e0
push esi
push 2
call fcn.01001ab3
add esp, 0x10
push dword [ebp - 0x418]
call ebx
jmp 0x10027e8
push eax
push 0x10016bc
push esi
push 2
call fcn.01001ab3
add esp, 0x10
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
jmp 0x1002827
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x1001698
push esi
push 2
call fcn.01001ab3
add esp, 0x14
jmp 0x1002827
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1001660
push esi
push 2
call fcn.01001ab3
add esp, 0x10
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002ae0
leave
ret