Function at 0x100126a0
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x2b8
mov eax, dword [0x10023050]
xor eax, esp
mov dword [esp + 0x2b4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0xb5]
mov edi, ecx
push 0
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], 0x208
mov byte [esp + 0xbc], 0
call sub.MSVCR90.dll_memset
push 0x104
lea ecx, [esp + 0x1c9]
push 0
push ecx
mov byte [esp + 0x1d0], 0
call sub.MSVCR90.dll_memset
add esp, 0x18
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x100127c2
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push ebp
push str.SHGetFolderPathA
push esi
call ebx
push str.SHGetSpecialFolderPathA
push esi
mov ebp, eax
call ebx
mov edi, eax
test ebp, ebp
jne 0x10012768
test edi, edi
jne 0x10012764
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.SHFolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x10012764
push str.SHGetFolderPathA
push esi
call ebx
push str.SHGetSpecialFolderPathA
push esi
mov ebp, eax
call ebx
mov edi, eax
test ebp, ebp
je 0x1001278e
lea edx, [esp + 0xb4]
push edx
push 0
push 0
push 0x19
push 0
call ebp
lea eax, [esp + 0x1bc]
push eax
push 0
push 0
push 0x10
push 0
call ebp
jmp 0x100127b2
test edi, edi
je 0x100127b2
push 0
push 0x19
lea ecx, [esp + 0xbc]
push ecx
push 0
call edi
push 0
push 0x10
lea edx, [esp + 0x1c4]
push edx
push 0
call edi
pop ebp
test esi, esi
je 0x100127be
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x2c], 2
jne 0x10012822
cmp byte [esp + 0xb0], 0
je 0x100127ff
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0xb4]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x100128e4
mov ebx, dword [esp + 0xc]
mov eax, edi
call fcn.10012a60
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x2b4]
xor ecx, esp
call fcn.100192c6
add esp, 0x2b8
ret
cmp byte [esp + 0x1b8], 0
je 0x10012845
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x1bc]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x100128e4
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100128c2
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push edi
lea ecx, [esp + 0x20]
push ecx
push 0
push 0x1001eb78
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100128c2
cmp byte [edi], 0
je 0x100128c2
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2b4]
xor ecx, esp
call fcn.100192c6
add esp, 0x2b8
ret
mov ecx, dword [esp + 0xc]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [esp + 0xc]
cmp ecx, 0x7fffffff
ja 0x100128e4
push str.Desktop
call fcn.10003520
mov ecx, dword [esp + 0x2c0]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.100192c6
add esp, 0x2b8
ret