Function at 0x100729b
Capabilities:
Get common file path
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4ac
mov eax, dword [0x1035030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
xor eax, eax
push 0x4c
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x52]
push esi
push eax
mov dword [ebp - 0x47c], 0x80004005
mov dword [ebp - 0x484], esi
mov dword [ebp - 0x488], esi
mov dword [ebp - 0x480], esi
call sub.msvcrt.dll_memset
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp - 0x25c], ax
lea eax, [ebp - 0x25a]
push esi
push eax
mov dword [ebp - 0x494], esi
mov dword [ebp - 0x490], esi
call sub.msvcrt.dll_memset
xor eax, eax
mov dword [ebp - 0x474], esi
lea edi, [ebp - 0x470]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
push ebx
mov word [ebp - 0x464], ax
lea eax, [ebp - 0x462]
push esi
push eax
mov dword [ebp - 0x49c], esi
mov dword [ebp - 0x498], esi
mov dword [ebp - 0x4a0], esi
mov dword [ebp - 0x4a4], esi
mov dword [ebp - 0x4ac], esi
mov dword [ebp - 0x4a8], esi
call sub.msvcrt.dll_memset
push 0xa84
call fcn.01011bcc
mov ebx, eax
add esp, 0x28
cmp ebx, esi
jne 0x10073a2
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007393
test byte [eax + 0x1c], 1
je 0x1007393
push 0xa84
push 0x1002040
push 0x38
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
mov dword [ebp - 0x47c], 0x8007000e
jmp 0x1007b4a
mov edi, 0xa84
push edi
push esi
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push 0x10025c8
push esi
push esi
mov dword [ebx], edi
mov dword [ebx + 0x2c], 0x20000
mov dword [ebx + 0x6c], 0x282
call dword [sym.imp.ADVAPI32.dll_QueryTraceW]
test eax, eax
jne 0x1007405
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007b4a
test byte [eax + 0x1c], 4
je 0x1007b4a
push 0x1002040
push 0x39
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004e8e
jmp 0x1007b4a
push edi
push esi
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x484]
push eax
push 0x20019
push esi
push 0x1002380
push 0x80000002
mov dword [ebx], edi
mov dword [ebx + 0x2c], 0x20000
mov dword [ebx + 0x6c], 0x282
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
je 0x100747a
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007b34
test byte [eax + 0x1c], 1
je 0x1007b34
push edi
push 0x1002380
push 0x1002040
push 0x3a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004f4d
jmp 0x1007b34
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x480]
push eax
lea eax, [ebx + 0x30]
push eax
push esi
push esi
push 0x10025b0
push dword [ebp - 0x484]
mov dword [ebp - 0x480], 4
call edi
mov dword [ebp - 0x478], eax
cmp eax, esi
je 0x10074db
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007b2e
test byte [eax + 0x1c], 1
je 0x1007b2e
mov edi, dword [ebp - 0x478]
push edi
push 0x1002040
push 0x3b
jmp 0x1007b21
lea eax, [ebp - 0x480]
push eax
lea eax, [ebx + 0x34]
push eax
push esi
push esi
push 0x1002590
push dword [ebp - 0x484]
mov dword [ebp - 0x480], 4
call edi
mov dword [ebp - 0x478], eax
cmp eax, esi
je 0x1007536
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007b2e
test byte [eax + 0x1c], 1
je 0x1007b2e
mov edi, dword [ebp - 0x478]
push edi
push 0x1002040
push 0x3c
jmp 0x1007b21
lea eax, [ebp - 0x480]
push eax
lea eax, [ebx + 0x38]
push eax
push esi
push esi
push 0x1002570
push dword [ebp - 0x484]
mov dword [ebp - 0x480], 4
call edi
mov dword [ebp - 0x478], eax
cmp eax, esi
je 0x1007591
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007b2e
test byte [eax + 0x1c], 1
je 0x1007b2e
mov edi, dword [ebp - 0x478]
push edi
push 0x1002040
push 0x3d
jmp 0x1007b21
lea eax, [ebp - 0x480]
push eax
lea eax, [ebx + 0x3c]
push eax
push esi
push esi
push 0x1002558
push dword [ebp - 0x484]
mov dword [ebp - 0x480], 4
call edi
mov dword [ebp - 0x478], eax
cmp eax, esi
je 0x10075ec
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007b2e
test byte [eax + 0x1c], 1
je 0x1007b2e
mov edi, dword [ebp - 0x478]
push edi
push 0x1002040
push 0x3e
jmp 0x1007b21
lea ecx, [ebp - 0x480]
push ecx
lea eax, [ebx + 0x40]
push eax
push esi
push esi
push 0x1002540
push dword [ebp - 0x484]
mov dword [ebp - 0x480], 4
call edi
test eax, eax
je 0x1007617
mov dword [ebx + 0x40], esi
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push 0x1002534
push dword [ebp - 0x484]
mov dword [ebp - 0x480], 0x4e
call edi
mov dword [ebp - 0x478], eax
cmp eax, esi
jne 0x1007b01
lea eax, [ebx + 0x18]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.0101294a
cmp eax, esi
mov dword [ebp - 0x47c], eax
jge 0x100768c
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007b4a
test byte [eax + 0x1c], 1
je 0x1007b4a
push dword [ebp - 0x47c]
push 0x1002040
push 0x3f
jmp 0x1007739
mov eax, dword [ebx + 0x6c]
add eax, ebx
mov dword [ebp - 0x48c], eax
lea eax, [ebp - 0x464]
push eax
push 0x1002518
push esi
push esi
push 0x8025
push esi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirW]
cmp eax, esi
mov dword [ebp - 0x47c], eax
jge 0x10076e4
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007b4a
test byte [eax + 0x1c], 1
je 0x1007b4a
push dword [ebp - 0x47c]
push 0x1002040
push 0x41
jmp 0x1007739
push 0x10025c8
lea eax, [ebp - 0x464]
push eax
push 0x1002504
push 0x105
push dword [ebp - 0x48c]
call fcn.01006a35
add esp, 0x14
cmp eax, esi
mov dword [ebp - 0x47c], eax
jge 0x1007749
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007b4a
test byte [eax + 0x1c], 1
je 0x1007b4a
push dword [ebp - 0x47c]
push 0x1002040
push 0x42
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
jmp 0x1007b4a
push ebx
push 0x10025c8
lea eax, [ebp - 0x494]
push eax
call dword [sym.imp.ADVAPI32.dll_StartTraceW]
mov dword [ebp - 0x478], eax
cmp eax, esi
je 0x10077aa
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007793
test byte [eax + 0x1c], 1
je 0x1007793
mov edi, dword [ebp - 0x478]
push edi
push 0x1002040
push 0x43
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
jmp 0x1007799
mov edi, dword [ebp - 0x478]
mov dword [ebp - 0x494], esi
mov dword [ebp - 0x490], esi
jmp 0x1007b34
mov dword [ebp - 0x48c], esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x49c]
push eax
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x48c]
mov dword [ebp - 0x49c], 0x104
push dword [ebp - 0x484]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1007b4a
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.0101294a
mov dword [ebp - 0x478], eax
cmp eax, esi
je 0x1007836
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007ad3
test byte [eax + 0x1c], 1
je 0x1007ad3
push dword [ebp - 0x478]
lea ecx, [ebp - 0x25c]
push ecx
push 0x1002040
push 0x44
jmp 0x1007a33
lea eax, [ebp - 0x488]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x484]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x478], eax
cmp eax, esi
je 0x1007893
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007ad3
test byte [eax + 0x1c], 1
je 0x1007ad3
push dword [ebp - 0x478]
lea ecx, [ebp - 0x25c]
push ecx
push 0x1002040
push 0x45
jmp 0x1007a33
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x498]
push eax
push esi
push esi
push 0x1002370
push dword [ebp - 0x488]
mov dword [ebp - 0x480], 4
call edi
mov dword [ebp - 0x478], eax
cmp eax, esi
je 0x1007932
mov dword [ebp - 0x498], 1
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x4a0]
push eax
push esi
push esi
push 0x10024ec
push dword [ebp - 0x488]
mov dword [ebp - 0x480], 4
call edi
mov dword [ebp - 0x478], eax
cmp eax, esi
je 0x1007973
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007ad3
test byte [eax + 0x1c], 1
je 0x1007ad3
push dword [ebp - 0x478]
lea ecx, [ebp - 0x25c]
push ecx
push 0x1002040
push 0x47
jmp 0x1007a33
cmp dword [ebp - 0x498], 1
je 0x10078ce
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007ad3
test byte [eax + 0x1c], 4
je 0x1007ad3
lea ecx, [ebp - 0x25c]
push ecx
push 0x1002040
push 0x46
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004ee0
jmp 0x1007ad3
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x4ac]
push eax
push esi
push esi
push 0x10024cc
push dword [ebp - 0x488]
mov dword [ebp - 0x480], 8
call edi
mov dword [ebp - 0x478], eax
cmp eax, esi
je 0x10079d4
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007ad3
test byte [eax + 0x1c], 1
je 0x1007ad3
push dword [ebp - 0x478]
lea ecx, [ebp - 0x25c]
push ecx
push 0x1002040
push 0x48
jmp 0x1007a33
lea eax, [ebp - 0x480]
push eax
lea eax, [ebp - 0x4a4]
push eax
push esi
push esi
push 0x10024ac
push dword [ebp - 0x488]
mov dword [ebp - 0x480], 4
call edi
mov dword [ebp - 0x478], eax
cmp eax, esi
je 0x1007a43
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007ad3
test byte [eax + 0x1c], 1
je 0x1007ad3
push dword [ebp - 0x478]
lea ecx, [ebp - 0x25c]
push ecx
push 0x1002040
push 0x49
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004f4d
jmp 0x1007ad3
push esi
push dword [ebp - 0x4a4]
lea eax, [ebp - 0x474]
push esi
push esi
push dword [ebp - 0x4a8]
push dword [ebp - 0x4ac]
push dword [ebp - 0x4a0]
push dword [ebp - 0x498]
push dword [ebp - 0x490]
push dword [ebp - 0x494]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_EnableTraceEx]
mov dword [ebp - 0x478], eax
cmp eax, esi
je 0x1007ab9
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007ab9
test byte [eax + 0x1c], 1
je 0x1007ab9
push dword [ebp - 0x478]
lea ecx, [ebp - 0x25c]
push ecx
push 0x1002040
push 0x4a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004f4d
mov eax, dword [ebp - 0x478]
cmp eax, esi
jle 0x1007acd
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x47c], eax
cmp dword [ebp - 0x488], esi
je 0x1007aed
push dword [ebp - 0x488]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x488], esi
inc dword [ebp - 0x48c]
cmp dword [ebp - 0x478], esi
je 0x10077b0
jmp 0x1007b4a
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x1007b2e
test byte [eax + 0x1c], 1
je 0x1007b2e
mov edi, dword [ebp - 0x478]
push edi
push 0x1002040
push 0x40
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
jmp 0x1007b34
mov edi, dword [ebp - 0x478]
cmp edi, esi
jle 0x1007b44
and edi, 0xffff
or edi, 0x80070000
mov dword [ebp - 0x47c], edi
cmp dword [ebp - 0x484], esi
je 0x1007b64
push dword [ebp - 0x484]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x484], esi
cmp dword [ebp - 0x47c], esi
jge 0x1007bdd
mov eax, dword [ebp - 0x494]
or eax, dword [ebp - 0x490]
je 0x1007bdd
mov edi, 0xa84
push edi
push esi
push ebx
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push 0x10025c8
mov dword [ebx], edi
mov dword [ebx + 0x2c], 0x20000
mov dword [ebx + 0x6c], 0x282
push dword [ebp - 0x490]
push dword [ebp - 0x494]
call dword [sym.imp.ADVAPI32.dll_StopTraceW]
cmp eax, esi
je 0x1007bdd
mov ecx, dword [0x1035014]
cmp ecx, 0x1035014
je 0x1007bdd
test byte [ecx + 0x1c], 1
je 0x1007bdd
push eax
push 0x1002040
push 0x4b
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01004eb4
cmp ebx, esi
je 0x1007be8
push ebx
call fcn.01011bdc
pop ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x47c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01011f27
leave
ret