Function at 0x101001a
Capabilities:
Get common file path
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x102a0ec]
push esi
xor esi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x410], esi
call fcn.01019582
fcomp qword [0x10026d0]
mov dword [ebp - 0x414], 1
fnstsw ax
test ah, 1
je 0x1010058
mov dword [ebp - 0x414], esi
push 0x100
lea eax, [ebp - 0x40c]
push eax
push 0x7f
push dword [0x102aec0]
mov dword [ebp - 0x418], esi
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1010516
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1010515
push 0x1003e68
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x420], esi
mov dword [ebp - 0x41c], esi
call fcn.01017285
test eax, eax
jne 0x1010136
mov eax, dword [ebp - 0x41c]
mov ecx, eax
shr ecx, 0x10
cmp cx, 5
jne 0x10100f6
cmp ax, 1
jne 0x10100f6
inc eax
mov dword [ebp - 0x41c], eax
movzx ecx, ax
push ecx
shr eax, 0x10
push eax
lea eax, [ebp - 0x40c]
push eax
push 0x1003e50
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x18
lea eax, [ebp - 0x20c]
push eax
push 0xff
lea eax, [ebp - 0x40c]
push eax
call fcn.0100c535
push ebx
push 0x103
lea eax, [ebp - 0x20c]
push eax
push 3
call fcn.0100dd71
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.msvcrt.dll_wcslen]
je 0x1010218
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x1003d98
push 0x80000002
mov dword [ebp - 0x418], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10101bc
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1003d88
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x1003d98
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1010210
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1003d88
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x414], esi
jne 0x1010232
push 0x103
lea eax, [ebp - 0x20c]
push eax
push esi
call fcn.0100dd71
test eax, eax
je 0x1010514
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1003a58
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1010286
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1003a3c
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x10016c8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10102fc
lea eax, [ebp - 0x40c]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x40c]
push eax
push 1
push esi
push esi
push dword [ebp - 0x410]
call edi
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1003d88
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x10016c8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1010350
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1003d88
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x418], esi
je 0x1010360
cmp dword [ebp - 0x414], esi
jne 0x101037b
push 0x103
lea eax, [ebp - 0x20c]
push eax
push 2
call fcn.0100dd71
test eax, eax
je 0x1010423
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1003cd0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10103cf
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1003d88
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1003cd0
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1010423
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1003d88
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x418], esi
je 0x1010433
cmp dword [ebp - 0x414], esi
jne 0x101044e
push 0x103
lea eax, [ebp - 0x20c]
push eax
push 1
call fcn.0100dd71
test eax, eax
je 0x1010514
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1003c18
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10104c0
push 0x1003c14
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003c14
push 1
push esi
push esi
push dword [ebp - 0x410]
call edi
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1003d88
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x410]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1003c18
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1010514
lea eax, [ebp - 0x20c]
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1003d88
push dword [ebp - 0x410]
call edi
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop edi
mov ecx, dword [ebp - 4]
pop esi
call fcn.0101672d
leave
ret 4