Function at 0x10017af0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10096b4d
mov eax, dword fs:[0]
push eax
sub esp, 0x6a0
mov eax, dword [0x100c7394]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6ac], ecx
mov eax, dword [0x100ca8cc]
test al, 1
jne 0x10017f2d
or eax, 1
mov dword [0x100ca8cc], eax
mov dword [ebp - 4], 0
call fcn.10006af0
mov ecx, eax
test ecx, ecx
je 0x100182ef
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x658], eax
push str.gighmmpiobklfepjocnamgkkbiglidom
lea ecx, [ebp - 0x658]
mov byte [ebp - 4], 1
call fcn.10005ea0
test al, al
jne 0x10017b87
push 0x20
push str.gighmmpiobklfepjocnamgkkbiglidom
lea ecx, [ebp - 0x658]
call fcn.10008270
mov byte [ebp - 4], 2
call fcn.10006af0
mov ecx, eax
test ecx, ecx
je 0x100182f9
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x654], eax
push str.cfhdojbkjhnklbpkdaibdccddilifddb
lea ecx, [ebp - 0x654]
mov byte [ebp - 4], 3
call fcn.10005ea0
test al, al
jne 0x10017bd2
push 0x20
push str.cfhdojbkjhnklbpkdaibdccddilifddb
lea ecx, [ebp - 0x654]
call fcn.10008270
mov byte [ebp - 4], 4
call fcn.10006af0
mov ecx, eax
test ecx, ecx
je 0x10018303
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x650], eax
push str.bgnkhhnnamicmpeenaelnjfhikgbkllg
lea ecx, [ebp - 0x650]
mov byte [ebp - 4], 5
call fcn.10005ea0
test al, al
jne 0x10017c1d
push 0x20
push str.bgnkhhnnamicmpeenaelnjfhikgbkllg
lea ecx, [ebp - 0x650]
call fcn.10008270
mov byte [ebp - 4], 6
call fcn.10006af0
mov ecx, eax
test ecx, ecx
je 0x1001830d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x64c], eax
push str.comfmchjneommdoncjhagbkidolibgil
lea ecx, [ebp - 0x64c]
mov byte [ebp - 4], 7
call fcn.10005ea0
test al, al
jne 0x10017c68
push 0x20
push str.comfmchjneommdoncjhagbkidolibgil
lea ecx, [ebp - 0x64c]
call fcn.10008270
mov byte [ebp - 4], 8
call fcn.10006af0
mov ecx, eax
test ecx, ecx
je 0x10018317
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x648], eax
push str.figbiejimdgnhdefdigjmcgfbhppcmlh
lea ecx, [ebp - 0x648]
mov byte [ebp - 4], 9
call fcn.10005ea0
test al, al
jne 0x10017cb3
push 0x20
push str.figbiejimdgnhdefdigjmcgfbhppcmlh
lea ecx, [ebp - 0x648]
call fcn.10008270
mov byte [ebp - 4], 0xa
call fcn.10006af0
mov ecx, eax
test ecx, ecx
je 0x10018321
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x644], eax
push str.jjmnodmnjioloohkajephjnljefnpofk
lea ecx, [ebp - 0x644]
mov byte [ebp - 4], 0xb
call fcn.10005ea0
test al, al
jne 0x10017cfe
push 0x20
push str.jjmnodmnjioloohkajephjnljefnpofk
lea ecx, [ebp - 0x644]
call fcn.10008270
mov byte [ebp - 4], 0xc
call fcn.10006af0
mov ecx, eax
test ecx, ecx
je 0x1001832b
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x640], eax
push str.npdmbbiopnooephgmjlebjgkkhljambm
lea ecx, [ebp - 0x640]
mov byte [ebp - 4], 0xd
call fcn.10005ea0
test al, al
jne 0x10017d49
push 0x20
push str.npdmbbiopnooephgmjlebjgkkhljambm
lea ecx, [ebp - 0x640]
call fcn.10008270
mov byte [ebp - 4], 0xe
call fcn.10006af0
mov ecx, eax
test ecx, ecx
je 0x10018335
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x63c], eax
push str.khikalbjeipalegfaggfglmbjjnoppdg
lea ecx, [ebp - 0x63c]
mov byte [ebp - 4], 0xf
call fcn.10005ea0
test al, al
jne 0x10017d94
push 0x20
push str.khikalbjeipalegfaggfglmbjjnoppdg
lea ecx, [ebp - 0x63c]
call fcn.10008270
mov byte [ebp - 4], 0x10
call fcn.10006af0
mov ecx, eax
test ecx, ecx
je 0x1001833f
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x638], eax
push str.nkfmeecpeiaggnigpidlmbiipcdabifn
lea ecx, [ebp - 0x638]
mov byte [ebp - 4], 0x11
call fcn.10005ea0
test al, al
jne 0x10017ddf
push 0x20
push str.nkfmeecpeiaggnigpidlmbiipcdabifn
lea ecx, [ebp - 0x638]
call fcn.10008270
mov byte [ebp - 4], 0x12
call fcn.10006af0
mov ecx, eax
test ecx, ecx
je 0x10018349
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x634], eax
push str.ccbfjmejnkjmljidafielfedmeoibnap
lea ecx, [ebp - 0x634]
mov byte [ebp - 4], 0x13
call fcn.10005ea0
test al, al
jne 0x10017e2a
push 0x20
push str.ccbfjmejnkjmljidafielfedmeoibnap
lea ecx, [ebp - 0x634]
call fcn.10008270
mov byte [ebp - 4], 0x14
call fcn.10006af0
mov ecx, eax
test ecx, ecx
je 0x10018353
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x630], eax
push str.fpdnjdlbdmifoocedhkighhlbchbiikl
lea ecx, [ebp - 0x630]
mov byte [ebp - 4], 0x15
call fcn.10005ea0
test al, al
jne 0x10017e75
push 0x20
push str.fpdnjdlbdmifoocedhkighhlbchbiikl
lea ecx, [ebp - 0x630]
call fcn.10008270
mov byte [ebp - 4], 0x16
call fcn.10006af0
mov ecx, eax
test ecx, ecx
je 0x1001835d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x62c], eax
push str.kebaabphpfemempnnkkghjmjcmdibnka
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 0x17
call fcn.10005ea0
test al, al
jne 0x10017ec0
push 0x20
push str.kebaabphpfemempnnkkghjmjcmdibnka
lea ecx, [ebp - 0x62c]
call fcn.10008270
push dword [ebp - 0x6ac]
lea eax, [ebp - 0x628]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x658]
mov dword [0x100ca8c0], 0
push eax
mov ecx, 0x100ca8c0
mov dword [0x100ca8c4], 0
mov dword [0x100ca8c8], 0
call fcn.10014f50
push fcn.10004c70
push 0xc
push 4
lea eax, [ebp - 0x658]
mov byte [ebp - 4], 0
push eax
call fcn.1004d192
push 0x1009cd70
call fcn.1004d135
add esp, 4
mov dword [ebp - 4], 0xffffffff
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.10056af0
add esp, 0xc
lea eax, [ebp - 0x628]
push 0
push 0x1c
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp eax, 1
jne 0x10017f6f
push str.GoogleChromeUser_DataDefaultExtensions
lea eax, [ebp - 0x628]
push eax
call esi
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10056af0
add esp, 0xc
mov dword [ebp - 0x6a8], 1
xor eax, eax
mov dword [ebp - 0x6a4], 0x104
lea ecx, [ebp - 0x670]
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 7
push 0x58
push str.TK8Fj70YG_v_3_vPPg7Vdm30XuBkLQEO1THF4mZ06i_foDUuatiCLqo3UQuDlAc1wuD5hVjglIbaOJeXMCQ
mov word [ebp - 0x670], ax
call fcn.1000aaa0
lea eax, [ebp - 0x670]
mov dword [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x640]
push eax
call fcn.100080d0
add esp, 8
mov edx, dword [ebp - 0x65c]
mov byte [ebp - 4], 0x1b
cmp edx, 8
jb 0x10018029
mov ecx, dword [ebp - 0x670]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1001801f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10018367
push edx
push ecx
call fcn.1004cdcb
add esp, 8
mov ebx, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea ecx, [ebp - 0x6a4]
push ecx
xor eax, eax
mov dword [ebp - 0x660], 0
cmp dword [ebp - 0x62c], 8
lea ecx, [ebp - 0x218]
push ecx
mov word [ebp - 0x670], ax
lea ecx, [ebp - 0x6a8]
push ecx
lea eax, [ebp - 0x640]
mov dword [ebp - 0x65c], 7
cmovae eax, dword [ebp - 0x640]
push str.InstallLocation
push eax
push 0x80000001
call ebx
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
test eax, eax
jne 0x100180a3
lea eax, [ebp - 0x218]
push eax
call edi
push str.User_DataDefaultExtensions
lea eax, [ebp - 0x218]
push eax
call esi
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.10056af0
add esp, 0xc
mov dword [ebp - 0x6a8], 1
xor eax, eax
mov dword [ebp - 0x6a4], 0x104
lea ecx, [ebp - 0x688]
mov dword [ebp - 0x678], 0
mov dword [ebp - 0x674], 7
push 0x58
push str.TK8Fj70YG_v_3_vPPg7Vdm30XuBkLQEO1THF4mZ06i_foDUuatiCLqo3UQuDlAcNYT9wv6OGo2LxfcPIj7LcA
mov word [ebp - 0x688], ax
call fcn.1000aaa0
lea eax, [ebp - 0x688]
mov byte [ebp - 4], 0x1c
push eax
lea eax, [ebp - 0x6a0]
push eax
call fcn.100080d0
add esp, 8
mov edx, dword [ebp - 0x674]
mov byte [ebp - 4], 0x1e
cmp edx, 8
jb 0x1001815a
mov ecx, dword [ebp - 0x688]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10018150
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001836c
push edx
push ecx
call fcn.1004cdcb
add esp, 8
lea ecx, [ebp - 0x6a4]
mov dword [ebp - 0x678], 0
push ecx
xor eax, eax
mov dword [ebp - 0x674], 7
cmp dword [ebp - 0x68c], 8
lea ecx, [ebp - 0x420]
push ecx
mov word [ebp - 0x688], ax
lea ecx, [ebp - 0x6a8]
push ecx
lea eax, [ebp - 0x6a0]
cmovae eax, dword [ebp - 0x6a0]
push str.InstallLocation
push eax
push 0x80000001
call ebx
test eax, eax
jne 0x100181c8
lea eax, [ebp - 0x420]
push eax
call edi
push str.User_DataDefaultExtensions
lea eax, [ebp - 0x420]
push eax
call esi
lea eax, [ebp - 0x628]
xor ebx, ebx
mov dword [ebp - 0x664], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 0x660], eax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x65c], eax
mov eax, dword [0x100ca8c4]
mov esi, dword [0x100ca8c0]
cmp esi, eax
je 0x10018223
mov edi, dword [ebp + ebx*4 - 0x664]
push dword [esi]
mov ecx, dword [ebp - 0x6ac]
push edi
call fcn.10018380
cmp eax, 1
je 0x10018263
mov eax, dword [0x100ca8c4]
add esi, 4
cmp esi, eax
jne 0x10018204
inc ebx
cmp ebx, 3
jl 0x100181f3
xor ebx, ebx
mov edx, dword [ebp - 0x68c]
cmp edx, 8
jb 0x10018274
mov ecx, dword [ebp - 0x6a0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1001826a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10018371
jmp 0x1001826a
mov ebx, 1
jmp 0x1001822b
push edx
push ecx
call fcn.1004cdcb
add esp, 8
mov edx, dword [ebp - 0x62c]
xor eax, eax
mov dword [ebp - 0x690], 0
mov dword [ebp - 0x68c], 7
mov word [ebp - 0x6a0], ax
cmp edx, 8
jb 0x100182d1
mov ecx, dword [ebp - 0x640]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100182c7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10018376
push edx
push ecx
call fcn.1004cdcb
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004d14a
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.10005e80
push 0x80004005
call fcn.10005e80
push 0x80004005
call fcn.10005e80
push 0x80004005
call fcn.10005e80
push 0x80004005
call fcn.10005e80
push 0x80004005
call fcn.10005e80
push 0x80004005
call fcn.10005e80
push 0x80004005
call fcn.10005e80
push 0x80004005
call fcn.10005e80
push 0x80004005
call fcn.10005e80
push 0x80004005
call fcn.10005e80
push 0x80004005
call fcn.10005e80
call fcn.10059c49
call fcn.10059c49
call fcn.10059c49
call fcn.10059c49
int3