Function at 0x100e0ef
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x278
push ebx
push esi
push edi
xor esi, esi
cmp dword [0x10374dc], esi
mov edi, 0x104
mov dword [ebp - 8], edi
je 0x100e110
mov dword [ebp + 0xc], esi
push 0xc
push edi
lea eax, [ebp - 0x278]
push eax
push dword [ebp + 8]
call fcn.0100dc41
push 0x2e
lea eax, [ebp - 0x278]
push eax
call fcn.0100738b
test eax, eax
jne 0x100e146
push edi
push 0x1001d78
lea eax, [ebp - 0x278]
push eax
call fcn.0100d647
lea eax, [ebp - 0x174]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push edi
lea eax, [ebp - 0x174]
push eax
call fcn.0100d8d9
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x174]
push eax
call fcn.0100d647
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [ebp - 0x174]
push eax
call ebx
cmp eax, 0xffffffff
lea eax, [ebp - 0x174]
push eax
jne 0x100e25c
push dword [ebp + 8]
call fcn.0100e03d
test eax, eax
jne 0x100e255
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push 0x1001958
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100e1f4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x174]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100e1f4
mov esi, 0x168
jmp 0x100e226
push 1
lea eax, [ebp - 0x174]
push eax
call fcn.0100d926
mov esi, 0x168
push esi
lea eax, [ebp - 0x174]
push eax
call fcn.0100d8d9
push esi
push 0x1001d80
lea eax, [ebp - 0x174]
push eax
call fcn.0100d647
push esi
lea eax, [ebp - 0x174]
push eax
call fcn.0100d8d9
push esi
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x174]
push eax
call fcn.0100d647
lea eax, [ebp - 0x174]
push eax
call ebx
cmp eax, 0xffffffff
je 0x100e266
lea eax, [ebp - 0x174]
push eax
call fcn.0100d76d
jmp 0x100e37c
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x100e274
xor eax, eax
jmp 0x100e37c
push dword [ebp + 8]
mov dword [0x10374dc], 1
push 0xe
call fcn.01021676
push eax
lea eax, [ebp - 0x174]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x1039554]
add esp, 0xc
cmp eax, esi
jne 0x100e2b3
mov eax, dword [0x1039478]
lea eax, [eax + eax*4]
shl eax, 4
mov eax, dword [eax + 0x1039580]
mov ecx, dword [0x10394e4]
or ecx, 0x24
push ecx
push dword [0x1039304]
lea ecx, [ebp - 0x174]
push ecx
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
je 0x100e2dd
xor eax, eax
jmp 0x100e376
mov eax, dword [0x1039478]
push esi
push dword [ebp + 8]
lea eax, [eax + eax*4]
shl eax, 4
push dword [eax + 0x1039580]
call fcn.0100ba90
mov ebx, eax
cmp ebx, esi
je 0x100e374
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x174]
push eax
push edi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jbe 0x100e374
mov eax, dword [ebp + 8]
and byte [eax - 1], 0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0xf003f
push esi
push str.Folder
push esi
push 0x1001958
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100e374
lea eax, [ebp - 0x174]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x174]
push eax
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov dword [0x10374dc], esi
pop edi
pop esi
pop ebx
leave
ret 8