Function at 0x10097a5
Capabilities:
Check if file exists
Copy file
Create directory
Get file attributes
Get installed programs
Persist via app paths registry key
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x13c8
call fcn.0100d920
mov eax, dword [0x101200c]
push esi
push edi
push 1
push 0x1001ce0
mov dword [ebp - 4], eax
call fcn.0100d0a2
xor eax, eax
push 0x41
pop ecx
lea edi, [ebp - 0x414]
rep stosd dword es:[edi], eax
mov eax, dword [0x1016c6c]
dec eax
dec eax
jne 0x100a6e8
push ebx
xor ebx, ebx
cmp dword [0x1016c80], ebx
je 0x100a6db
cmp dword [0x1016c84], ebx
je 0x100a6db
lea eax, [ebp - 0x1058]
push eax
push 0x20019
push ebx
push 0x10054c4
mov esi, 0x80000002
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100a6e7
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x105c]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x1005490
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100a6cd
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x1068]
push eax
push ebx
push 0x1005510
push dword [ebp - 0x1058]
mov dword [ebp - 0x1048], 0x103
mov byte [ebp - 0x61d], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a6c1
cmp dword [ebp - 0x1068], 2
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov edi, 0x104
jne 0x10098db
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x720]
push eax
call esi
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 4
jmp 0x10098e4
mov eax, dword [ebp - 0x1048]
add eax, 0xfffffffb
mov dword [ebp - 0x1054], eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100a6c1
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x1068]
push eax
push ebx
push 0x10053f0
push dword [ebp - 0x1058]
mov dword [ebp - 0x1048], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a6c1
cmp dword [ebp - 0x1068], 2
jne 0x1009964
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push eax
call esi
push edi
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x61c]
push eax
call esi
cmp byte [ebp - 0x61c], bl
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1050], ebx
je 0x100a6c1
mov eax, dword [ebp - 0x104c]
cmp byte [eax], 0x5c
jne 0x10099ab
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x1050], eax
push dword [ebp - 0x104c]
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], bl
mov dword [ebp - 0x104c], eax
jne 0x1009993
cmp dword [ebp - 0x1050], ebx
je 0x100a6c1
mov ecx, 0x1001cd4
mov dword [ebp - 0x110c], ecx
mov dword [ebp - 0x10cc], ecx
mov ecx, 0x10166ac
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x10b8], ecx
mov dword [ebp - 0x10b0], ecx
lea ecx, [ebp - 0x310]
lea eax, [ebp - 0xb30]
mov dword [ebp - 0x1138], eax
mov dword [ebp - 0x13c4], ecx
mov dword [ebp - 0x13bc], ecx
lea eax, [ebp - 0x20c]
mov ecx, edx
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x1128], eax
lea eax, [ebp - 0x310]
mov dword [ebp - 0x13b4], ecx
mov dword [ebp - 0x13ac], ecx
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x1120], eax
mov dword [ebp - 0x1118], eax
mov dword [ebp - 0x1110], eax
mov dword [ebp - 0x1108], eax
mov eax, 0x10165a8
mov dword [ebp - 0x13a4], ecx
mov dword [ebp - 0x139c], ecx
mov dword [ebp - 0x137c], ecx
mov ecx, edx
mov byte [ebp - 0x310], bl
mov byte [ebp - 0xb30], bl
mov byte [ebp - 0x20c], bl
mov byte [ebp - 0x108], bl
mov byte [ebp - 0x518], bl
mov dword [ebp - 0x113c], 0x1001cc8
mov dword [ebp - 0x1134], 0x1001cc0
mov dword [ebp - 0x112c], 0x1001cb8
mov dword [ebp - 0x1124], 0x10014d8
mov dword [ebp - 0x111c], 0x1001cac
mov dword [ebp - 0x1114], 0x1001ca0
mov dword [ebp - 0x1104], 0x1001c90
mov dword [ebp - 0x1100], eax
mov dword [ebp - 0x10fc], 0x1001c84
mov dword [ebp - 0x10f8], eax
mov dword [ebp - 0x10f4], 0x1001c74
mov dword [ebp - 0x10f0], edx
mov dword [ebp - 0x10ec], 0x1001c68
mov dword [ebp - 0x10e8], edx
mov dword [ebp - 0x10e4], 0x1001c5c
mov dword [ebp - 0x10e0], edx
mov dword [ebp - 0x10dc], 0x1001c54
mov dword [ebp - 0x10d8], edx
mov dword [ebp - 0x10d4], 0x1001cc8
mov dword [ebp - 0x10d0], eax
mov dword [ebp - 0x10c8], eax
mov dword [ebp - 0x10c4], 0x1001ca0
mov dword [ebp - 0x10c0], eax
mov dword [ebp - 0x10bc], 0x10014d8
mov dword [ebp - 0x10b4], 0x1001cac
mov dword [ebp - 0x13c8], 0x1001c48
mov dword [ebp - 0x13c0], 0x1001c3c
mov dword [ebp - 0x13b8], 0x1001c30
mov dword [ebp - 0x13b0], 0x1001c24
mov dword [ebp - 0x13a8], 0x1001c18
mov dword [ebp - 0x13a0], 0x1001c08
mov dword [ebp - 0x1398], 0x1001bf8
mov dword [ebp - 0x1394], eax
mov dword [ebp - 0x1390], 0x1001bec
mov dword [ebp - 0x138c], eax
mov dword [ebp - 0x1388], 0x1001bdc
mov dword [ebp - 0x1384], eax
mov dword [ebp - 0x1380], 0x1001bd0
mov dword [ebp - 0x1378], 0x1001bc0
mov dword [ebp - 0x1374], ecx
mov dword [ebp - 0x1370], 0x1001bb4
mov dword [ebp - 0x136c], ecx
mov dword [ebp - 0x1368], 0x1001ba8
mov dword [ebp - 0x1364], ecx
mov dword [ebp - 0x1360], 0x1001b9c
mov dword [ebp - 0x135c], ecx
mov dword [ebp - 0x1358], 0x1001b90
mov dword [ebp - 0x131c], eax
lea eax, [ebp - 0x518]
mov dword [ebp - 0x1354], ecx
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x1314], eax
mov dword [ebp - 0x130c], eax
mov dword [ebp - 0x1304], eax
mov dword [ebp - 0x12fc], eax
mov dword [ebp - 0x12f4], eax
mov dword [ebp - 0x12ec], eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x1350], 0x1001b84
mov dword [ebp - 0x134c], ecx
mov dword [ebp - 0x1348], 0x1001b78
mov dword [ebp - 0x1344], ecx
mov dword [ebp - 0x1340], 0x1001b6c
mov dword [ebp - 0x133c], ecx
mov dword [ebp - 0x1338], 0x1001b5c
mov dword [ebp - 0x1334], ecx
mov dword [ebp - 0x1330], 0x1001b4c
mov dword [ebp - 0x132c], ecx
mov dword [ebp - 0x1328], 0x1001b40
mov dword [ebp - 0x1324], 0x10169b8
mov dword [ebp - 0x1320], 0x1001b34
mov dword [ebp - 0x1318], 0x1001b28
mov dword [ebp - 0x1310], 0x1001b18
mov dword [ebp - 0x1308], 0x1001b0c
mov dword [ebp - 0x1300], 0x1001afc
mov dword [ebp - 0x12f8], 0x1001aec
mov dword [ebp - 0x12f0], 0x1001adc
mov dword [ebp - 0x12e8], 0x1001acc
mov dword [ebp - 0x12e4], eax
mov dword [ebp - 0x12e0], 0x1001aac
mov dword [ebp - 0x12dc], eax
mov dword [ebp - 0x12d8], 0x1001a98
mov dword [ebp - 0x12d4], eax
mov dword [ebp - 0x12d0], 0x1001a80
mov dword [ebp - 0x12cc], eax
mov dword [ebp - 0x12c8], 0x1001a70
mov dword [ebp - 0x12c4], eax
mov dword [ebp - 0x12c0], 0x1001a64
mov dword [ebp - 0x12bc], eax
mov dword [ebp - 0x12b8], 0x1001a50
mov dword [ebp - 0x12b4], eax
mov dword [ebp - 0x12b0], 0x1001a44
mov dword [ebp - 0x12ac], eax
mov dword [ebp - 0x12a8], 0x1001a2c
mov dword [ebp - 0x12a4], eax
mov dword [ebp - 0x12a0], 0x1001a1c
mov dword [ebp - 0x129c], eax
mov dword [ebp - 0x1298], 0x1001a0c
mov dword [ebp - 0x1294], eax
mov dword [ebp - 0x1290], 0x1001a04
mov dword [ebp - 0x128c], eax
mov dword [ebp - 0x1288], 0x10019ec
mov dword [ebp - 0x1284], eax
mov dword [ebp - 0x1280], 0x10019d8
mov dword [ebp - 0x127c], eax
mov dword [ebp - 0x1278], 0x10019cc
mov dword [ebp - 0x1274], eax
mov dword [ebp - 0x1270], 0x10019b4
mov dword [ebp - 0x126c], eax
mov dword [ebp - 0x1268], 0x1001994
mov dword [ebp - 0x1264], eax
mov dword [ebp - 0x1260], 0x1001980
mov dword [ebp - 0x125c], eax
mov dword [ebp - 0x1258], 0x1001974
mov dword [ebp - 0x1254], eax
mov dword [ebp - 0x1250], 0x1001958
mov dword [ebp - 0x124c], eax
mov dword [ebp - 0x1248], 0x100194c
mov dword [ebp - 0x1244], eax
mov dword [ebp - 0x1240], 0x1001940
mov dword [ebp - 0x123c], eax
mov dword [ebp - 0x1238], 0x1001934
mov dword [ebp - 0x1234], eax
mov dword [ebp - 0x1230], 0x1001920
mov dword [ebp - 0x122c], eax
mov dword [ebp - 0x1228], 0x1001910
mov dword [ebp - 0x1224], eax
mov dword [ebp - 0x1220], 0x1001900
mov ecx, 0x10018c4
mov dword [ebp - 0x121c], eax
mov dword [ebp - 0x1214], eax
mov dword [ebp - 0x120c], eax
mov dword [ebp - 0x1204], eax
mov dword [ebp - 0x11fc], eax
mov dword [ebp - 0x11f4], eax
mov dword [ebp - 0x11ec], eax
mov dword [ebp - 0x11e4], eax
mov dword [ebp - 0x11dc], eax
mov eax, 0x100553c
mov dword [ebp - 0x10a8], ecx
mov dword [ebp - 0x109c], ecx
mov ecx, 0x1001884
mov dword [ebp - 0x10ac], eax
mov dword [ebp - 0x10a0], eax
mov edx, 0x10022f4
mov dword [ebp - 0x1094], eax
mov dword [ebp - 0x1090], ecx
mov dword [ebp - 0x1088], eax
mov dword [ebp - 0x1084], ecx
mov ecx, 0x1001840
mov dword [ebp - 0x107c], eax
mov dword [ebp - 0x11d8], eax
mov dword [ebp - 0x11cc], eax
mov dword [ebp - 0x11c0], eax
mov dword [ebp - 0x11b4], eax
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x119c], eax
mov dword [ebp - 0x1190], eax
mov dword [ebp - 0x1184], eax
mov dword [ebp - 0x1178], eax
mov dword [ebp - 0x116c], eax
mov dword [ebp - 0x1160], eax
mov dword [ebp - 0x1154], eax
mov dword [ebp - 0x1148], eax
lea eax, [ebp - 0x518]
sub eax, dword [ebp - 0x1050]
mov dword [ebp - 0x1098], edx
mov dword [ebp - 0x1080], edx
mov edx, 0x10017f8
mov dword [ebp - 0x11c8], ecx
mov dword [ebp - 0x11bc], ecx
mov dword [ebp - 0x11b0], ecx
mov dword [ebp - 0x11a4], ecx
mov ecx, 0x10017d0
mov dword [ebp - 0x1218], 0x10017c0
mov dword [ebp - 0x1210], 0x10017b4
mov dword [ebp - 0x1208], 0x10017a0
mov dword [ebp - 0x1200], 0x1001798
mov dword [ebp - 0x11f8], 0x1001774
mov dword [ebp - 0x11f0], 0x1001764
mov dword [ebp - 0x11e8], 0x1001758
mov dword [ebp - 0x11e0], 0x100174c
mov dword [ebp - 0x10a4], 0x10025a4
mov dword [ebp - 0x108c], 0x10025a4
mov dword [ebp - 0x1078], edx
mov dword [ebp - 0x1074], ebx
mov dword [ebp - 0x11d4], 0x10016f8
mov dword [ebp - 0x11d0], 0x10016e8
mov dword [ebp - 0x11c4], 0x10016dc
mov dword [ebp - 0x11b8], 0x10016cc
mov dword [ebp - 0x11ac], 0x10016b4
mov dword [ebp - 0x11a0], 0x1005558
mov dword [ebp - 0x1198], ecx
mov dword [ebp - 0x1194], 0x10016a8
mov dword [ebp - 0x118c], 0x100167c
mov dword [ebp - 0x1188], 0x1001674
mov dword [ebp - 0x1180], ecx
mov dword [ebp - 0x117c], 0x100166c
mov dword [ebp - 0x1174], 0x1001644
mov dword [ebp - 0x1170], ebx
mov dword [ebp - 0x1168], 0x100161c
mov dword [ebp - 0x1164], ebx
mov dword [ebp - 0x115c], 0x10015ec
mov dword [ebp - 0x1158], ebx
mov dword [ebp - 0x1150], 0x10015bc
mov dword [ebp - 0x114c], ebx
mov dword [ebp - 0x1144], edx
mov dword [ebp - 0x1140], ebx
push eax
push 0x10057bc
push dword [ebp - 0x1050]
call esi
push ebx
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
push dword [ebp - 0x105c]
push dword [ebp - 0x1058]
call fcn.01006d9f
cmp dword [0x1016bd8], 1
jne 0x100a219
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
push ebx
push 0x10054fc
push dword [ebp - 0x1058]
mov dword [ebp - 0x1048], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a219
cmp byte [ebp - 0x414], bl
lea eax, [ebp - 0x414]
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1050], ebx
je 0x100a219
mov eax, dword [ebp - 0x104c]
cmp byte [eax], 0x5c
jne 0x100a189
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x1050], eax
push dword [ebp - 0x104c]
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], bl
mov dword [ebp - 0x104c], eax
jne 0x100a171
cmp dword [ebp - 0x1050], ebx
je 0x100a219
push dword [ebp - 0x1050]
lea eax, [ebp - 0x61c]
push eax
push 0x10024a4
lea eax, [ebp - 0x928]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push edi
lea eax, [ebp - 0x928]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x928]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x928]
push eax
push 1
push ebx
push 0x10054fc
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push edi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x824]
push eax
call esi
push edi
push 0x10057d8
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatBuffA]
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x104c], edi
sub dword [ebp - 0x104c], eax
push dword [ebp - 0x104c]
lea eax, [ebp + eax - 0x824]
push 0x1005920
push eax
mov dword [ebp - 0x1070], eax
call esi
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov dword [ebp - 0x1048], eax
lea eax, [ebp - 0x61c]
push eax
push 1
push ebx
push 0x10053f0
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov dword [ebp - 0x1048], eax
lea eax, [ebp - 0x824]
push eax
push 1
push ebx
push 0x1005510
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0xb30]
push eax
lea eax, [ebp - 0x310]
push eax
push 0xf
call fcn.010094aa
cmp dword [0x1016bd8], 1
mov dword [ebp - 0x1050], eax
jne 0x100a35e
test al, 1
je 0x100a316
push edi
lea eax, [ebp - 0x310]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test byte [ebp - 0x1050], 2
je 0x100a32e
push edi
lea eax, [ebp - 0xb30]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test byte [ebp - 0x1050], 4
je 0x100a346
push edi
lea eax, [ebp - 0x518]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test byte [ebp - 0x1050], 8
je 0x100a35e
push edi
lea eax, [ebp - 0x108]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push edi
push 0x10166ac
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, edi
sub ecx, eax
push ecx
mov dword [ebp - 0x1048], eax
lea eax, [ebp + eax - 0x20c]
push eax
push 0x40a
push dword [0x1016c8c]
call dword [sym.imp.USER32.dll_LoadStringA]
cmp dword [0x1016bd8], 1
jne 0x100a3b6
push edi
lea eax, [ebp - 0x20c]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 1
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [ebp - 0x1054]
mov ecx, edi
sub ecx, eax
push ecx
push 0x1005910
lea eax, [ebp + eax - 0x720]
push eax
call esi
push dword [ebp - 0x104c]
push 0x1005910
push dword [ebp - 0x1070]
call esi
push 1
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
xor esi, esi
cmp esi, 0x12
mov dword [ebp - 0x1048], ebx
jae 0x100a479
mov dword [ebp - 0x104c], ebx
cmp dword [ebp - 0x104c], 5
jge 0x100a479
push dword [ebp + esi*8 - 0x113c]
mov eax, dword [ebp - 0x1048]
push dword [ebp + esi*8 - 0x1138]
inc dword [ebp - 0x1048]
mov ecx, 0x514
sub ecx, dword [ebp - 0x1048]
push 0x100597c
lea eax, [ebp + eax - 0x1044]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add dword [ebp - 0x1048], eax
add esp, 0x14
inc esi
inc dword [ebp - 0x104c]
cmp esi, 0x12
jb 0x100a422
mov eax, dword [ebp - 0x1048]
push 2
mov byte [ebp + eax - 0x1044], bl
push 0x10057c8
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x1044]
push eax
call dword [0x1016c80]
cmp esi, 0x12
jb 0x100a411
xor esi, esi
cmp esi, 0x3e
mov dword [ebp - 0x1048], ebx
jae 0x100a514
mov dword [ebp - 0x104c], ebx
cmp dword [ebp - 0x104c], 5
jge 0x100a514
push dword [ebp + esi*8 - 0x13c8]
mov eax, dword [ebp - 0x1048]
push dword [ebp + esi*8 - 0x13c4]
inc dword [ebp - 0x1048]
mov ecx, 0x514
sub ecx, dword [ebp - 0x1048]
push 0x100597c
lea eax, [ebp + eax - 0x1044]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add dword [ebp - 0x1048], eax
add esp, 0x14
inc esi
inc dword [ebp - 0x104c]
cmp esi, 0x3e
jb 0x100a4bd
mov eax, dword [ebp - 0x1048]
push 2
mov byte [ebp + eax - 0x1044], bl
push 0x10057bc
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x1044]
push eax
call dword [0x1016c80]
cmp esi, 0x3e
jb 0x100a4ac
cmp dword [0x1016bd8], 1
mov dword [ebp - 0x1064], ebx
mov dword [ebp - 0x1060], ebx
je 0x100a596
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x1064]
push eax
push 0x2001f
push ebx
push 0x100554c
push dword [ebp - 0x1058]
call esi
lea eax, [ebp - 0x1060]
push eax
push 0x2001f
push ebx
push 0x100554c
push dword [ebp - 0x105c]
call esi
jmp 0x100a5ae
mov eax, dword [ebp - 0x1058]
mov dword [ebp - 0x1064], eax
mov eax, dword [ebp - 0x105c]
mov dword [ebp - 0x1060], eax
cmp dword [ebp - 0x1064], ebx
je 0x100a601
lea esi, [ebp - 0x10a8]
mov dword [ebp - 0x1054], 5
push 0x1009
push dword [esi + 4]
push dword [esi]
push dword [esi - 4]
push dword [ebp - 0x1064]
push ebx
push ebx
call dword [0x1016c84]
add esi, 0xc
dec dword [ebp - 0x1054]
jne 0x100a5c6
cmp dword [0x1016bd8], 1
je 0x100a601
push dword [ebp - 0x1064]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1060], ebx
je 0x100a654
lea esi, [ebp - 0x11d4]
mov dword [ebp - 0x1054], 0xd
push 0x1009
push dword [esi + 4]
push dword [esi]
push dword [esi - 4]
push dword [ebp - 0x1060]
push ebx
push ebx
call dword [0x1016c84]
add esi, 0xc
dec dword [ebp - 0x1054]
jne 0x100a619
cmp dword [0x1016bd8], 1
je 0x100a654
push dword [ebp - 0x1060]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x106c]
push eax
push ebx
call fcn.0100cb57
cmp dword [ebp - 0x106c], 1
je 0x100a673
cmp dword [ebp - 0x106c], 2
jne 0x100a6c1
push dword [0x1016bc4]
mov esi, 0x10169b8
push esi
push 0x100597c
lea eax, [ebp - 0x414]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
cmp dword [ebp - 0x106c], 2
mov eax, 0x100586c
je 0x100a6a8
mov eax, 0x1005888
push ebx
push 0xd
push ebx
push 0x10167b0
push esi
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [0x1016c74]
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x1058]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100a6e7
push 1
push 0x1001570
call fcn.0100d0a2
pop ebx
push 1
push 0x1001550
call fcn.0100d0a2
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0100d528
leave
ret