Function at 0x103316c
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa2c
mov eax, dword [0x10de03c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0xa10], eax
push edi
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x604]
xor esi, esi
push eax
mov dword [ebp - 0xa18], esi
mov dword [ebp - 0xa0c], 0x200
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
test eax, eax
mov ebx, dword [sym.imp.msvcrt.dll_wcslen]
je 0x1033240
cmp word [ebp + 0xc], si
je 0x1033240
lea eax, [ebp - 0x604]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
jne 0x10331e4
lea edi, [ebp - 0x604]
jmp 0x10331e6
inc edi
inc edi
push edi
call ebx
cmp word [edi], si
pop ecx
lea ecx, [eax + eax + 2]
mov eax, edi
je 0x1033205
cmp word [eax], 0x5c
jne 0x10331fe
mov word [eax], si
inc eax
inc eax
cmp word [eax], si
jne 0x10331f5
push 1
push 1
push 4
push 0x1004c50
push ecx
push edi
push 1
lea eax, [ebp - 0xa08]
push eax
call fcn.0108c5ff
test ax, ax
jne 0x1033240
mov eax, dword [ebp - 0xa08]
or byte [eax + 0x15], 2
push dword [ebp - 0xa08]
push dword [ebp - 0xa10]
call fcn.0108cabd
lea eax, [ebp - 0xa24]
push eax
push 1
push esi
push 0x1005aa0
push reloc.KERNEL32.dll_WaitForSingleObject
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10334ba
mov eax, 0x200
mov dword [ebp - 0xa28], eax
mov dword [ebp - 0xa0c], eax
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x604]
push eax
push esi
push esi
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0xa04]
push eax
push dword [ebp - 0xa18]
push dword [ebp - 0xa24]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
mov dword [ebp - 0xa2c], eax
jne 0x103349c
mov eax, dword [ebp - 0xa0c]
shr eax, 1
mov dword [ebp - 0xa0c], eax
mov word [ebp + eax*2 - reloc.ADVAPI32.dll_RegDeleteValueW], si
cmp eax, esi
je 0x103349c
dec eax
cmp word [ebp + eax*2 - reloc.ADVAPI32.dll_RegDeleteValueW], 0x5c
mov dword [ebp - 0xa0c], eax
jne 0x10332c7
cmp eax, esi
je 0x103349c
mov edi, dword [sym.imp.msvcrt.dll_wcschr]
add eax, eax
lea ecx, [ebp + eax - 0x602]
mov word [ebp + eax - reloc.ADVAPI32.dll_RegDeleteValueW], si
lea eax, [ebp - 0x604]
push 0x5c
push eax
mov dword [ebp - 0xa14], ecx
call edi
cmp eax, esi
pop ecx
pop ecx
je 0x103349c
add eax, 2
push 0x5c
push eax
call edi
cmp eax, esi
pop ecx
pop ecx
je 0x103349c
add eax, 2
push 0x5c
push eax
call edi
cmp eax, esi
pop ecx
pop ecx
je 0x103349c
lea edi, [eax + 2]
push edi
mov dword [ebp - 0xa1c], edi
call ebx
lea eax, [eax + eax + 2]
pop ecx
mov dword [ebp - 0xa20], eax
jmp 0x1033363
cmp word [edi], 0x5c
jne 0x1033361
mov word [edi], si
inc edi
inc edi
cmp word [edi], si
jne 0x1033358
push esi
push esi
push dword [ebp - 0xa14]
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0xa14]
xor eax, eax
cmp word [ebp + 0xc], si
push dword [ebp - 0xa20]
setne al
push dword [ebp - 0xa1c]
push eax
lea eax, [ebp - 0xa08]
push eax
call fcn.0108c5ff
test ax, ax
jne 0x10333c0
mov eax, dword [ebp - 0xa08]
or byte [eax + 0x15], 2
push dword [ebp - 0xa08]
push dword [ebp - 0xa10]
call fcn.0108cabd
push dword [ebp - 0xa14]
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x204]
push eax
call edi
lea eax, [ebp - 0x204]
push 0x1005a94
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
push esi
lea eax, [ebp - 0x204]
push esi
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0xa20]
lea eax, [ebp - 0xa08]
push dword [ebp - 0xa1c]
push esi
push eax
call fcn.0108c5ff
test ax, ax
jne 0x1033431
push dword [ebp - 0xa08]
push dword [ebp - 0xa10]
call fcn.0108cabd
push dword [ebp - 0xa14]
lea eax, [ebp - 0x204]
push eax
call edi
lea eax, [ebp - 0x204]
push 0x1005a88
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
push esi
lea eax, [ebp - 0x204]
push esi
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0xa20]
lea eax, [ebp - 0xa08]
push dword [ebp - 0xa1c]
push esi
push eax
call fcn.0108c5ff
test ax, ax
jne 0x103349c
push dword [ebp - 0xa08]
push dword [ebp - 0xa10]
call fcn.0108cabd
inc dword [ebp - 0xa18]
cmp dword [ebp - 0xa2c], esi
je 0x1033262
push dword [ebp - 0xa24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01075bbb
leave
ret 8