Function at 0x1003691
Capabilities:
Check if file exists
Create directory
Get common file path
Get disk information
Get file attributes
Persist via run registry key
Query or enumerate registry value
Set file attributes
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x448
mov eax, dword [0x100923c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x444], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x43c], eax
mov eax, dword [ebp + 0x20]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x428], edi
je 0x1003725
lea ecx, [ebp - 0x434]
push ecx
lea ecx, [ebp - 0x430]
push ecx
lea ecx, [ebp - 0x440]
push ecx
push ebx
push dword [esi + 0xc]
mov dword [ebp - 0x434], 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1003725
cmp dword [ebp - 0x440], 4
je 0x1003717
cmp dword [ebp - 0x440], 3
jne 0x1003725
cmp dword [ebp - 0x434], 4
jne 0x1003725
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x41c], eax
jmp 0x1003743
cmp dword [0x1009250], ebx
jne 0x1003739
test byte [esi + 0x1c], 2
mov dword [ebp - 0x41c], ebx
je 0x1003743
mov dword [ebp - 0x41c], 1
push dword [ebp - 0x43c]
mov byte [edi], bl
mov edi, 0x104
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.01002385
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
push dword [ebp + 0x14]
push dword [ebp - 0x428]
push dword [esi]
push dword [0x100924c]
call dword [sym.imp.USER32.dll_LoadStringA]
cmp eax, ebx
jne 0x100379f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x1003798
call esi
jmp 0x100395d
call esi
jmp 0x1003ddb
push ebx
inc eax
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x424]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push dword [esi + 4]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x1003dd5
push edi
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test byte [esi + 0x1c], 4
lea eax, [ebp - 0x310]
je 0x100382d
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
test eax, eax
lea eax, [ebp - 0x310]
je 0x1003816
push 0x5c
push eax
call fcn.01005e1e
cmp eax, ebx
je 0x1003839
push 0x5c
inc eax
push eax
call fcn.01005e1e
cmp eax, ebx
je 0x1003839
mov byte [eax + 1], bl
jmp 0x1003839
push eax
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], 0x3a
jne 0x1003823
inc eax
cmp byte [eax], 0x5c
jne 0x1003829
inc eax
mov byte [eax], bl
jmp 0x1003839
push 0x10016d0
push edi
push eax
call fcn.01005cac
push dword [ebp - 0x428]
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x440]
push eax
push ebx
push dword [esi + 8]
mov dword [ebp - 0x420], ebx
push dword [ebp - 0x424]
mov dword [ebp - 0x434], edi
mov byte [ebp - 0x20c], bl
call fcn.01004afd
mov edi, eax
neg edi
sbb edi, edi
inc edi
jne 0x1003904
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
test byte [esi + 0x1c], 4
jne 0x10038af
mov dword [ebp - 0x420], 1
cmp dword [ebp + 0x1c], ebx
mov dword [ebp - 0x42c], 1
jne 0x100396c
cmp dword [ebp - 0x41c], ebx
je 0x100396c
cmp edi, ebx
je 0x10038fc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10038fc
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100396c
mov eax, dword [ebp - 0x43c]
jmp 0x1003978
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
test eax, eax
jne 0x100394f
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathGetDriveNumberA]
cmp eax, 0xffffffff
je 0x10038af
add al, 0x41
mov dword [ebp - 0x42c], 0x5c3a58
mov byte [ebp - 0x42c], al
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x10038af
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01005857
leave
ret 0x1c
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x42c], ebx
cmp edi, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x418], eax
jne 0x1003b63
cmp dword [esi + 4], 0x1001238
jne 0x10039b5
lea eax, [ebp - 0x20c]
cmp dword [ebp - 0x418], eax
jne 0x10039b5
cmp dword [ebp - 0x420], ebx
je 0x10039b5
test byte [esi + 0x1c], 8
je 0x1003ae8
cmp dword [0x1009250], ebx
je 0x10039ff
push 0x1001938
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x428]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 2
jmp 0x1003adc
test byte [esi + 0x1c], 8
je 0x1003ac6
cmp dword [0x100925c], ebx
jne 0x1003ac6
push ebx
lea eax, [ebp - 0x420]
push eax
push ebx
push 0x20019
push ebx
push ebx
push ebx
push 0x1001628
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1003ae8
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x448]
push eax
push ebx
push dword [esi + 8]
mov dword [ebp - 0x438], 0x104
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1003ab8
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1003ab8
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp - 0x418]
push 1
push ebx
push dword [esi + 8]
push dword [ebp - 0x424]
call edi
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1003ae8
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp - 0x418]
push 1
push ebx
push dword [esi + 8]
push dword [ebp - 0x424]
call edi
cmp dword [esi + 4], 0x1001238
jne 0x1003b44
push ebx
lea eax, [ebp - 0x420]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x1001628
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1003b44
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp - 0x418]
push 1
push ebx
push dword [esi + 8]
push dword [ebp - 0x420]
call edi
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x42c], ebx
je 0x1003b63
mov eax, dword [esi + 0x14]
cmp eax, ebx
je 0x1003b63
push dword [ebp - 0x43c]
lea ecx, [ebp - 0x20c]
push ecx
push esi
call eax
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1003b96
push ebx
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [esi + 0x18]
cmp eax, 0x10
je 0x1003b96
push eax
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi + 0x14], 0x10034ac
jne 0x1003c08
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1003c08
push 0x10014b4
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 0x438], eax
je 0x1003c08
push 0x100192c
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1003bfc
call eax
push dword [ebp - 0x438]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x41c], ebx
je 0x100395b
cmp dword [0x1009250], ebx
jne 0x100395b
push 0x1001920
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x428]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
lea eax, [ebp - 0x41c]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [esi + 0xc]
push dword [ebp - 0x444]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
mov dword [ebp - 0x418], eax
jne 0x1003d13
push dword [ebp - 0x430]
push dword [ebp - 0x428]
push 1
push ebx
push 0x10012dc
push dword [ebp - 0x41c]
call edi
cmp eax, ebx
mov dword [ebp - 0x418], eax
jne 0x1003d13
push dword [ebp - 0x430]
push dword [ebp - 0x428]
push 1
push ebx
push 0x10012e8
push dword [ebp - 0x41c]
call edi
cmp eax, ebx
mov dword [ebp - 0x418], eax
jne 0x1003d13
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esi + 0x10]
push 1
push ebx
push 0x10012f4
push dword [ebp - 0x41c]
call edi
cmp eax, ebx
mov dword [ebp - 0x418], eax
jne 0x1003d13
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push ebx
push 0x1001328
push dword [ebp - 0x41c]
call edi
mov dword [ebp - 0x418], eax
cmp dword [ebp - 0x418], ebx
mov dword [ebp - 0x420], 1
jne 0x1003dbb
push 4
lea eax, [ebp - 0x420]
push eax
push 4
push ebx
push 0x1001310
push dword [ebp - 0x41c]
call edi
cmp eax, ebx
mov dword [ebp - 0x418], eax
jne 0x1003dbb
push 4
lea eax, [ebp - 0x420]
push eax
push 4
push ebx
push 0x1001320
push dword [ebp - 0x41c]
call edi
cmp eax, ebx
mov dword [ebp - 0x418], eax
jne 0x1003dbb
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esi + 4]
push 1
push ebx
push 0x10012fc
push dword [ebp - 0x41c]
call edi
cmp eax, ebx
mov dword [ebp - 0x418], eax
jne 0x1003dbb
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esi + 8]
push 1
push ebx
push 0x1001304
push dword [ebp - 0x41c]
call edi
mov dword [ebp - 0x418], eax
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x418]
cmp eax, ebx
je 0x100395b
jle 0x100395d
and eax, 0xffff
or eax, 0x80070000
jmp 0x100395d