Function at 0x1000452a
Capabilities:
Create directory
Get common file path
Persist via run registry key
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x1002f060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
call fcn.10015e60
call fcn.10002e05
test eax, eax
jne 0x1000455a
mov ecx, esi
call fcn.10003ea4
jmp 0x1000485c
push ebx
push edi
push 3
push 0x1f4
xor ebx, ebx
push 0x1002690c
mov ecx, str.Installer
mov byte [esi], bl
call fcn.1000317e
add esp, 0xc
test eax, eax
je 0x100045b8
cmp byte [esi], bl
je 0x100045b8
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x100045b8
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
neg eax
sbb edi, edi
lea eax, [ebp - 0x10c]
push eax
inc edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp edi, ebx
je 0x10004857
call fcn.10015e60
call fcn.10002e1d
test eax, eax
je 0x100045ea
push 0x1f4
push esi
push str.WriteableUserFolder
push str.SoftwareReadingFanatic_6xEI
push ebx
push SysReAllocString
call fcn.100033b3
add esp, 0x18
test eax, eax
jne 0x100045ea
mov byte [esi], bl
cmp byte [esi], bl
jne 0x10004758
cmp dword [0x100342f4], ebx
jne 0x10004628
call fcn.10015e60
call fcn.10002e05
test eax, eax
je 0x10004628
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
je 0x10004628
push str.SHGetKnownFolderPath
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100342f4], eax
mov eax, dword [0x100342f4]
mov dword [ebp - 0x114], ebx
cmp eax, ebx
je 0x10004699
lea ecx, [ebp - 0x114]
push ecx
push ebx
push ebx
push 0x100245ac
call eax
test eax, eax
js 0x10004699
cmp dword [ebp - 0x114], ebx
je 0x10004699
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x114]
push ebx
push ebx
call edi
cmp eax, ebx
je 0x1000473f
cmp eax, 0x1f4
jge 0x1000473f
push ebx
push ebx
inc eax
push eax
push esi
push 0xffffffffffffffff
push dword [ebp - 0x114]
push ebx
push ebx
call edi
push dword [ebp - 0x114]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp byte [esi], bl
jne 0x10004758
lea eax, [ebp - 0x110]
push eax
mov dword [ebp - 0x110], ebx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
js 0x10004707
cmp dword [ebp - 0x110], ebx
je 0x10004707
lea eax, [ebp - 0x114]
push eax
push 0x1a
push ebx
mov dword [ebp - 0x114], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
js 0x10004707
cmp dword [ebp - 0x114], ebx
je 0x10004707
push esi
push dword [ebp - 0x114]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
jns 0x100046f5
mov byte [esi], bl
mov eax, dword [ebp - 0x110]
push dword [ebp - 0x114]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x110]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [esi], bl
jne 0x10004758
push 0x1f4
push esi
push str.AppData
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call fcn.10003395
add esp, 0x14
test eax, eax
jne 0x10004750
mov byte [esi], bl
jmp 0x1000483e
push dword [ebp - 0x114]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x1000483e
cmp byte [esi], bl
je 0x1000483e
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
xor ecx, ecx
mov eax, str.Cache
cmp ecx, eax
jne 0x10004771
mov dword [ebp - 0x110], ebx
jmp 0x1000477a
push eax
call edi
mov dword [ebp - 0x110], eax
push dword [0x10031e34]
call edi
push dword [0x10031e30]
mov ebx, eax
call edi
add ebx, dword [ebp - 0x110]
push esi
lea ebx, [eax + ebx + 0xa]
call edi
dec eax
test eax, eax
jle 0x100047a8
cmp byte [esi + eax], 0x5c
jne 0x100047a8
mov byte [esi + eax], 0
lea eax, [eax + ebx + 1]
cmp eax, 0x1f4
jg 0x1000483e
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x110], 0x10031e30
mov eax, dword [ebp - 0x110]
push dword [eax]
push esi
call edi
push 0
call ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x100047f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000483e
add dword [ebp - 0x110], 4
cmp dword [ebp - 0x110], 0x10031e38
jl 0x100047cd
xor ecx, ecx
mov eax, str.Cache
cmp ecx, eax
je 0x10004818
push eax
push esi
call edi
push 0x10026c48
push esi
call edi
push 0
call ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x10004842
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x10004842
xor eax, eax
jmp 0x1000485a
push esi
push 0x1002690c
push 3
pop edx
mov ecx, str.Installer
call fcn.100034d8
pop ecx
pop ecx
xor eax, eax
inc eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10017a76
leave
ret