Function at 0x10002a40
Capabilities:
Create directory
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x64c
mov eax, dword [0x10140664]
xor eax, esp
mov dword [esp + 0x648], eax
push ebx
push ebp
mov ebp, dword [esp + 0x65c]
push esi
mov esi, dword [esp + 0x65c]
push edi
lea eax, [esp + 0x10]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push closesocket
mov dword [esp + 0x28], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10002ced
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x15c]
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.Personal
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10002ced
push str.BBE_Sound
lea ecx, [esp + 0x15c]
push ecx
lea edx, [esp + 0x560]
push str._s_s
push edx
call sub.MSVCR80.dll_sprintf
mov edi, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
add esp, 0x10
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x55c]
push ecx
call edi
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jne 0x10002b47
push str.BBE_Sound
lea edx, [esp + 0x15c]
push edx
lea eax, [esp + 0x260]
push 0x1005d7ec
push eax
call sub.MSVCR80.dll_sprintf
add esp, 0x10
push 0
lea ecx, [esp + 0x25c]
push ecx
call ebx
test eax, eax
jne 0x10002b47
push eax
mov eax, str.Could_not_find_the_BBE_Mind_Bender_directory._nProgram_FilesBBE_SoundBBE_Mind_Bender_n_nThe_BBE_Mind_Bender_may_not_be_installed_properly.
mov ecx, str.BBE_Sound_BBE_Mind_Bender
call fcn.10011040
add esp, 4
xor al, al
jmp 0x10002cef
push str.Plug_In_Settings
push str.BBE_Sound
lea edx, [esp + 0x160]
push edx
lea eax, [esp + 0x464]
push str._s_s_s
push eax
call sub.MSVCR80.dll_sprintf
add esp, 0x14
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x45c]
push edx
call edi
cmp eax, 0xffffffff
jne 0x10002bb9
push str.Plug_In_Settings
push str.BBE_Sound
lea eax, [esp + 0x160]
push eax
lea ecx, [esp + 0x264]
push 0x1005d718
push ecx
call sub.MSVCR80.dll_sprintf
add esp, 0x14
push 0
lea edx, [esp + 0x25c]
push edx
call ebx
test eax, eax
je 0x10002b40
push esi
push str.Plug_In_Settings
push str.BBE_Sound
lea eax, [esp + 0x164]
push eax
lea ecx, [esp + 0x368]
push str._s_s_s_s
push ecx
call sub.MSVCR80.dll_sprintf
add esp, 0x18
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x35c]
push eax
call edi
cmp eax, 0xffffffff
jne 0x10002c31
push esi
push str.Plug_In_Settings
push str.BBE_Sound
lea ecx, [esp + 0x164]
push ecx
lea edx, [esp + 0x268]
push 0x1005d6fc
push edx
call sub.MSVCR80.dll_sprintf
add esp, 0x18
push 0
lea eax, [esp + 0x25c]
push eax
call ebx
test eax, eax
je 0x10002b40
push str.00_User_Presets
push esi
push str.Plug_In_Settings
push str.BBE_Sound
lea ecx, [esp + 0x168]
push ecx
lea edx, [esp + 0x36c]
push str._s_s_s_s_s
push edx
call sub.MSVCR80.dll_sprintf
add esp, 0x1c
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x35c]
push ecx
call edi
mov edi, eax
cmp edi, 0xffffffff
jne 0x10002cb5
push str.00_User_Presets
push esi
push str.Plug_In_Settings
push str.BBE_Sound
lea edx, [esp + 0x168]
push edx
lea eax, [esp + 0x26c]
push 0x1005d6c8
push eax
call sub.MSVCR80.dll_sprintf
add esp, 0x1c
push 0
lea ecx, [esp + 0x25c]
push ecx
call ebx
test eax, eax
je 0x10002b40
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push str.Plug_In_Settings
push str.BBE_Sound
lea eax, [esp + 0x164]
push eax
push str._s_s_s_s_
push pe_nt_image_headers32
push ebp
call sub.MSVCR80.dll__snprintf
add esp, 0x1c
mov al, 1
mov ecx, dword [esp + 0x658]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1005a96e
add esp, 0x64c
ret 8