Function at 0x100ea71
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x102e0fc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov dword [ebp - 0x428], eax
xor ebx, ebx
lea eax, [ebp - 0x434]
xor edi, edi
inc ebx
push eax
mov dword [ebp - 0x434], edi
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x438], ebx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
cmp eax, edi
mov dword [ebp - 0x420], eax
jl 0x100f041
push esi
mov dword [ebp - 0x41c], edi
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x424], edi
mov dword [ebp - 0x430], edi
call fcn.0100e897
test eax, eax
mov esi, 0x104
je 0x100ec86
lea eax, [ebp - 0x424]
push eax
push ebx
push edi
push 0x1001838
push 0x80000002
call fcn.0102b456
test eax, eax
jne 0x100eb7e
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x438]
push eax
push edi
push 0x1002aa8
push dword [ebp - 0x424]
mov dword [ebp - 0x430], 0x208
call fcn.0102b674
test eax, eax
jne 0x100eb66
cmp dword [ebp - 0x438], ebx
jne 0x100eb66
lea eax, [ebp - 0x20c]
push eax
call fcn.01016d15
test eax, eax
je 0x100eb66
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x42c], ebx
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x418], edi
jne 0x100edbc
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102bcd1
test eax, eax
je 0x100ebb5
push 0x1002a18
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d5b3
lea eax, [ebp - 0x20c]
push eax
call fcn.01016d15
test eax, eax
jne 0x100ec75
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102bcd1
test eax, eax
je 0x100ec36
lea eax, [ebp - 0x20c]
push eax
call fcn.0101690b
push esi
lea eax, [ebp - 0x414]
push eax
push 0x9f
push dword [0x102efb0]
call fcn.0102ae77
test eax, eax
je 0x100ec36
push 0x1002a00
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d5b3
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d5b3
push 0x10029a8
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d5b3
lea eax, [ebp - 0x20c]
push eax
call fcn.01016d15
test eax, eax
jne 0x100ec75
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102bcd1
test eax, eax
je 0x100ec86
lea eax, [ebp - 0x20c]
push eax
call fcn.0101690b
push 0x100297c
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d5b3
lea eax, [ebp - 0x20c]
push eax
call fcn.01016d15
test eax, eax
je 0x100ec86
mov dword [ebp - 0x428], ebx
mov dword [ebp - 0x42c], ebx
jmp 0x100edb6
lea eax, [ebp - 0x41c]
push eax
push 0x802e
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, edi
mov dword [ebp - 0x420], eax
jl 0x100ecc9
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x41c]
call fcn.0102bc3c
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x41c], edi
je 0x100ece9
mov eax, dword [ebp - 0x434]
push dword [ebp - 0x41c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x41c], edi
cmp dword [ebp - 0x420], 0x80070057
jne 0x100ed80
lea eax, [ebp - 0x424]
push eax
push ebx
push edi
push 0x10028f8
push 0x80000002
call fcn.0102b456
test eax, eax
jne 0x100edbc
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x438]
push eax
push edi
push 0x10028d0
push dword [ebp - 0x424]
mov dword [ebp - 0x430], 0x208
call fcn.0102b674
test eax, eax
jne 0x100ed74
cmp dword [ebp - 0x438], ebx
jne 0x100ed74
cmp word [ebp - 0x20c], di
je 0x100ed74
lea eax, [ebp - 0x20c]
push eax
call fcn.01016ca8
test eax, eax
je 0x100ed74
mov dword [ebp - 0x420], edi
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x420], edi
jl 0x100edbc
lea eax, [ebp - 0x20c]
push eax
call fcn.0101690b
push 0x1002878
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d5b3
lea eax, [ebp - 0x20c]
push eax
call fcn.01016d15
test eax, eax
je 0x100edbc
mov dword [ebp - 0x418], ebx
lea eax, [ebp - 0x41c]
push eax
push 0x23
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, edi
mov dword [ebp - 0x420], eax
jl 0x100ef35
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x41c]
call fcn.0102bc3c
test eax, eax
je 0x100f055
lea eax, [ebp - 0x414]
push eax
call fcn.0101690b
push 0x1002864
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0100d5b3
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.0102a481
push 0x1002848
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0100d5b3
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.0102a481
mov ebx, 0x1002820
push ebx
push 1
lea eax, [ebp - 0x414]
push eax
call fcn.0100c8cd
push 0x100297c
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0100d5b3
cmp dword [ebp - 0x418], edi
je 0x100ef32
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x100ef32
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0102b01b
cmp eax, edi
mov dword [ebp - 0x418], eax
jne 0x100eedb
cmp dword [ebp - 0x428], edi
je 0x100eedb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100eedb
push 3
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0102af73
mov dword [ebp - 0x418], eax
push ebx
push 1
lea eax, [ebp - 0x414]
push eax
call fcn.0100c8cd
cmp dword [ebp - 0x428], edi
je 0x100ef32
cmp dword [ebp - 0x418], edi
je 0x100ef32
lea eax, [ebp - 0x20c]
push eax
call fcn.0102a5a1
mov ebx, dword [sym.imp.msvcrt.dll_wcsrchr]
jmp 0x100ef21
mov word [eax], di
lea eax, [ebp - 0x20c]
push eax
call fcn.0102c1a3
test eax, eax
je 0x100ef32
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call ebx
cmp eax, edi
pop ecx
pop ecx
jne 0x100ef0e
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x41c], edi
je 0x100ef55
mov eax, dword [ebp - 0x434]
push dword [ebp - 0x41c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x41c], edi
mov eax, dword [ebp - 0x434]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x42c], edi
je 0x100f040
call fcn.010192d1
fcomp qword [0x10026a0]
fnstsw ax
test ah, 5
jp 0x100f040
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0102c0fe
test eax, eax
je 0x100efb4
push 0x1002804
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d5b3
push edi
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01019ab1
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.01018e47
test eax, eax
je 0x100f040
lea eax, [ebp - 0x20c]
push eax
call fcn.0101690b
push 0x1002654
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d5b3
lea eax, [ebp - 0x20c]
push eax
call fcn.01016d15
test eax, eax
je 0x100f040
call fcn.0100e00a
test eax, eax
je 0x100f040
lea eax, [ebp - 0x20c]
push eax
push 0x103
lea eax, [ebp - 0x414]
push eax
call fcn.0100c755
push 0x10027f0
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.0100d5b3
push 0xffff
push ebx
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0101876c
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x420]
pop edi
pop ebx
call fcn.01016306
leave
ret 4
mov dword [ebp - 0x420], 0x80004005
jmp 0x100ef35