Function at 0x1010528
Capabilities:
Delete file
Delete registry key
Delete registry value
Get common file path
Get file attributes
Query environment variable
Query or enumerate registry key
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x102a0ec]
push ebx
push esi
xor esi, esi
push edi
push esi
push esi
push 2
push 5
mov dword [ebp - 4], eax
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x624], esi
mov dword [ebp - 0x638], esi
mov dword [ebp - 0x628], esi
mov dword [ebp - 0x630], 1
mov dword [ebp - 0x63c], esi
call fcn.01018dae
test eax, eax
mov edi, 0x104
je 0x10107a2
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x634], esi
mov dword [ebp - 0x62c], esi
call fcn.010190e9
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
je 0x101069a
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push 0x1002570
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
test eax, eax
jl 0x101069a
lea eax, [ebp - 0x20c]
push eax
call fcn.01016f8a
test eax, eax
je 0x101069a
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01017285
test eax, eax
jl 0x101069a
mov eax, dword [ebp - 0x634]
shr eax, 0x10
cmp ax, 9
jae 0x101069a
lea eax, [ebp - 0x20c]
push eax
call ebx
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x101069a
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push 0x1004e00
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
test eax, eax
jl 0x101069a
lea eax, [ebp - 0x20c]
push eax
call fcn.01016f8a
test eax, eax
je 0x101069a
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01017285
test eax, eax
jl 0x101069a
mov eax, dword [ebp - 0x634]
shr eax, 0x10
cmp ax, 9
jae 0x101069a
lea eax, [ebp - 0x20c]
push eax
call ebx
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010190e9
test eax, eax
je 0x10107a2
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push 0x1001cf0
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
test eax, eax
jl 0x10107a2
lea eax, [ebp - 0x20c]
push eax
call fcn.01016f8a
test eax, eax
je 0x10107a2
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01017285
test eax, eax
jl 0x10107a2
mov eax, dword [ebp - 0x634]
shr eax, 0x10
cmp ax, 9
jae 0x10107a2
lea eax, [ebp - 0x20c]
push eax
call ebx
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10107a2
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push 0x1004dd4
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
test eax, eax
jl 0x10107a2
lea eax, [ebp - 0x20c]
push eax
call fcn.01016f8a
test eax, eax
je 0x10107a2
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01017285
test eax, eax
jl 0x10107a2
mov eax, dword [ebp - 0x634]
shr eax, 0x10
cmp ax, 9
jae 0x10107a2
lea eax, [ebp - 0x20c]
push eax
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
push 0x1004d70
push 0x80000000
call edi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x10108ec
lea eax, [ebp - 0x624]
push eax
push 0x20019
push esi
push 0x1004d20
push dword [ebp - 0x620]
call edi
test eax, eax
jne 0x1010855
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x630]
push eax
push esi
push 0x1004d04
push dword [ebp - 0x624]
mov dword [ebp - 0x628], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101082b
cmp dword [ebp - 0x630], 1
je 0x1010835
mov dword [ebp - 0x638], 1
push dword [ebp - 0x624]
call ebx
cmp dword [ebp - 0x638], esi
je 0x1010855
push 0x1004d20
push dword [ebp - 0x620]
call fcn.01017d6c
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x62c], esi
mov dword [ebp - 0x628], 0x104
push esi
jmp 0x10108d4
inc dword [ebp - 0x62c]
lea eax, [ebp - 0x624]
push eax
push 2
push esi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x620]
mov dword [ebp - 0x628], 0x104
call edi
test eax, eax
jne 0x10108bc
push esi
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x624]
call ebx
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x62c]
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x101087a
push dword [ebp - 0x620]
call ebx
push esi
lea eax, [ebp - 0x620]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1004c48
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1010995
push 0x1004bf8
mov dword [ebp - 0x62c], 0x600000
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1004bf8
push 1
push esi
push 0x100158c
push dword [ebp - 0x620]
push esi
call fcn.01017e70
push 0x1004bcc
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1004bcc
push 1
push esi
push 0x1004bb0
push dword [ebp - 0x620]
push esi
call fcn.01017e70
push 4
lea eax, [ebp - 0x62c]
push eax
push 4
push esi
push 0x1004ba4
push dword [ebp - 0x620]
push esi
call fcn.01017e70
push dword [ebp - 0x620]
call ebx
lea eax, [ebp - 0x620]
push eax
push 2
push esi
push 0x1004b18
push 0x80000002
call edi
test eax, eax
jne 0x10109c8
push 0x1004b08
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x620]
call ebx
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
push 0x1004b08
push 0x80000000
call edi
test eax, eax
jne 0x1010a69
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x630]
push eax
push esi
push esi
push dword [ebp - 0x620]
mov dword [ebp - 0x628], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1010a61
cmp dword [ebp - 0x630], 1
jne 0x1010a61
lea eax, [ebp - 0x414]
push 0x1004af4
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
pop ecx
pop ecx
jne 0x1010a61
push 0x1004ae0
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1004ae0
push 1
push esi
push esi
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x620]
call ebx
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
push 0x1004a70
push 0x80000002
call edi
test eax, eax
jne 0x1010ba1
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x628], 0x104
mov dword [ebp - 0x634], esi
push esi
jmp 0x1010b85
inc dword [ebp - 0x634]
lea eax, [ebp - 0x62c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x620]
mov dword [ebp - 0x62c], esi
mov dword [ebp - 0x638], esi
mov dword [ebp - 0x628], 0x104
call edi
test eax, eax
jne 0x1010b6d
lea eax, [ebp - 0x640]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x630]
push eax
push esi
push 0x1004a5c
push dword [ebp - 0x62c]
mov dword [ebp - 0x640], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1010b45
cmp dword [ebp - 0x630], 1
jne 0x1010b45
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x638], eax
push dword [ebp - 0x62c]
call ebx
cmp dword [ebp - 0x638], esi
je 0x1010b6d
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x620]
call fcn.01017d6c
dec dword [ebp - 0x634]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x634]
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1010ab2
push dword [ebp - 0x620]
call ebx
lea eax, [ebp - 0x620]
push eax
push 3
push esi
push 0x1003488
push 0x80000001
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x624], esi
call edi
test eax, eax
jne 0x1010c0d
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x630]
push eax
push esi
push 0x1004a48
push dword [ebp - 0x620]
mov dword [ebp - 0x628], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1010c13
inc eax
cmp dword [ebp - 0x630], eax
jne 0x1010c13
mov dword [ebp - 0x63c], eax
jmp 0x1010c13
mov dword [ebp - 0x620], esi
lea eax, [ebp - 0x624]
push eax
push 3
push esi
push 0x10022a0
push 0x80000002
call edi
test eax, eax
jne 0x1010cbb
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x630]
push eax
push esi
push 0x1002288
push dword [ebp - 0x624]
mov dword [ebp - 0x628], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1010c75
cmp dword [ebp - 0x630], 1
jne 0x1010c75
inc dword [ebp - 0x63c]
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x630]
push eax
push esi
push 0x1004a2c
push dword [ebp - 0x624]
mov dword [ebp - 0x628], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1010cc1
cmp dword [ebp - 0x630], 1
jne 0x1010cc1
inc dword [ebp - 0x63c]
jmp 0x1010cc1
mov dword [ebp - 0x624], esi
cmp dword [ebp - 0x63c], esi
mov dword [ebp - 0x638], esi
jle 0x1010ce2
cmp dword [ebp - 0x63c], 3
jge 0x1010ce2
mov dword [ebp - 0x638], 1
cmp dword [ebp - 0x624], esi
je 0x1010d1c
cmp dword [ebp - 0x638], esi
je 0x1010d14
push 0x1002288
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x1004a2c
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x624]
call ebx
cmp dword [ebp - 0x620], esi
je 0x1010d45
cmp dword [ebp - 0x638], esi
je 0x1010d3d
push 0x1004a18
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x620]
call ebx
push esi
push esi
push esi
push 5
call fcn.01018dae
test eax, eax
je 0x1010de6
push esi
push esi
push 1
push 5
call fcn.01018dae
test eax, eax
je 0x1010d76
push esi
push 0x10049a0
push 0x80000000
call fcn.0100ce5c
push esi
push 0x1004928
push 0x80000000
call fcn.0100ce5c
push esi
push 0x10048b0
push 0x80000000
call fcn.0100ce5c
push esi
push 0x1004838
push 0x80000000
call fcn.0100ce5c
push esi
push 0x10047c0
push 0x80000000
call fcn.0100ce5c
push esi
push 0x1004748
push 0x80000000
call fcn.0100ce5c
push esi
push 0x10046d0
push 0x80000000
call fcn.0100ce5c
push esi
push 0x1004658
push 0x80000000
call fcn.0100ce5c
push 0x104
lea eax, [ebp - 0x414]
push eax
push dword [0x102a024]
push 0x100464c
push 0x100462c
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
test eax, eax
je 0x1010e89
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
lea eax, [ebp - 0x414]
mov dword [esp], 0x1004620
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x1010e89
push 0x104
lea eax, [ebp - 0x414]
push eax
push dword [0x102a024]
push 0x1004618
push 0x100462c
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
test eax, eax
je 0x1010e89
lea eax, [ebp - 0x414]
push eax
push dword [0x102a024]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1010e89
lea eax, [ebp - 0x414]
push eax
push 0x100464c
push 0x100462c
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x70
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1010fa2
push 0x103
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x1010fa2
push 0x10045f8
push 0x104
lea eax, [ebp - 0x61c]
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x61c]
push eax
call fcn.01016f8a
test eax, eax
je 0x1010fa2
lea eax, [ebp - 0x61c]
push eax
push 0x104
lea eax, [ebp - 0x414]
push eax
push dword [0x102a024]
push 0x10045d8
push 0x10045c8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x1010fa2
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1010fa2
push 0x10045c4
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.0100c535
push 0x104
lea eax, [ebp - 0x20a]
push eax
push 0x76
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1010fa2
push 0x10045c4
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x10045d8
push 0x10045c8
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 1
push 0x10045b0
call fcn.0101b328
lea eax, [ebp - 0x620]
push eax
push 0x20006
push esi
push 0x1004560
push 0x80000002
call edi
test eax, eax
jne 0x1011062
push 0x1004540
push dword [ebp - 0x620]
call fcn.01017d6c
push 0x1004520
push dword [ebp - 0x620]
call fcn.01017d6c
push 0x1004500
push dword [ebp - 0x620]
call fcn.01017d6c
push 0x10044c8
push dword [ebp - 0x620]
call fcn.01017d6c
push 0x10044bc
call fcn.0101e485
test eax, eax
je 0x101105a
push esi
push 0x100449c
call fcn.01027b54
push 0x1004490
push 0x1002668
push 0x1004480
push 0x10044bc
call fcn.0101f74d
push 0x1004490
push 0x1002668
push 0x1004480
push 0x1004478
call fcn.0101f74d
push dword [ebp - 0x620]
call ebx
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
push 0x1004428
push 0x80000002
call edi
test eax, eax
jne 0x1011196
lea eax, [ebp - 0x62c]
push eax
push 0x20019
push esi
push 0x1004408
push dword [ebp - 0x620]
mov dword [ebp - 0x62c], esi
call edi
test eax, eax
jne 0x10110f7
push dword [ebp - 0x62c]
call ebx
push 1
push 0x10043f0
call fcn.01027b54
push 1
push 0x10043d4
call fcn.01027b54
push 0x1004408
push dword [ebp - 0x620]
call fcn.01017d6c
push 0x10043a4
push dword [ebp - 0x620]
call fcn.01017d6c
push 0x1004370
push dword [ebp - 0x620]
call fcn.01017d6c
lea eax, [ebp - 0x62c]
push eax
push 0x20019
push esi
push 0x1004330
push dword [ebp - 0x620]
call edi
test eax, eax
jne 0x1011139
push dword [ebp - 0x62c]
call ebx
push 1
push 0x1004300
call fcn.01027b54
push 0x1004330
push dword [ebp - 0x620]
call fcn.01017d6c
push 0x1004490
push 0x1002570
push 0x10042f0
push 0x10042e4
call fcn.0101f74d
push 1
push 0x10042cc
call fcn.01027b54
push 0x10042ac
push dword [ebp - 0x620]
call fcn.01017d6c
push 0x100427c
push dword [ebp - 0x620]
call fcn.01017d6c
push 0x1004258
push dword [ebp - 0x620]
call fcn.01017d6c
push dword [ebp - 0x620]
call ebx
lea eax, [ebp - 0x620]
push eax
push 2
push esi
push 0x100424c
push 0x80000000
call edi
test eax, eax
jne 0x10111c9
push 0x1004230
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x620]
call ebx
lea eax, [ebp - 0x620]
push eax
push 0x2001b
push esi
push 0x10041c0
push 0x80000002
call edi
test eax, eax
jne 0x10112e4
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x84
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x10112dc
lea eax, [ebp - 0x624]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x620]
call edi
test eax, eax
jne 0x1011267
push dword [ebp - 0x624]
call ebx
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x83
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x86
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x624]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x620]
call edi
test eax, eax
jne 0x10112dc
push dword [ebp - 0x624]
call ebx
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x85
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0x620]
call ebx
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
push 0x1004160
push 0x80000000
call edi
test eax, eax
jne 0x1011405
lea eax, [ebp - 0x624]
push eax
push 0x20019
push esi
push 0x100413c
push dword [ebp - 0x620]
mov dword [ebp - 0x638], 1
call edi
test eax, eax
jne 0x10113dd
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x630]
push eax
push esi
push esi
push dword [ebp - 0x624]
xor edi, edi
inc edi
mov dword [ebp - 0x630], edi
mov dword [ebp - 0x628], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10113cb
cmp dword [ebp - 0x630], edi
je 0x101137c
cmp dword [ebp - 0x630], 2
jne 0x10113cb
cmp dword [ebp - 0x630], 2
jne 0x10113b6
lea eax, [ebp - 0x414]
push eax
push 0x103
lea eax, [ebp - 0x61c]
push eax
call fcn.0100c535
push 0x104
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x414]
push eax
call fcn.01016f8a
mov edi, eax
neg edi
sbb edi, edi
inc edi
jmp 0x10113d1
mov edi, dword [ebp - 0x638]
push dword [ebp - 0x624]
call ebx
cmp edi, esi
je 0x10113fd
mov edi, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push 0x1004130
push dword [ebp - 0x620]
call edi
push 0x1004124
push dword [ebp - 0x620]
call edi
push dword [ebp - 0x620]
call ebx
push esi
lea eax, [ebp - 0x620]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x10040f0
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
jne 0x1011457
push 0x10040a0
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x10040a0
push 1
push esi
push esi
push dword [ebp - 0x620]
push esi
call fcn.01017e70
push dword [ebp - 0x620]
call ebx
push esi
lea eax, [ebp - 0x620]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1004068
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10114a3
push 0x1004018
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1004018
push 1
push esi
push esi
push dword [ebp - 0x620]
push esi
call fcn.01017e70
push dword [ebp - 0x620]
call ebx
push esi
lea eax, [ebp - 0x620]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1003fe8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10114ef
push 0x1003f98
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003f98
push 1
push esi
push esi
push dword [ebp - 0x620]
push esi
call fcn.01017e70
push dword [ebp - 0x620]
call ebx
push esi
lea eax, [ebp - 0x620]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1003f68
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x101153b
push 0x1003f18
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003f18
push 1
push esi
push esi
push dword [ebp - 0x620]
push esi
call fcn.01017e70
push dword [ebp - 0x620]
call ebx
push esi
lea eax, [ebp - 0x620]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1003ee8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1011587
push 0x1003f98
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003f98
push 1
push esi
push esi
push dword [ebp - 0x620]
push esi
call fcn.01017e70
push dword [ebp - 0x620]
call ebx
push esi
lea eax, [ebp - 0x620]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1003eb4
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10115d3
push 0x1003f18
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003f18
push 1
push esi
push esi
push dword [ebp - 0x620]
push esi
call fcn.01017e70
push dword [ebp - 0x620]
call ebx
push esi
lea eax, [ebp - 0x620]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1003e80
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x101161f
push 0x1003f98
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003f98
push 1
push esi
push esi
push dword [ebp - 0x620]
push esi
call fcn.01017e70
push dword [ebp - 0x620]
call ebx
push esi
call fcn.0101001a
call fcn.0100d7ad
call fcn.0100feb4
mov edi, 0x104
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010190e9
test eax, eax
je 0x101167c
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push 0x1002570
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
push esi
lea eax, [ebp - 0x20c]
push eax
push 0x2005
push 0x2000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101672d
leave
ret