Function at 0x1029e380
Capabilities:
Create directory
Move file
Print debug messages
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
test ecx, ecx
js 0x1029e581
test ecx, 0x10000000
jne 0x1029e3e5
movzx eax, cl
mov dword [edi + 8], eax
mov eax, ecx
shr eax, 0xe
and al, 1
mov byte [edi + 0x11], al
jne 0x1029e3c8
test ecx, 0x2000
jne 0x1029e3c8
xor al, al
jmp 0x1029e3ca
mov al, 1
mov byte [edi + 0x10], al
mov eax, ecx
shr eax, 0xf
and al, 1
shr ecx, 0x10
and cl, 1
mov byte [edi + 0x12], al
mov byte [edi + 0x13], cl
jmp 0x1029e4d5
push 0x103
lea eax, [ebp - 0x218]
push 0x10455e60
push eax
call fcn.1043c460
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0xc
xor eax, eax
mov word [ebp - 0x12], ax
mov dword [ebp - 0x824], eax
lea eax, [ebp - 0x824]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x218]
push eax
push 0x80000002
call esi
cmp eax, 2
jne 0x1029e44d
lea eax, [ebp - 0x824]
push eax
push 0x20219
push 0
lea eax, [ebp - 0x218]
push eax
push 0x80000002
call esi
test eax, eax
jne 0x1029e4d5
mov dword [ebp - 0x830], eax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x830]
mov dword [ebp - 0x828], 4
push eax
push 0
push 0
push 0x10455ec0
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1029e4c9
mov ecx, dword [ebp - 0x830]
movzx eax, cl
mov dword [edi + 8], eax
mov eax, ecx
shr eax, 0xe
and al, 1
mov byte [edi + 0x11], al
jne 0x1029e4b0
test ecx, 0x2000
jne 0x1029e4b0
xor al, al
jmp 0x1029e4b2
mov al, 1
mov byte [edi + 0x10], al
test ecx, 0x80000000
mov eax, dword [edi + 8]
mov ecx, 0xffffffff
cmovne eax, ecx
mov dword [edi + 8], eax
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [edi + 8], 0xffffffff
je 0x1029e581
cmp dword [edi + 4], 0
jne 0x1029e6c8
cmp byte [edi + 0x11], 0
jne 0x1029e6b3
push 0x104
lea eax, [ebp - 0x420]
push eax
push 0x10455ee0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1029e52c
call esi
cmp eax, 0xb7
jne 0x1029e57a
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.10434250
push 0x10455f30
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.1043432c
add esp, 0x18
lea eax, [ebp - 0x218]
mov ecx, edi
push eax
call fcn.1029df70
test eax, eax
jne 0x1029e598
push 0x10455f50
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov dword [edi + 8], 0xffffffff
pop edi
mov eax, 0x80004005
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret 4
push 0x40
lea eax, [ebp - 0x218]
push 0x10455fa0
push eax
call fcn.10434f00
add esp, 0xc
mov dword [edi + 4], eax
test eax, eax
je 0x1029e661
push eax
call fcn.1043f574
push eax
call fcn.1043f6e1
add esp, 8
test edx, edx
jl 0x1029e661
jg 0x1029e5dd
cmp eax, 0x1000000
jb 0x1029e661
push dword [edi + 4]
call fcn.10434d63
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x820]
push 0x104
push eax
call fcn.10434250
push 0x10455fb0
lea eax, [ebp - 0x820]
push 0x104
push eax
call fcn.1043432c
add esp, 0x1c
lea eax, [ebp - 0x820]
mov ecx, edi
push eax
call fcn.1029df70
test eax, eax
jne 0x1029e632
push 0x10455fe0
jmp 0x1029e574
push 1
lea eax, [ebp - 0x820]
push eax
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 0x40
lea eax, [ebp - 0x218]
push 0x10455fa0
push eax
call fcn.10434f00
add esp, 0xc
mov dword [edi + 4], eax
cmp dword [edi + 4], 0
je 0x1029e68d
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x10456030
call esi
lea eax, [ebp - 0x218]
push eax
call esi
push 0x10456050
call esi
push 0x10456060
call esi
jmp 0x1029e6b3
call esi
push eax
push 0x10456120
lea eax, [ebp - 0x4e8]
push 0x64
push eax
call fcn.10238bf0
add esp, 0x10
lea eax, [ebp - 0x4e8]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [edi + 4], 0
jne 0x1029e6c8
cmp byte [edi + 0x10], 0
lea eax, [edi + 0x10]
je 0x1029e816
jmp 0x1029e6cb
lea eax, [edi + 0x10]
cmp byte [edi + 0x12], 0
mov esi, eax
je 0x1029e734
push 0x112370e0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea eax, [ebp - 0x82c]
xorps xmm0, xmm0
push eax
movlpd qword [ebp - 0x82c], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 0x828]
mov ecx, dword [ebp - 0x82c]
call fcn.104511a0
mov edx, dword [0x112370e4]
mov ecx, dword [0x112370e0]
movsd qword [ebp - 0x82c], xmm0
call fcn.104511a0
movsd xmm1, qword [ebp - 0x82c]
divsd xmm1, xmm0
movsd qword [0x11cd7308], xmm1
push 0
call fcn.1043f256
mov dword [ebp - 0x834], eax
mov ax, word [0x10454460]
mov word [ebp - 0x10], ax
mov al, byte [0x10454462]
mov byte [ebp - 0xe], al
xor eax, eax
mov dword [ebp - 0xd], eax
mov word [ebp - 9], ax
mov byte [ebp - 7], al
lea eax, [ebp - 0x834]
push eax
mov dword [ebp - 0x830], edx
call fcn.1043f54d
push eax
call fcn.1043f8fd
push eax
lea eax, [ebp - 0x10]
push eax
push dword [edi + 0xc]
push 0x10456180
push 0x800
push 0x11cd6b00
call fcn.100da4c0
add esp, 0x24
cmp byte [esi], 0
je 0x1029e7a6
push 0x11cd6b00
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [edi + 4]
test eax, eax
je 0x1029e7c3
push 0x11cd6b00
push eax
call fcn.1029e850
push dword [edi + 4]
call fcn.10439c5c
add esp, 0xc
mov ecx, dword [edi + 8]
mov eax, esi
cmp ecx, 2
jl 0x1029e816
push ecx
push 0x104561c0
push 0x800
push 0x11cd6b00
call fcn.100da4c0
add esp, 0x10
cmp byte [esi], 0
je 0x1029e7f5
push 0x11cd6b00
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [edi + 4]
mov eax, esi
test ecx, ecx
je 0x1029e816
push 0x11cd6b00
push ecx
call fcn.1029e850
push dword [edi + 4]
call fcn.10439c5c
add esp, 0xc
mov eax, esi
cmp dword [edi + 4], 0
jne 0x1029e828
cmp byte [eax], 0
jne 0x1029e828
mov dword [edi + 8], 0xffffffff
mov eax, dword [edi + 8]
mov ecx, dword [ebp - 4]
sar eax, 0x1f
xor ecx, ebp
pop edi
and eax, 0x80004005
pop esi
call fcn.1045066c
mov esp, ebp
pop ebp
ret 4