Function at 0x10001f90
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x214
mov ax, word [0x1000b448]
push esi
push edi
mov word [esp + 0x14], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
rep stosd dword es:[edi], eax
push str.Program_Manager
push str.Progman
stosw word es:[edi], ax
call esi
mov eax, dword [esp + 0x224]
sub eax, 0
je 0x100021c3
dec eax
jne 0x100021f7
mov eax, dword [esp + 0x220]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
push 0x1000bf94
push eax
mov dword [0x1000c3a4], eax
call esi
push 0x104
push 0x1000bd8c
push 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x1000bf94
push 0x1000c19c
call edi
push 0x1000bf94
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x208
push ecx
push 0x1000bb84
push 0
push str.Directory
push str.SoftwareFeiteng5
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 0x1000bb84
call dword [sym.imp.MSVCRT.dll__wcslwr]
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.10002fb0
add esp, 0xc
push 0x1000bb84
push 0x1000b97c
call edi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x100090d8
push 0x1000b97c
call esi
lea eax, [esp + 0x14]
push eax
push 0x1000b97c
call esi
push 0x100090d8
push 0x1000b97c
call esi
push str.cfg.ini
push 0x1000b97c
call esi
push 0x1000bd8c
push 0x1000b97c
push str._ftlive.dll__cfg_ini_path_s__exe_s_n
call fcn.10001880
add esp, 0xc
push 0x1000bd8c
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x100020f1
push str.QQ.exe
push eax
call dword [sym.imp.MSVCRT.dll__wcsicmp]
add esp, 8
test eax, eax
jne 0x100020f1
pop edi
pop esi
add esp, 0x214
ret 0xc
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x10002150
lea edx, [esp + 0xc]
push edx
push 5
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x10002146
mov eax, dword [esp + 0xc]
push 0x1000b774
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push str._feiteng5
push 0x1000b774
call esi
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 0x1000b774
push 0x1000b56c
call edi
push 0x100090d8
push 0x1000b56c
call esi
push str.ita.log
push 0x1000b56c
call esi
mov al, byte [0x1000b568]
test al, 1
jne 0x1000219f
mov dl, al
mov ecx, 0x1000b564
or dl, 1
mov byte [0x1000b568], dl
call fcn.100051a0
push 0x10002210
call fcn.100069ae
add esp, 4
push 0x1000bd8c
call fcn.10002220
add esp, 4
push 0x1000cd18
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x1000bd8c
push str._ftlive.dll__Process_Attach_ftlive.dll___s.
jmp 0x100021ef
push str.FTLiveWindow
push str.FTLiveWndClass
call esi
test eax, eax
je 0x100021da
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0x1000cd18
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x1000bd8c
push str._ftlive.dll__Process_Detach_ftlive.dll___s.
call fcn.10001880
add esp, 8
pop edi
mov eax, 1
pop esi
add esp, 0x214
ret 0xc