Function at 0x1006852
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1474
call fcn.0100e440
mov eax, dword [0x10140d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x1460], ecx
xor ecx, ecx
mov ebx, 0x104
mov dword [ebp - 0x1468], eax
mov word [eax], cx
cmp dword [ebp + 0xc], ebx
jae 0x1006894
xor eax, eax
jmp 0x1006b1c
lea eax, [ebp - 0x145c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x100688d
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push edi
lea eax, [ebp - 0x1458]
push eax
xor edi, edi
push 0x23
push edi
mov dword [ebp - 0x1470], edi
call esi
test eax, eax
jl 0x10068fc
push dword [ebp - 0x1468]
push dword [ebp - 0x1458]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1006aee
mov eax, dword [ebp - 0x145c]
push dword [ebp - 0x1458]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x1458], edi
jmp 0x1006ac6
lea eax, [ebp - 0x1458]
push eax
push 0x1a
push edi
call esi
test eax, eax
lea eax, [ebp - 0x41c]
jl 0x1006941
push eax
push dword [ebp - 0x1458]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1006aee
mov eax, dword [ebp - 0x145c]
push dword [ebp - 0x1458]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x1458], edi
jmp 0x1006954
push ebx
push eax
push 0x1f5
push dword [ebp - 0x1460]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x1458]
push eax
push 0x19
push edi
mov dword [ebp - 0x1464], edi
call esi
test eax, eax
jl 0x10069af
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x1458]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x100698b
mov dword [ebp - 0x1464], 1
mov eax, dword [ebp - 0x145c]
push dword [ebp - 0x1458]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x1458], edi
cmp dword [ebp - 0x1464], edi
jne 0x1006a65
lea eax, [ebp - 0x1460]
push eax
push 0x20019
push edi
push 0x1001910
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1006a36
lea eax, [ebp - 0x146c]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x1474]
push eax
push edi
push 0x10018ec
push dword [ebp - 0x1460]
xor esi, esi
inc esi
mov dword [ebp - 0x146c], ebx
mov dword [ebp - 0x1474], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1006a22
mov eax, dword [ebp - 0x146c]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x210], cx
mov dword [ebp - 0x1464], esi
push dword [ebp - 0x1460]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1464], edi
jne 0x1006a65
push ebx
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1006a65
push 0x900
push edi
push edi
push 0x10018d8
push 0x106
lea eax, [ebp - 0x210]
push eax
call fcn.01011bb9
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x1454]
call fcn.0100f4f8
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0xc38]
call fcn.0100f4f8
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0x103e]
push eax
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0xa2e]
push eax
push 0x10018c4
push 0x900
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x1468]
call fcn.01011c3f
add esp, 0x28
test eax, eax
jl 0x1006aee
push 0x900
push edi
push edi
push 0x1001880
push dword [ebp + 0xc]
push dword [ebp - 0x1468]
call fcn.01011bb9
test eax, eax
jl 0x1006aee
mov dword [ebp - 0x1470], 1
cmp dword [ebp - 0x1458], edi
pop edi
pop esi
je 0x1006b0a
mov eax, dword [ebp - 0x145c]
push dword [ebp - 0x1458]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x145c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x1470]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0100e410
leave
ret 0xc