Function at 0x10292bb
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push 0x22c
mov eax, 0x1042b8b
call fcn.01001615
mov esi, 0x1029b78
push esi
push dword [0x1050b74]
push dword [0x1050b70]
call dword [0x1050b68]
test al, al
je 0x10292fd
push 0x1029b54
push esi
push dword [0x1050b74]
push dword [0x1050b70]
call fcn.0101ddc6
mov esi, 0x1002ebc
push esi
lea ecx, [ebp - 0x21c]
call fcn.01003615
and dword [ebp - 4], 0
push esi
lea ecx, [ebp - 0x228]
call fcn.01003615
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x238]
push eax
mov ebx, 0x20019
push ebx
push 0
push 0x1019330
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x220], 0x80004005
call esi
push eax
call fcn.0100b113
test eax, eax
jl 0x10295b6
lea eax, [ebp - 0x234]
push eax
push ebx
xor edi, edi
push edi
push 0x1029f08
push dword [ebp - 0x238]
call esi
push eax
call fcn.0100b113
test eax, eax
jl 0x1029573
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x224]
push eax
push 0x1029ee0
push edi
push dword [ebp - 0x234]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x22c], 0x208
mov dword [ebp - 0x224], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push eax
call fcn.0100b113
cmp eax, edi
mov dword [ebp - 0x220], eax
jl 0x1029567
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x21c]
call fcn.01003693
test byte [0x1050ddc], bl
jne 0x1029411
or dword [0x1050ddc], ebx
push 0x1029e80
mov ecx, 0x1050dd8
mov byte [ebp - 4], 2
call fcn.01003615
push 0x1047dbe
call fcn.0100fc8e
pop ecx
mov byte [ebp - 4], bl
mov eax, dword [0x1050dd8]
push dword [eax - 0xc]
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x21c]
call fcn.01009243
push dword [0x1050dd8]
mov esi, dword [ebp - 0x230]
push esi
mov byte [ebp - 4], 3
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x102954b
mov eax, dword [ebp - 0x21c]
mov eax, dword [eax - 0xc]
mov ecx, dword [0x1050dd8]
sub eax, dword [ecx - 0xc]
lea ecx, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0100977f
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 4
call fcn.0100523a
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.01002480
push ebx
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x21c]
call fcn.01009243
push 0x5c
push eax
call fcn.0100498c
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
mov bl, al
call fcn.01002480
test bl, bl
je 0x1029501
mov eax, dword [ebp - 0x21c]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0100977f
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 5
call fcn.0100523a
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
mov byte [ebp - 4], 3
call fcn.01002480
push 0x104
lea ecx, [ebp - 0x228]
call fcn.010034bd
push eax
push 1
push edi
push 0x23
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x220], eax
call fcn.0101c9ff
cmp dword [ebp - 0x220], edi
lea ecx, [ebp - 0x228]
jl 0x1029551
push 0x1029e5c
call fcn.0101cbaf
jmp 0x102955b
lea ecx, [ebp - 0x21c]
push 0x1002ebc
call fcn.01003693
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.01002480
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x21c]
cmp dword [eax - 0xc], edi
mov eax, dword [ebp - 0x228]
je 0x1029599
cmp dword [eax - 0xc], edi
jne 0x1029852
lea ecx, [eax - 0x10]
call fcn.01002480
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.01002480
xor eax, eax
jmp 0x1029b4e
lea eax, [ebp - 0x238]
push eax
push 1
xor ebx, ebx
push ebx
push 0x100af48
push edi
call esi
mov esi, eax
cmp esi, ebx
jne 0x1029643
push 4
pop eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x234], eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x234]
push eax
push 0x100b064
push ebx
push dword [ebp - 0x238]
mov dword [ebp - 0x224], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, eax
cmp esi, ebx
jne 0x102962c
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
jmp 0x102959c
cmp esi, 2
jne 0x1029633
xor esi, esi
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x102966a
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.01002480
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.01002480
push esi
call fcn.0100b113
jmp 0x1029b4e
push 0x104d19c
lea ecx, [ebp - 0x234]
call fcn.01003395
lea eax, [ebp - 0x234]
push eax
mov byte [ebp - 4], 6
call fcn.01028fbb
cmp eax, ebx
mov esi, dword [ebp - 0x234]
mov dword [ebp - 0x220], eax
jl 0x1029b24
cmp dword [esi - 0xc], ebx
je 0x1029b24
lea eax, [ebp - 0x21c]
push eax
push 0x1029ee0
push 0x1029d88
push esi
call fcn.0102818a
mov eax, dword [ebp - 0x21c]
cmp dword [eax - 0xc], ebx
jne 0x10296d6
lea ecx, [esi - 0x10]
call fcn.01002480
jmp 0x102961e
test byte [0x1050ddc], 2
jne 0x1029708
or dword [0x1050ddc], 2
push 0x1029d40
mov ecx, 0x1050dd4
mov byte [ebp - 4], 7
call fcn.01003615
push 0x1047dab
call fcn.0100fc8e
pop ecx
mov byte [ebp - 4], 6
mov eax, dword [0x1050dd4]
push dword [eax - 0xc]
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x21c]
call fcn.01009243
push dword [0x1050dd4]
mov edi, dword [ebp - 0x22c]
push edi
mov byte [ebp - 4], 8
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1029749
lea ecx, [edi - 0x10]
call fcn.01002480
jmp 0x10296c9
mov eax, dword [ebp - 0x21c]
mov eax, dword [eax - 0xc]
mov ecx, dword [0x1050dd4]
sub eax, dword [ecx - 0xc]
lea ecx, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
call fcn.0100977f
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 9
call fcn.0100523a
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
mov byte [ebp - 4], 8
call fcn.01002480
push 1
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x21c]
call fcn.01009243
push 0x5c
push eax
call fcn.0100498c
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
mov bl, al
call fcn.01002480
test bl, bl
je 0x10297ff
mov eax, dword [ebp - 0x21c]
mov eax, dword [eax - 0xc]
dec eax
push eax
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0100977f
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0xa
call fcn.0100523a
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
mov byte [ebp - 4], 8
call fcn.01002480
lea eax, [ebp - 0x228]
push eax
push 0x1029d24
push 0x1029ca0
push esi
call fcn.0102818a
mov eax, dword [ebp - 0x228]
cmp dword [eax - 0xc], 0
je 0x102973f
push 0x1029c6c
lea ecx, [ebp - 0x228]
call fcn.0101cbaf
lea ecx, [edi - 0x10]
call fcn.01002480
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 1
call fcn.01002480
mov eax, dword [ebp - 0x228]
xor edi, edi
push dword [ebp - 0x21c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1029b2c
push edi
push 0x1029c5c
lea ecx, [ebp - 0x21c]
call fcn.01009ab3
cmp eax, 0xffffffff
jne 0x1029899
push edi
push 0x1029c3c
lea ecx, [ebp - 0x21c]
call fcn.01009ab3
cmp eax, 0xffffffff
je 0x102961e
push eax
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x21c]
call fcn.0100977f
push dword [eax]
lea ecx, [ebp - 0x234]
mov byte [ebp - 4], 0xb
call fcn.01003615
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xd
call fcn.01002480
push 0x104d19c
lea ecx, [ebp - 0x230]
call fcn.01003395
push 0x104
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 0xe
call fcn.010034bd
push eax
push 1
push edi
push 0x23
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x220], eax
call fcn.0101c9ff
cmp dword [ebp - 0x220], edi
jl 0x1029b0b
mov eax, dword [ebp - 0x234]
cmp dword [eax - 0xc], edi
jle 0x1029b0b
mov eax, dword [ebp - 0x230]
cmp dword [eax - 0xc], edi
jle 0x1029b0b
push 0x1029c28
lea ecx, [ebp - 0x230]
call fcn.01027c64
push 0x100c810
lea ecx, [ebp - 0x22c]
call fcn.01003615
push 0x10032b8
lea ecx, [ebp - 0x224]
mov byte [ebp - 4], 0xf
call fcn.01003615
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x234]
push eax
mov byte [ebp - 4], 0x10
call fcn.01027ca9
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
mov dword [ebp - 0x220], eax
call fcn.01002480
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.01002480
cmp dword [ebp - 0x220], edi
jl 0x1029b0b
push 0x1018980
lea ecx, [ebp - 0x224]
call fcn.01003615
mov esi, 0x1029bc0
push esi
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 0x11
call fcn.01003615
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x234]
push eax
mov byte [ebp - 4], 0x12
call fcn.01027ca9
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
mov dword [ebp - 0x220], eax
call fcn.01002480
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.01002480
cmp dword [ebp - 0x220], edi
jl 0x1029b0b
push 0x1029ba8
lea ecx, [ebp - 0x224]
call fcn.01003615
push esi
lea ecx, [ebp - 0x22c]
mov byte [ebp - 4], 0x13
call fcn.01003615
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x234]
push eax
mov byte [ebp - 4], 0x14
call fcn.01027ca9
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
mov dword [ebp - 0x220], eax
call fcn.01002480
mov ecx, dword [ebp - 0x224]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xe
call fcn.01002480
cmp dword [ebp - 0x220], edi
jl 0x1029b0b
push 0x1029b98
lea ecx, [ebp - 0x230]
call fcn.01027c64
mov esi, 0x1029b88
push esi
push dword [0x1050b74]
push dword [0x1050b70]
call dword [0x1050b68]
test al, al
je 0x1029b00
push dword [ebp - 0x230]
push 0x1029b64
push esi
push dword [0x1050b74]
push dword [0x1050b70]
call fcn.010336ce
push dword [ebp - 0x230]
call fcn.01027845
mov ecx, dword [ebp - 0x230]
add ecx, 0xfffffff0
call fcn.01002480
mov ecx, dword [ebp - 0x234]
add ecx, 0xfffffff0
jmp 0x1029b27
lea ecx, [esi - 0x10]
call fcn.01002480
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.01002480
mov ecx, dword [ebp - 0x21c]
add ecx, 0xfffffff0
call fcn.01002480
mov eax, dword [ebp - 0x220]
call fcn.01001652
ret