Function at 0x1034dda
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa2c
mov eax, dword [0x10e607c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0xa10], eax
push edi
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x604]
xor esi, esi
push eax
mov dword [ebp - 0xa18], esi
mov dword [ebp - 0xa0c], 0x200
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
test eax, eax
mov ebx, dword [sym.imp.msvcrt.dll_wcslen]
je 0x1034eae
cmp word [ebp + 0xc], si
je 0x1034eae
lea eax, [ebp - 0x604]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
jne 0x1034e52
lea edi, [ebp - 0x604]
jmp 0x1034e54
inc edi
inc edi
push edi
call ebx
cmp word [edi], si
pop ecx
lea ecx, [eax + eax + 2]
mov eax, edi
je 0x1034e73
cmp word [eax], 0x5c
jne 0x1034e6c
mov word [eax], si
inc eax
inc eax
cmp word [eax], si
jne 0x1034e63
push 1
push 1
push 4
push 0x1004d10
push ecx
push edi
push 1
lea eax, [ebp - 0xa08]
push eax
call fcn.010927df
test ax, ax
jne 0x1034eae
mov eax, dword [ebp - 0xa08]
or byte [eax + 0x15], 2
push dword [ebp - 0xa08]
push dword [ebp - 0xa10]
call fcn.01092c9d
lea eax, [ebp - 0xa24]
push eax
push 1
push esi
push 0x1005be8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1035128
mov eax, 0x200
mov dword [ebp - 0xa28], eax
mov dword [ebp - 0xa0c], eax
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x604]
push eax
push esi
push esi
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0xa04]
push eax
push dword [ebp - 0xa18]
push dword [ebp - 0xa24]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
mov dword [ebp - 0xa2c], eax
jne 0x103510a
mov eax, dword [ebp - 0xa0c]
shr eax, 1
mov dword [ebp - 0xa0c], eax
mov word [ebp + eax*2 - 0x604], si
cmp eax, esi
je 0x103510a
dec eax
cmp word [ebp + eax*2 - 0x604], 0x5c
mov dword [ebp - 0xa0c], eax
jne 0x1034f35
cmp eax, esi
je 0x103510a
mov edi, dword [sym.imp.msvcrt.dll_wcschr]
add eax, eax
lea ecx, [ebp + eax - 0x602]
mov word [ebp + eax - 0x604], si
lea eax, [ebp - 0x604]
push 0x5c
push eax
mov dword [ebp - 0xa14], ecx
call edi
cmp eax, esi
pop ecx
pop ecx
je 0x103510a
add eax, 2
push 0x5c
push eax
call edi
cmp eax, esi
pop ecx
pop ecx
je 0x103510a
add eax, 2
push 0x5c
push eax
call edi
cmp eax, esi
pop ecx
pop ecx
je 0x103510a
lea edi, [eax + 2]
push edi
mov dword [ebp - 0xa1c], edi
call ebx
lea eax, [eax + eax + 2]
pop ecx
mov dword [ebp - 0xa20], eax
jmp 0x1034fd1
cmp word [edi], 0x5c
jne 0x1034fcf
mov word [edi], si
inc edi
inc edi
cmp word [edi], si
jne 0x1034fc6
push esi
push esi
push dword [ebp - 0xa14]
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0xa14]
xor eax, eax
cmp word [ebp + 0xc], si
push dword [ebp - 0xa20]
setne al
push dword [ebp - 0xa1c]
push eax
lea eax, [ebp - 0xa08]
push eax
call fcn.010927df
test ax, ax
jne 0x103502e
mov eax, dword [ebp - 0xa08]
or byte [eax + 0x15], 2
push dword [ebp - 0xa08]
push dword [ebp - 0xa10]
call fcn.01092c9d
push dword [ebp - 0xa14]
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x204]
push eax
call edi
lea eax, [ebp - 0x204]
push 0x1005bdc
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
push esi
lea eax, [ebp - 0x204]
push esi
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0xa20]
lea eax, [ebp - 0xa08]
push dword [ebp - 0xa1c]
push esi
push eax
call fcn.010927df
test ax, ax
jne 0x103509f
push dword [ebp - 0xa08]
push dword [ebp - 0xa10]
call fcn.01092c9d
push dword [ebp - 0xa14]
lea eax, [ebp - 0x204]
push eax
call edi
lea eax, [ebp - 0x204]
push 0x1005bd0
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
push esi
lea eax, [ebp - 0x204]
push esi
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0xa20]
lea eax, [ebp - 0xa08]
push dword [ebp - 0xa1c]
push esi
push eax
call fcn.010927df
test ax, ax
jne 0x103510a
push dword [ebp - 0xa08]
push dword [ebp - 0xa10]
call fcn.01092c9d
inc dword [ebp - 0xa18]
cmp dword [ebp - 0xa2c], esi
je 0x1034ed0
push dword [ebp - 0xa24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01078836
leave
ret 8