Function at 0x101106b
Capabilities:
Check if file exists
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x838
mov eax, dword [0x102e1b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x102f244]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
mov ebx, 0x104
mov dword [ebp - 0x82c], edi
mov dword [ebp - 0x838], ebx
je 0x10111fe
cmp dword [eax], 3
jb 0x10111fe
lea eax, [ebp - 0x82c]
push eax
push 0x20019
push edi
push 0x1004840
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101142a
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x834]
push eax
push edi
push 0x1006014
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101142a
cmp dword [ebp - 0x834], 1
jne 0x101142a
lea eax, [ebp - 0x824]
push eax
push edi
push edi
push 0x23
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x101142a
push 0x1005fe4
push ebx
lea eax, [ebp - 0x824]
push eax
call fcn.0100ca7e
test eax, eax
jl 0x101142a
mov esi, dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0xffffffffffffffff
lea eax, [ebp - 0x824]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
push eax
push 1
push 0x800
call esi
push 2
pop ebx
cmp eax, ebx
je 0x101142a
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, ebx
cmp cx, di
jne 0x1011183
push 0xb
sub eax, edx
push 0x1005fcc
sar eax, 1
push 0xb
lea eax, [ebp + eax*2 - 0x222]
push eax
push 1
push 0x7f
call esi
cmp eax, ebx
jne 0x101142a
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov edi, 0x1005fc4
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x1011428
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x1011428
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x10111e8
sub eax, edx
sar eax, 1
cmp eax, 4
jmp 0x10113b6
lea eax, [ebp - 0x82c]
push eax
push 0x20019
push edi
push 0x1005f70
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101142a
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x834]
push eax
push edi
push 0x10049c8
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101142a
cmp dword [ebp - 0x834], 1
jne 0x101142a
lea eax, [ebp - 0x61c]
push eax
push edi
push edi
push 0x28
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x101142a
push 0x1005fc4
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x101142a
lea eax, [ebp - 0x61c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x101129c
mov esi, dword [sym.imp.KERNEL32.dll_CompareStringW]
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x61c]
push ecx
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
mov edi, 0x800
push edi
call esi
cmp eax, 2
je 0x1011428
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x830], 0x5c
call fcn.010170ea
test eax, eax
pop ecx
pop ecx
je 0x1011428
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
call fcn.0100e2f6
test eax, eax
jl 0x1011428
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
test eax, eax
je 0x1011428
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
je 0x1011428
mov byte [ebp - 0x825], 1
jmp 0x1011374
push 0xffffffffffffffff
push 0x1005f50
push 0xffffffffffffffff
push ebx
push 1
push edi
call esi
cmp eax, 2
je 0x101138f
push ebx
lea eax, [ebp - 0x414]
push eax
mov byte [ebp - 0x825], 0
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x1011428
lea eax, [ebp - 0x830]
push eax
push 0
call fcn.010170ea
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x1011343
jmp 0x1011428
cmp byte [ebp - 0x825], 0
jne 0x1011428
lea eax, [ebp - 0x414]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0100e2f6
test eax, eax
jl 0x1011428
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1011428
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10113d2
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.01016252
test eax, eax
pop ecx
mov dword [0x102f230], eax
je 0x1011428
lea ecx, [ebp - 0x20c]
push ecx
push esi
push eax
call fcn.0100e2f6
test eax, eax
jge 0x1011428
push dword [0x102f230]
call fcn.01016242
and dword [0x102f230], 0
pop ecx
xor edi, edi
cmp dword [ebp - 0x82c], edi
pop edi
pop esi
pop ebx
je 0x1011441
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010171cf
leave
ret