Function at 0x100ee66
Capabilities:
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1046080]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x218], ebx
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
mov esi, dword [sym.imp.SHLWAPI.dll_IsOS]
je 0x100eeef
push 0x17
call esi
test eax, eax
je 0x1023cab
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x234]
push eax
push 0x10106fc
push 0x1010698
mov edi, 0x80000002
push edi
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x238], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1023cc0
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
call fcn.0101183c
test al, al
jne 0x1023d8c
mov edi, dword [ebp - 0x218]
push 0x1f
call esi
test eax, eax
jne 0x100efd3
push 0x20
call esi
test eax, eax
jne 0x100efd3
push 0x17
call esi
test eax, eax
je 0x1023dcd
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x100efe4
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x230]
push eax
push ebx
push ebx
push edi
lea eax, [ebp - 0x20c]
push eax
call fcn.0101240b
test eax, eax
jl 0x100ef96
push 0xffffffffffffffff
push dword [ebp - 0x230]
call dword [sym.imp.SHLWAPI.dll_Ordinal_194]
push dword [ebp - 0x230]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x22c]
call esi
call fcn.0100ec69
test eax, eax
jne 0x100efb9
push ebx
push ebx
push 0x100ea64
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push eax
push dword [0x1046094]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010019ca
leave
ret
test eax, eax
jne 0x100eea6
jmp 0x100eeef
xor edi, edi
jmp 0x100ef28
test eax, eax
je 0x100ef96
jmp 0x100ef34
push 0x15
call esi
test eax, eax
jne 0x100eea6
push 0x16
call esi
jmp 0x100efc6
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x1023e2c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x230]
push eax
push ebx
push ebx
push 0x100ab04
lea eax, [ebp - 0x20c]
push eax
call fcn.0101240b
test eax, eax
jl 0x1023d2b
push 0xffffffffffffffff
push dword [ebp - 0x230]
call dword [sym.imp.SHLWAPI.dll_Ordinal_194]
push dword [ebp - 0x230]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x22c]
call edi
jmp 0x100eeef
lea eax, [ebp - 0x210]
push eax
push 0x1010698
push edi
mov dword [ebp - 0x210], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x100eeef
cmp dword [ebp - 0x210], ebx
je 0x100eeef
push 4
lea eax, [ebp - 0x220]
push eax
push 4
push ebx
push 0x10106fc
push dword [ebp - 0x210]
mov dword [ebp - 0x220], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100eeef
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x102aee8
push dword [ebp - 0x214]
call edi
test eax, eax
jne 0x1023dad
mov edi, 0x1023e14
jmp 0x100ef10
push 0x102aed4
push dword [ebp - 0x214]
call edi
mov edi, eax
neg edi
sbb edi, edi
not edi
and edi, 0x1023dfc
jmp 0x100ef10
push 0x15
call esi
test eax, eax
jne 0x100ef34
push 0x16
call esi
test eax, eax
jne 0x100ef34
push 0x20
call esi
test eax, eax
jne 0x100ef34
push 0x1f
call esi
jmp 0x100efda