Function at 0x1029674
Capabilities:
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4a8
mov eax, dword [0x10723e4]
push esi
mov dword [ebp - 4], eax
call fcn.0103d656
call fcn.01029c3a
lea eax, [ebp - 0x46c]
push eax
call fcn.0101e3a2
xor esi, esi
test eax, eax
je 0x10296b2
lea eax, [ebp - 0x46c]
push eax
call fcn.0102cadb
jmp 0x10296b8
mov dword [ebp - 0x46c], esi
cmp dword [0x1073938], esi
jne 0x10296c8
xor eax, eax
inc eax
jmp 0x1029bfd
push ebx
push edi
push dword [0x10723d8]
push 0x1013010
call fcn.0103da11
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x464]
push eax
push 0x20019
push esi
push 0x1011048
mov ebx, 0x80000002
push ebx
call edi
test eax, eax
jne 0x1029753
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x480]
push eax
push esi
push str.DontWatchSysProcs
push dword [ebp - 0x464]
mov dword [ebp - 0x490], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1029747
cmp dword [ebp - 0x480], 4
jne 0x1029747
mov eax, dword [ebp - 0x47c]
mov dword [0x107334c], eax
push dword [ebp - 0x464]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push 0x1012fc8
push 0x1012f98
push 0x1010fcc
call fcn.010318f4
cmp eax, esi
mov dword [ebp - 0x468], eax
je 0x102978e
push esi
push esi
push eax
call fcn.010295a8
push dword [ebp - 0x468]
mov dword [ebp - 0x460], eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1029794
mov dword [ebp - 0x460], esi
cmp dword [ebp - 0x460], esi
je 0x1029b41
push esi
push esi
push 2
push dword [ebp - 0x46c]
push 0x80
push esi
push esi
push 0x1010ab4
push dword [ebp - 0x460]
call fcn.01029452
push dword [ebp - 0x460]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [0x10733c4], esi
je 0x10297e3
cmp dword [0x10733c0], 4
je 0x10297e3
call fcn.01027d83
lea eax, [ebp - 0x464]
push eax
push 0x20019
push esi
push 0x1012f20
push ebx
call edi
test eax, eax
je 0x10299ef
lea eax, [ebp - 0x464]
push eax
push 0x20019
push esi
push 0x1012eb8
push ebx
call edi
test eax, eax
jne 0x10299fb
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x478]
push eax
push esi
push 0x1012ea4
push dword [ebp - 0x464]
mov dword [ebp - 0x48c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10299ef
cmp dword [ebp - 0x478], 4
jne 0x10299ef
cmp dword [ebp - 0x468], esi
je 0x10299ef
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, esi
jbe 0x10299c8
cmp eax, 0x104
jae 0x10299c8
lea eax, [ebp - 0x20c]
push 0x1012e8c
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x488], eax
je 0x10299c8
push 0x1012df0
lea eax, [ebp - 0x474]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push esi
push 1
push esi
lea eax, [ebp - 0x474]
mov dword [ebp - 0x4a0], eax
push esi
lea eax, [ebp - 0x4a8]
push eax
push 0x2001f
lea eax, [ebp - 0x460]
push eax
mov dword [ebp - 0x4a8], 0x18
mov dword [ebp - 0x4a4], esi
mov dword [ebp - 0x49c], 0x40
mov dword [ebp - 0x498], esi
mov dword [ebp - 0x494], esi
call dword [sym.imp.ntdll.dll_NtCreateKey]
test eax, eax
jl 0x10299bc
push 0x1012ddc
lea eax, [ebp - 0x474]
push eax
mov dword [ebp - 0x484], 1
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
shl eax, 1
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0x460]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push 0x1012dbc
lea eax, [ebp - 0x474]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 4
lea eax, [ebp - 0x484]
push eax
push 4
push esi
lea eax, [ebp - 0x474]
push eax
push dword [ebp - 0x460]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push dword [ebp - 0x460]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x488]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 4
lea eax, [ebp - 0x468]
push eax
push dword [ebp - 0x478]
mov dword [ebp - 0x468], esi
push esi
push 0x1012ea4
push dword [ebp - 0x464]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x464]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x464]
push eax
push 0x20019
push esi
push 0x1012f20
push ebx
call edi
cmp eax, esi
jne 0x1029a22
push dword [ebp - 0x464]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1029a7f
lea eax, [ebp - 0x464]
push eax
push 0x20019
push esi
push 0x1012d50
push ebx
call edi
cmp eax, esi
jne 0x1029af4
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push esi
push esi
push esi
push 0x1012d24
push dword [ebp - 0x464]
call edi
mov ebx, eax
cmp ebx, esi
je 0x1029a6f
push esi
push esi
push esi
push esi
push 0x1012cf8
push dword [ebp - 0x464]
call edi
mov ebx, eax
push dword [ebp - 0x464]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
jne 0x1029af4
push esi
push 0x1012cb0
push 0x1012c90
mov ebx, 0x1010fcc
push ebx
call fcn.010318f4
mov edi, eax
cmp edi, esi
je 0x1029ab5
push esi
push 3
push edi
call fcn.010295a8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x460], eax
call edi
jmp 0x1029ac1
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x460], esi
cmp dword [ebp - 0x460], esi
je 0x1029aff
push esi
push esi
push esi
push dword [ebp - 0x46c]
push 0x80
push esi
push 3
push 0x1010ab4
push dword [ebp - 0x460]
call fcn.01029452
push dword [ebp - 0x460]
call edi
jmp 0x1029aff
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, 0x1010fcc
push esi
push 0x1012c50
push 0x1012c38
push ebx
call fcn.010318f4
cmp eax, esi
mov dword [ebp - 0x468], eax
je 0x1029b33
push esi
push 1
push eax
call fcn.010295a8
push dword [ebp - 0x468]
mov dword [ebp - 0x460], eax
call edi
jmp 0x1029b39
mov dword [ebp - 0x460], esi
cmp dword [ebp - 0x460], esi
jne 0x1029b48
xor eax, eax
jmp 0x1029bfb
push esi
push esi
push 2
push dword [ebp - 0x46c]
push 0x80
push esi
push 1
push 0x1010ab4
push dword [ebp - 0x460]
call fcn.01029452
push dword [ebp - 0x460]
call edi
push esi
push esi
push 0x1012664
push ebx
call fcn.010318f4
cmp eax, esi
mov dword [ebp - 0x460], eax
je 0x1029bec
push 0x101248c
push eax
jmp 0x1029bd6
cmp word [ebx], 0x20
jne 0x1029ba2
mov ax, word [ebx]
inc ebx
inc ebx
cmp ax, 0x20
je 0x1029b97
push 0x1012650
push ebx
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1029bd0
push esi
push esi
push esi
push dword [ebp - 0x46c]
push 0x80
push esi
push 4
push 0x1010ab4
push ebx
call fcn.01029452
push 0x101248c
push esi
call dword [sym.imp.msvcrt.dll_wcstok]
mov ebx, eax
cmp ebx, esi
pop ecx
pop ecx
jne 0x1029b91
push dword [ebp - 0x460]
call edi
push dword [ebp - 0x46c]
call dword [sym.imp.ntdll.dll_RtlDestroyEnvironment]
xor eax, eax
inc eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
pop esi
call fcn.0103d24a
leave
ret