Function at 0x1029b41
Capabilities:
Accept command line arguments
Get common file path
Persist via run registry key

Disassembly:
push 0x2bc
mov eax, 0x103b2ee
call fcn.0102af8a
mov eax, dword [ebp + 0xc]
xor edi, edi
mov esi, 0x103e7d8
push esi
lea ecx, [ebp - 0x24c]
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x27c], edi
mov dword [ebp - 0x244], edi
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x264], edi
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x270], edi
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x288], edi
mov dword [ebp - 0x284], edi
mov dword [ebp - 0x280], edi
mov dword [ebp - 0x278], edi
call fcn.01022033
push esi
lea ecx, [ebp - 0x268]
mov dword [ebp - 4], edi
call fcn.01022033
push esi
lea ecx, [ebp - 0x254]
mov byte [ebp - 4], 1
call fcn.01022033
push esi
lea ecx, [ebp - 0x25c]
mov byte [ebp - 4], 2
call fcn.01022033
push esi
lea ecx, [ebp - 0x260]
mov byte [ebp - 4], 3
mov dword [ebp - 0x240], edi
call fcn.01022033
xor eax, eax
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push edi
push eax
mov byte [ebp - 4], 4
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x274], edi
call fcn.01022033
lea eax, [ebp - 0x24c]
push eax
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x250], edi
mov byte [ebp - 4], 6
call fcn.01020750
cmp eax, edi
jl 0x1029c65
push edi
push dword [ebp - 0x24c]
call fcn.0102c543
push 0x10013c8
push 0x1008604
push 0x4000000
call fcn.010265a2
mov ebx, dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
mov dword [ebp - 0x224], 1
mov eax, dword [ebp - 0x224]
cmp eax, dword [ebp + 8]
jae 0x1029ec1
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x224]
lea edi, [eax + ecx*4]
push 0x10085f4
push dword [edi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1029cd0
push 0x10085e4
push dword [edi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1029ce8
cmp dword [ebp - 0x230], 0
jne 0x1029ce8
mov dword [ebp - 0x230], 1
jmp 0x1029e82
push 0x10085d0
push dword [edi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1029d0e
push 0x10085bc
push dword [edi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1029d26
cmp dword [ebp - 0x258], 0
jne 0x1029d26
mov dword [ebp - 0x258], 1
jmp 0x1029e82
push 4
push 0x10085b0
push dword [edi]
call ebx
add esp, 0xc
test eax, eax
je 0x1029d4a
push 4
push 0x10085a4
push dword [edi]
call ebx
add esp, 0xc
test eax, eax
jne 0x1029d9a
cmp dword [ebp - 0x244], 0
jne 0x1029d9a
lea eax, [ebp - 0x248]
push eax
mov eax, dword [edi]
add eax, 8
push eax
call fcn.01021dc0
mov dword [ebp - 0x220], eax
test eax, eax
jge 0x1029d8b
push 0x1008578
push 0x100856c
push eax
call fcn.010262cc
add esp, 0xc
mov byte [ebp - 4], 5
jmp 0x102a3cd
mov dword [ebp - 0x244], 1
jmp 0x1029e82
push 7
push 0x100855c
push dword [edi]
call ebx
add esp, 0xc
test eax, eax
je 0x1029dbe
push 7
push 0x100854c
push dword [edi]
call ebx
add esp, 0xc
test eax, eax
jne 0x1029dff
cmp dword [ebp - 0x26c], 0
jne 0x1029dff
lea eax, [ebp - 0x284]
push eax
mov eax, dword [edi]
add eax, 0xe
push eax
call fcn.01021dc0
mov dword [ebp - 0x220], eax
test eax, eax
jge 0x1029df0
push 0x100851c
push 0x1008510
push eax
jmp 0x1029d7a
mov dword [ebp - 0x26c], 1
jmp 0x1029e82
push 0xd
push 0x10084f4
push dword [edi]
call ebx
add esp, 0xc
test eax, eax
je 0x1029e23
push 0xd
push 0x10084d8
push dword [edi]
call ebx
add esp, 0xc
test eax, eax
jne 0x1029e49
cmp dword [ebp - 0x264], 0
jne 0x1029e49
mov edi, dword [edi]
add edi, 0x1a
push edi
lea ecx, [ebp - 0x260]
call fcn.01020429
mov dword [ebp - 0x264], 1
jmp 0x1029e82
push 0x10084c0
push dword [edi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1029e6f
push 0x10084a4
push dword [edi]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1029e8f
cmp dword [ebp - 0x234], 0
jne 0x1029e8f
mov dword [ebp - 0x234], 1
inc dword [ebp - 0x224]
xor edi, edi
jmp 0x1029c8c
mov ecx, dword [ebp - 0x23c]
mov edx, dword [ebp - 0x224]
push dword [ecx + edx*4]
mov eax, 0x80070057
push 0x1008464
push 0x1008458
push eax
mov dword [ebp - 0x220], eax
call fcn.010262cc
add esp, 0x10
jmp 0x1029d82
push 2
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
cmp eax, edi
jge 0x1029ee1
push 0x1008410
push 0x4000000
call fcn.01026649
pop ecx
pop ecx
jmp 0x1029eeb
mov dword [ebp - 0x27c], 1
push edi
push edi
push edi
push 3
push 3
push edi
push edi
push 0xffffffffffffffff
push edi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
cmp eax, edi
mov dword [ebp - 0x220], eax
jge 0x1029f16
push 0x10083c8
push 0x10083bc
jmp 0x1029d79
cmp dword [ebp - 0x234], edi
je 0x1029f8c
push 0x10013c8
push 0x1008398
push 0x4000000
call fcn.010265a2
add esp, 0xc
call fcn.01022ee5
push 0
lea eax, [ebp - 0x268]
push eax
mov edi, 0x1008378
push edi
push 0x1008308
mov ebx, 0x80000002
push ebx
call fcn.01020ca3
test eax, eax
jl 0x1029fbb
mov eax, dword [ebp - 0x268]
cmp dword [eax - 0xc], 0
je 0x1029fbb
push eax
lea eax, [ebp - 0x254]
push 0x1001bf0
push eax
call fcn.0102280e
add esp, 0xc
push edi
push 0x1008308
push ebx
call fcn.01021717
jmp 0x1029fbb
cmp dword [ebp - 0x244], edi
je 0x102a371
cmp dword [ebp - 0x264], edi
je 0x102a371
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea ecx, [ebp - 0x254]
call fcn.01020429
mov ebx, 0x80000002
lea eax, [ebp - 0x270]
push eax
push 0x1001f20
push 0x1008278
push ebx
call fcn.01021408
xor edi, edi
cmp dword [ebp - 0x270], edi
jne 0x102a32b
cmp dword [ebp - 0x234], edi
jne 0x102a32b
lea eax, [ebp - 0x21c]
push eax
push 0x104
mov dword [ebp - 0x250], 1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x102a054
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, edi
jle 0x102a022
and eax, 0xffff
or eax, 0x80070000
cmp eax, edi
mov dword [ebp - 0x220], eax
jl 0x102a036
mov dword [ebp - 0x220], 0x80004005
push 0x1008234
push 0x1008228
call ebx
push eax
call fcn.010263be
add esp, 0xc
mov byte [ebp - 4], 5
jmp 0x102a3da
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x23c]
call fcn.0102070a
push 0
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x23c]
push eax
mov byte [ebp - 4], 7
call fcn.01020814
mov ecx, dword [ebp - 0x23c]
add ecx, 0xfffffff0
mov edi, eax
mov byte [ebp - 4], 6
call fcn.0101fb10
test edi, edi
jl 0x102a0a1
mov dword [ebp - 0x274], 1
lea eax, [ebp - 0x25c]
push eax
mov ecx, 0x103e5f4
call fcn.010203d2
push dword [ebp - 0x258]
xor edi, edi
push edi
mov ecx, 0x103e588
call fcn.01025b70
cmp eax, edi
jge 0x102a0e0
push 0x10013c8
push 0x1008204
push 0x2000000
call fcn.010265a2
add esp, 0xc
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x24c]
push eax
call fcn.01021e52
cmp eax, edi
jl 0x102a10c
push dword [ebp - 0x2bc]
mov ecx, 0x103e588
push 0xfde
call fcn.010257f6
cmp dword [ebp - 0x244], edi
je 0x102a129
push dword [ebp - 0x248]
mov ecx, 0x103e588
push 0xfe3
call fcn.010257f6
push 1
lea eax, [ebp - 0x22c]
push eax
push 0x10081f0
push 0x1008308
push ebx
call fcn.01020ca3
cmp eax, edi
mov dword [ebp - 0x220], eax
jge 0x102a166
push 0x1008180
push 0x1008174
push dword [ebp - 0x220]
call fcn.010262cc
jmp 0x102a048
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x288]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.01029790
cmp eax, edi
mov dword [ebp - 0x220], eax
jge 0x102a19d
push 0x1008120
push 0x1008114
jmp 0x102a156
push dword [ebp - 0x288]
mov ebx, 0x103e588
push 0xfe5
mov ecx, ebx
call fcn.010257f6
push dword [ebp - 0x280]
mov ecx, ebx
push 0xfe4
call fcn.010257f6
cmp dword [ebp - 0x26c], edi
je 0x102a1dd
push dword [ebp - 0x284]
mov ecx, ebx
push 0x14
call fcn.010257f6
lea ecx, [ebp - 0x2b8]
call fcn.01024471
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 8
call fcn.010249b9
cmp eax, edi
mov dword [ebp - 0x220], eax
jge 0x102a228
push 0x1002a90
push 0x1008108
push eax
call fcn.010262cc
add esp, 0xc
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 6
call fcn.0102455c
jmp 0x102a04b
lea eax, [ebp - 0x22c]
push eax
lea ecx, [ebp - 0x2b8]
call fcn.01024609
cmp eax, edi
jge 0x102a2e6
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x220], edi
cmp dword [ebp - 0x228], edi
jl 0x102a25f
cmp dword [ebp - 0x240], 7
jge 0x102a269
mov dword [ebp - 0x238], 1
push edi
push dword [ebp - 0x228]
push dword [ebp - 0x240]
push dword [ebp - 0x278]
push 4
push 0xfe1
push ebx
call fcn.01026006
add esp, 0x1c
push dword [ebp - 0x228]
push dword [ebp - 0x240]
push dword [ebp - 0x22c]
push 0x10013c8
push 0x10080e0
push 0x4000000
call fcn.010265a2
add esp, 0x18
lea ecx, [ebp - 0x2b8]
call fcn.01023d9f
lea ecx, [ebp - 0x2b8]
call fcn.01023a3c
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 6
call fcn.0102455c
mov dword [ebp - 4], 5
jmp 0x102a3da
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x2b8]
call fcn.010238d5
cmp eax, edi
mov dword [ebp - 0x220], eax
jge 0x102a24e
push dword [ebp - 0x22c]
push 0x1008080
push 0x1008070
push eax
call fcn.010262cc
add esp, 0x10
jmp 0x102a214
push 0x1008048
push 0x4000000
call fcn.01026649
mov eax, dword [ebp - 0x254]
pop ecx
pop ecx
mov dword [ebp - 0x230], 1
cmp dword [eax - 0xc], edi
je 0x102a366
push eax
push 0x1008034
push 0x1007fd0
push 0x80000001
call fcn.01021620
mov dword [ebp - 0x220], edi
jmp 0x1029d82
mov eax, 0x80070057
push 0x1007f60
mov dword [ebp - 0x220], eax
push 0x1007f54
jmp 0x1029d79
cmp dword [ebp - 0x250], 0
je 0x102a4ed
mov edi, dword [ebp - 0x220]
test edi, edi
jge 0x102a473
push esi
lea ecx, [ebp - 0x224]
call fcn.01022033
push edi
mov ebx, 0x10013c8
push ebx
push 0x1007f14
push 0x2000000
mov byte [ebp - 4], 0xa
call fcn.010265a2
add esp, 0x10
lea eax, [ebp - 0x224]
push eax
push edi
call fcn.01020c0e
test eax, eax
je 0x102a42e
mov eax, dword [ebp - 0x224]
cmp dword [eax - 0xc], 0
jne 0x102a443
push edi
lea eax, [ebp - 0x224]
push 0x1007f08
push eax
call fcn.0102280e
add esp, 0xc
push dword [ebp - 0x224]
push ebx
push 0x1007f00
push 0x2000000
call fcn.010265a2
mov ecx, dword [ebp - 0x224]
add esp, 0x10
add ecx, 0xfffffff0
mov byte [ebp - 4], 5
call fcn.0101fb10
jmp 0x102a4f8
cmp dword [ebp - 0x238], 0
mov ebx, 0x10013c8
jne 0x102a4ab
push ebx
push 0x1007ee4
push 0x4000000
call fcn.010265a2
add esp, 0xc
cmp dword [ebp - 0x230], 0
jne 0x102a4f8
push dword [ebp - 0x248]
call dword [sym.imp.SpWizUI.dll_SPInstallSucceeded]
jmp 0x102a4f8
push dword [ebp - 0x228]
push ebx
push 0x1007ec0
push 0x4000000
call fcn.010265a2
add esp, 0x10
cmp dword [ebp - 0x230], 0
jne 0x102a4f8
push dword [ebp - 0x260]
push dword [ebp - 0x228]
push dword [sym.imp.SpError.dll_GetErrorDescription]
push dword [ebp - 0x248]
call dword [sym.imp.SpWizUI.dll_SPInstallFailed]
jmp 0x102a4f8
mov edi, dword [ebp - 0x220]
mov ebx, 0x10013c8
push esi
lea ecx, [ebp - 0x238]
call fcn.01022033
lea eax, [ebp - 0x250]
push eax
mov ecx, 0x103e5a0
mov byte [ebp - 4], 0xb
call fcn.01026951
push eax
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 0xc
call fcn.010203d2
mov ecx, dword [ebp - 0x250]
add ecx, 0xfffffff0
mov byte [ebp - 4], 0xb
call fcn.0101fb10
mov esi, dword [ebp - 0x238]
cmp dword [esi - 0xc], 0
je 0x102a557
push esi
push 0xfe8
mov ecx, 0x103e588
call fcn.010259c7
lea ecx, [esi - 0x10]
mov byte [ebp - 4], 5
call fcn.0101fb10
cmp dword [ebp - 0x27c], 0
je 0x102a572
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x102a586
and edi, 0xffff
mov esi, edi
push esi
mov edi, 0x103e588
push 0xfdf
mov ecx, edi
call fcn.010257f6
cmp dword [ebp - 0x274], 0
je 0x102a5b7
push dword [ebp - 0x258]
mov ecx, edi
call fcn.010256e7
mov ecx, edi
call fcn.01025679
push esi
push ebx
push 0x1007e94
mov edi, 0x4000000
push edi
call fcn.010265a2
add esp, 0x10
cmp dword [ebp - 0x234], 0
je 0x102a5e6
push ebx
push 0x1007e58
push edi
xor esi, esi
call fcn.010265a2
add esp, 0xc
call fcn.0102b8d1
mov ecx, dword [ebp - 0x22c]
add ecx, 0xfffffff0
call fcn.0101fb10
mov ecx, dword [ebp - 0x260]
add ecx, 0xfffffff0
call fcn.0101fb10
mov ecx, dword [ebp - 0x25c]
add ecx, 0xfffffff0
call fcn.0101fb10
mov ecx, dword [ebp - 0x254]
add ecx, 0xfffffff0
call fcn.0101fb10
mov ecx, dword [ebp - 0x268]
add ecx, 0xfffffff0
call fcn.0101fb10
mov ecx, dword [ebp - 0x24c]
add ecx, 0xfffffff0
call fcn.0101fb10
mov eax, esi
call fcn.0102aff5
ret