Function at 0x100a645
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6dc
mov eax, dword [0x101348c]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x6c8], eax
lea eax, [ebp - 0x6b8]
push eax
xor ebx, ebx
push 0x10016a4
push 0x80000001
mov dword [ebp - 0x6d4], edi
mov dword [ebp - 0x6b4], ebx
mov dword [ebp - 0x6b8], ebx
mov dword [ebp - 0x6ac], ebx
mov dword [ebp - 0x6c0], ebx
call esi
test eax, eax
jne 0x100a8e4
lea eax, [ebp - 0x6b4]
push eax
push 0x1001620
push 0x80000002
call esi
test eax, eax
jne 0x100a8e4
push 0x7f02
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [ebp - 0x6d8], eax
mov dword [ebp - 0x6bc], ebx
lea eax, [ebp - 0x6c4]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x6dc]
push eax
push ebx
lea eax, [ebp - 0x6d0]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x6bc]
mov dword [ebp - 0x6d0], 0xa
push dword [ebp - 0x6b8]
mov dword [ebp - 0x6c4], 0x14
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebx
mov dword [ebp - 0x6cc], eax
jne 0x100a8a3
cmp dword [ebp - 0x6ac], ebx
mov eax, dword [ebp - 0x6c4]
mov word [ebp + eax*2 - 0x18], bx
je 0x100a762
push dword [ebp - 0x6ac]
call edi
cmp word [ebp - 0x18], 0x45
je 0x100a774
cmp word [ebp - 0x18], 0x65
jne 0x100a8a3
lea eax, [ebp - 0x6ac]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x6b4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x100a8a3
lea eax, [ebp - 0x6b0]
push eax
lea eax, [ebp - 0x53c]
push eax
lea eax, [ebp - 0x6dc]
push eax
push ebx
push 0x100168c
push dword [ebp - 0x6ac]
mov dword [ebp - 0x6b0], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x6ac]
mov dword [ebp - 0x6b0], eax
call edi
cmp dword [ebp - 0x6b0], ebx
jne 0x100a8a3
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0100a48d
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x6b0], eax
mov word [ebp + eax*2 - 0x23c], bx
push 0x1001310
lea eax, [ebp - 0x234]
push eax
call esi
push 0x104
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x10012ac
lea eax, [ebp - 0x43c]
push eax
call esi
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x43c]
push eax
call esi
push 1
lea eax, [ebp - 0x6a8]
push eax
lea eax, [ebp - 0x43c]
push eax
call fcn.01008906
cmp eax, 1
jne 0x100a8a3
lea eax, [ebp - 0x53c]
push eax
push ebx
push 0x143
push 0x409
push dword [ebp - 0x6c8]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov ecx, dword [ebp - 0x6d8]
lea eax, [ebp - 0x18]
push eax
movzx eax, word [ebp - 0x6c0]
lea eax, [eax + eax*4]
lea eax, [ecx + eax*4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
inc dword [ebp - 0x6c0]
inc dword [ebp - 0x6bc]
cmp dword [ebp - 0x6cc], ebx
je 0x100a6f5
push dword [ebp - 0x6b8]
call edi
push dword [ebp - 0x6b4]
call edi
push dword [ebp - 0x6d4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0x7f00
push ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100dd00
leave
ret 8