Function at 0x1030a35
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa24
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x624]
xor esi, esi
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], 0x200
call dword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
test eax, eax
mov ebx, dword [sym.imp.msvcrt.dll_wcslen]
je 0x1030add
cmp word [ebp + 0xc], si
je 0x1030add
lea eax, [ebp - 0x624]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
jne 0x1030a8d
lea edi, [ebp - 0x624]
jmp 0x1030a8f
inc edi
inc edi
push edi
call ebx
cmp word [edi], si
pop ecx
lea ecx, [eax + eax + 2]
mov eax, edi
je 0x1030aae
cmp word [eax], 0x5c
jne 0x1030aa7
mov word [eax], si
inc eax
inc eax
cmp word [eax], si
jne 0x1030a9e
push 1
push 1
push 4
push 0x1004cd0
push ecx
push edi
push 1
lea eax, [ebp - 4]
push eax
call fcn.01081d11
test ax, ax
jne 0x1030add
mov eax, dword [ebp - 4]
or byte [eax + 0x15], 2
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.010821b4
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
push 0x1005b20
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1030ce8
mov eax, 0x200
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x624]
push eax
push esi
push esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xa24]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
mov dword [ebp - 0x24], eax
jne 0x1030cd3
mov eax, dword [ebp - 8]
shr eax, 1
mov dword [ebp - 8], eax
mov word [ebp + eax*2 - 0x624], si
cmp eax, esi
je 0x1030cd3
dec eax
cmp word [ebp + eax*2 - 0x624], 0x5c
mov dword [ebp - 8], eax
jne 0x1030b46
cmp eax, esi
je 0x1030cd3
mov edi, dword [sym.imp.msvcrt.dll_wcschr]
add eax, eax
lea ecx, [ebp + eax - 0x622]
mov word [ebp + eax - 0x624], si
lea eax, [ebp - 0x624]
push 0x5c
push eax
mov dword [ebp - 0xc], ecx
call edi
cmp eax, esi
pop ecx
pop ecx
je 0x1030cd3
add eax, 2
push 0x5c
push eax
call edi
cmp eax, esi
pop ecx
pop ecx
je 0x1030cd3
add eax, 2
push 0x5c
push eax
call edi
cmp eax, esi
pop ecx
pop ecx
je 0x1030cd3
lea edi, [eax + 2]
push edi
mov dword [ebp - 0x18], edi
call ebx
lea eax, [eax + eax + 2]
pop ecx
mov dword [ebp - 0x14], eax
jmp 0x1030bd6
cmp word [edi], 0x5c
jne 0x1030bd4
mov word [edi], si
inc edi
inc edi
cmp word [edi], si
jne 0x1030bcb
push esi
push esi
push dword [ebp - 0xc]
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0xc]
xor eax, eax
cmp word [ebp + 0xc], si
push dword [ebp - 0x14]
setne al
push dword [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
call fcn.01081d11
test ax, ax
jne 0x1030c1b
mov eax, dword [ebp - 4]
or byte [eax + 0x15], 2
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.010821b4
push dword [ebp - 0xc]
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x224]
push eax
call edi
lea eax, [ebp - 0x224]
push 0x1005b14
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
push esi
lea eax, [ebp - 0x224]
push esi
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 4]
push dword [ebp - 0x18]
push esi
push eax
call fcn.01081d11
test ax, ax
jne 0x1030c7a
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.010821b4
push dword [ebp - 0xc]
lea eax, [ebp - 0x224]
push eax
call edi
lea eax, [ebp - 0x224]
push 0x1005b08
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x10
push esi
lea eax, [ebp - 0x224]
push esi
push eax
call ebx
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 4]
push dword [ebp - 0x18]
push esi
push eax
call fcn.01081d11
test ax, ax
jne 0x1030cd3
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.010821b4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x24], esi
je 0x1030afc
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 8