Function at 0x100dc9f
Capabilities:
Get common file path
Get startup folder
Query or enumerate registry key
Query or enumerate registry value
Set environment variable

Disassembly:
push 0x470
mov eax, 0x104015f
call fcn.010030e2
xor esi, esi
push esi
push esi
push 1
push esi
mov dword [ebp - 0x434], esi
call dword [sym.imp.KERNEL32.dll_HeapSetInformation]
push 0xffffffffffffffff
call sub.IMM32.dll_ImmDisableIME
mov dword [ebp - 0x440], esi
mov dword [ebp - 4], esi
call fcn.0100e3a1
test eax, eax
je 0x100deac
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x42c]
push eax
push 9
push esi
push 0x100de10
push 0x80000002
call edi
cmp eax, esi
jne 0x100deac
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor eax, eax
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0x424]
push ecx
lea ecx, [ebp - 0x41c]
push ecx
mov esi, 0xff
mov dword [ebp - 0x430], eax
push eax
push dword [ebp - 0x42c]
mov dword [ebp - 0x424], esi
call ebx
test eax, eax
jne 0x100de9e
push 0x100de08
push esi
lea eax, [ebp - 0x41c]
push eax
call fcn.0100f54b
lea eax, [ebp - 0x428]
push eax
push 1
push 0
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x42c]
call edi
test eax, eax
jne 0x100ddc7
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x43c]
push eax
push 0
push 0x100ddec
push dword [ebp - 0x428]
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x43c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100ddbb
lea eax, [ebp - 0x214]
push eax
push 0x10a1
call fcn.01010898
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x430]
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x41c]
push eax
push dword [ebp - 0x430]
jmp 0x100dd28
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
push esi
mov byte [ebp - 4], 1
call fcn.0100e9f5
call fcn.0100e433
mov dword [ebp - 4], esi
push 0x104a2d0
push 0x104a348
push 0x100c341
xor ebx, ebx
push 0x100e19c
inc ebx
call fcn.0100c38b
xor edi, edi
cmp dword [0x104a36c], edi
je 0x100df79
mov al, byte [0x104a370]
cmp al, 4
jb 0x100e22c
mov eax, dword [0x104a358]
mov ecx, dword [0x104a35c]
mov edx, 0x80010000
and eax, 5
and ecx, edx
or eax, ecx
je 0x100df43
mov esi, dword [0x104a360]
mov ecx, dword [0x104a364]
mov eax, esi
and eax, 5
and ecx, edx
cmp eax, esi
jne 0x100df43
cmp ecx, dword [0x104a364]
jne 0x100df43
push 0x100e1b0
push dword [0x104a2d4]
push dword [0x104a2d0]
call fcn.0100c245
cmp dword [0x104a36c], edi
je 0x100df79
mov al, byte [0x104a370]
cmp al, 4
jb 0x100e239
mov eax, dword [0x104a358]
mov esi, dword [0x104a35c]
mov ecx, 0x200
mov edx, 0x80000000
and eax, ecx
and esi, edx
or eax, esi
jne 0x101b30e
push 0x100e1e4
push 0xffffffffffffffff
call fcn.0100cc0a
mov ecx, 0x104a0f8
call fcn.0100edf7
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea ecx, [ebp - 0x428]
mov byte [ebp - 4], 3
mov dword [ebp - 0x428], edi
call fcn.0100edbd
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 4
call fcn.0100ed58
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 5
call fcn.0100c993
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 6
call fcn.01010a5b
lea eax, [ebp - 0x21c]
push eax
push edi
push edi
push 0x801c
push edi
mov byte [ebp - 4], 7
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, edi
jl 0x101b356
lea eax, [ebp - 0x21c]
push eax
push 0x1011f04
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp eax, edi
je 0x101b356
lea ecx, [ebp - 0x478]
call fcn.0100f621
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x438]
push eax
push ebx
mov esi, 0xc0100000
push ebx
lea ecx, [ebp - 0x428]
mov byte [ebp - 0x420], 0
mov dword [ebp - 0x43c], esi
call fcn.010108db
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x438], eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x438]
push eax
push ebx
push ebx
lea ecx, [ebp - 0x428]
mov byte [ebp - 0x420], 0
mov dword [ebp - 0x43c], esi
call fcn.010108db
push edi
push dword [ebp - 0x428]
lea ecx, [ebp - 0x478]
push ebx
call fcn.0100c96a
and dword [ebp - 0x424], 0
lea eax, [ebp - 0x478]
mov dword [ebp - 0x448], edi
mov dword [ebp - 0x450], 0xc
mov dword [ebp - 0x44c], eax
lea edi, [ebp - 0x450]
mov esi, 0x104a104
cmp dword [ebp - 0x424], 0xf
jae 0x100e121
push 0x100e1c0
push 1
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push eax
mov ecx, esi
call fcn.0100272d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [0x104a108], 0
mov ebx, eax
je 0x101b4b4
test ebx, ebx
jne 0x101b4b4
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 6
call fcn.0100ed45
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 5
call fcn.0100ed45
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 4
call fcn.0100ecec
push dword [ebp - 0x428]
mov byte [ebp - 4], 3
call dword [0x104b7e8]
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
mov dword [0x104a074], eax
lea eax, [ebp - 0x444]
push eax
mov byte [ebp - 4], 9
call fcn.0100d3d9
mov edi, eax
mov dword [ebp - 0x440], edi
test edi, edi
je 0x101b52e
cmp dword [ebp - 0x444], 2
jne 0x101b52e
mov esi, ebx
jmp 0x100e1f8
cmp esi, dword [ebp - 0x444]
jge 0x100e25c
mov eax, dword [edi + esi*4]
movzx ecx, word [eax]
cmp cx, 0x2f
jne 0x101b505
add eax, 2
push 0x100e248
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x101b52e
inc esi
jmp 0x100e1f8
test al, al
je 0x100def5
jmp 0x100df43
test al, al
jne 0x100df79
jmp 0x100df58
lea ecx, [ebp - 0x424]
call fcn.0100c325
mov eax, dword [ebp - 0x424]
xor edi, edi
cmp eax, edi
mov byte [ebp - 4], 0xa
jl 0x101b511
mov esi, 0x104a170
push 0x104a738
mov ecx, esi
call fcn.010103b1
cmp eax, edi
jl 0x101b511
mov ecx, esi
call fcn.0100e2ba
push 3
push 0xb86
call fcn.010045b6
call dword [sym.imp.ole32.dll_CoUninitialize]
mov dword [ebp - 4], edi
jmp 0x101b39d
mov esi, dword [0x104a360]
mov eax, esi
and eax, ecx
mov ecx, dword [0x104a364]
and ecx, edx
cmp eax, esi
jne 0x100df79
cmp ecx, dword [0x104a364]
jne 0x100df79
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x101b560
push dword [0x104a2d4]
push dword [0x104a2d0]
call fcn.01036d4b
jmp 0x100df79
mov dword [ebp - 0x434], ebx
lea ecx, [ebp - 0x430]
mov byte [ebp - 4], 6
call fcn.0100ed45
lea ecx, [ebp - 0x42c]
mov byte [ebp - 4], 5
call fcn.0100ed45
lea ecx, [ebp - 0x478]
mov byte [ebp - 4], 4
call fcn.0100ecec
push dword [ebp - 0x428]
mov byte [ebp - 4], 3
call dword [0x104b7e8]
mov byte [ebp - 4], 0
call dword [sym.imp.MSSRCH.DLL_public:_static_int___stdcall_CSearchServiceObj::Cleanup_void_]
cmp dword [0x104a36c], 0
je 0x101b479
mov dl, byte [0x104a370]
cmp dl, 4
jae 0x101b3bf
test dl, dl
jne 0x101b41b
mov eax, dword [0x104a358]
mov ecx, dword [0x104a35c]
mov edi, 0x200
mov ebx, 0x80000000
and eax, edi
and ecx, ebx
or eax, ecx
je 0x101b41b
mov esi, dword [0x104a360]
mov eax, esi
and eax, edi
mov edi, dword [0x104a364]
mov ecx, edi
and ecx, ebx
cmp eax, esi
jne 0x101b41b
cmp ecx, edi
jne 0x101b41b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0x101b570
push dword [0x104a2d4]
push dword [0x104a2d0]
call fcn.01036d4b
mov dl, byte [0x104a370]
cmp dword [0x104a36c], 0
je 0x101b479
cmp dl, 4
jae 0x101b42d
test dl, dl
jne 0x101b479
mov eax, dword [0x104a358]
mov ecx, dword [0x104a35c]
mov edi, 0x80010000
and eax, 5
and ecx, edi
or eax, ecx
je 0x101b479
mov edx, dword [0x104a360]
mov esi, dword [0x104a364]
mov eax, edx
mov ecx, esi
and eax, 5
and ecx, edi
cmp eax, edx
jne 0x101b479
cmp ecx, esi
jne 0x101b479
push 0x101b580
push dword [0x104a2d4]
push dword [0x104a2d0]
call fcn.0100c245
push 0x104a2d0
call fcn.01029dd9
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x440], 0
je 0x101b49c
push dword [ebp - 0x440]
call dword [0x104b7e8]
mov eax, dword [ebp - 0x434]
call fcn.01003122
ret 0x10
push 0
mov ecx, esi
call fcn.0100272d
cmp ebx, 0xb7
je 0x101b4d4
mov dword [ebp - 0x434], 1
jmp 0x101b35c
cmp dword [ebp - 0x424], 0xe
jne 0x101b4ec
mov dword [ebp - 0x434], 2
jmp 0x101b35c
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x424]
xor ebx, ebx
inc ebx
jmp 0x100e0e2
cmp cx, 0x2d
je 0x100e210
jmp 0x101b52e
cmp dword [ebp - 0x424], edi
mov dword [ebp - 0x434], eax
jl 0x101b399
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x101b399
mov dword [ebp - 0x434], ebx
jmp 0x101b399