Function at 0x1007d75c
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1007db5c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x100212f4]
call fcn.100213f4
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x1007db07
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.100214d0
mov cl, 1
mov edx, 0x1007db74
mov eax, dword [ebp - 8]
call fcn.10021534
movzx eax, bl
cmp eax, 0x14
ja case.default.0x1007d7c1
jmp dword [eax*4 + 0x1007d7c8]
mov ecx, dword [ebp - 4]
mov edx, 0x1007dbc0
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dbd0
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dbe4
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dbf8
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dc08
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dc1c
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dc2c
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dc3c
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dc4c
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dc5c
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dc70
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dc80
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dc90
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dca0
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dcb0
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dcc4
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov ecx, dword [ebp - 4]
mov edx, 0x1007dcd8
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007d7c1
mov eax, 0xff
call fcn.10002f00
mov esi, eax
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.10021bac
mov eax, esi
call fcn.10002f1c
jmp case.default.0x1007d7c1
mov eax, 0xff
call fcn.10002f00
mov esi, eax
push 0xfe
push esi
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.10021bac
mov eax, esi
call fcn.10002f1c
jmp case.default.0x1007d7c1
mov eax, 0xff
call fcn.10002f00
mov esi, eax
push esi
push 0xfe
call sub.kernel32.dll_GetTempPathA
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.10021bac
mov eax, esi
call fcn.10002f1c
jmp case.default.0x1007d7c1
mov eax, 0xff
call fcn.10002f00
mov esi, eax
push 0xfe
push esi
call sub.kernel32.dll_GetSystemDirectoryA
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.10021bac
mov eax, dword [ebp - 0xc]
mov ecx, 2
mov edx, 1
call fcn.100054b0
mov eax, esi
call fcn.10002f1c
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.100214d0
mov cl, 1
mov edx, 0x1007dcf0
mov eax, dword [ebp - 8]
call fcn.10021534
movzx eax, bl
add eax, 0xffffffeb
cmp eax, 5
ja case.default.0x1007da60
jmp dword [eax*4 + 0x1007da67]
mov ecx, dword [ebp - 4]
mov edx, 0x1007dd24
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007da60
mov ecx, dword [ebp - 4]
mov edx, 0x1007dd3c
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007da60
mov ecx, dword [ebp - 4]
mov edx, 0x1007dd54
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007da60
mov ecx, dword [ebp - 4]
mov edx, 0x1007dd68
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007da60
mov ecx, dword [ebp - 4]
mov edx, 0x1007dd7c
mov eax, dword [ebp - 8]
call fcn.10021928
jmp case.default.0x1007da60
mov ecx, dword [ebp - 4]
mov edx, 0x1007dd90
mov eax, dword [ebp - 8]
call fcn.10021928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1007db0e
mov eax, dword [ebp - 8]
call fcn.100214a0
mov eax, dword [ebp - 8]
call fcn.100040d8
ret