Function at 0x1001dd2
Capabilities:
Delete registry value
Enumerate disk volumes
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push esi
lea eax, [ebp + 8]
push eax
push 0x80000002
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
xor esi, esi
cmp eax, esi
jne 0x1001fdf
cmp dword [ebp + 8], esi
jne 0x1001e05
push 0x57
pop eax
jmp 0x1001fdf
push ebx
push edi
lea eax, [ebp - 0x10]
push eax
push 3
push esi
push dword [0x100401c]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
je 0x1001e33
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x1001fdd
push dword [0x1004020]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp + 8]
call edi
mov eax, dword [ebp + 0xc]
test al, 1
je 0x1001f12
push esi
push 0x18
pop edi
push edi
lea eax, [ebp - 0x50]
push eax
push 7
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x1001fdb
mov eax, dword [ebp - 0x50]
xor ebx, ebx
cmp eax, esi
mov dword [ebp - 4], eax
jbe 0x1001f0f
push ebx
lea eax, [ebp - 0x250]
push 0x1001500
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push 0x60
lea eax, [ebp - 0x30]
mov dword [ebp - 0x20], eax
push 3
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
push 0x100080
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], 0x40
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call dword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
jl 0x1001f05
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push esi
push esi
push esi
push 0x70060
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtClose]
inc ebx
cmp ebx, dword [ebp - 4]
jb 0x1001e86
mov eax, dword [ebp + 0xc]
or eax, 2
je 0x1001fdb
push 0x200
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeW]
cmp eax, esi
mov dword [ebp - 4], eax
je 0x1001fdb
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp + eax*2 - 0x252]
cmp word [eax], 0x5c
pop ecx
jne 0x1001f56
mov word [eax], si
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, 0x80
jmp 0x1001f81
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
lea eax, [ebp + eax*2 - 0x252]
cmp word [eax], 0x5c
pop ecx
jne 0x1001f81
mov word [eax], si
push 0xffffffffffffffff
push ebx
push 3
push esi
push 3
lea eax, [ebp - 0x250]
push esi
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x1001fb9
push esi
lea ecx, [ebp - 0xc]
push ecx
push esi
push esi
push esi
push esi
push 0x70060
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x200
lea eax, [ebp - 0x250]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
test eax, eax
jne 0x1001f63
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindVolumeClose]
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret 8