Function at 0x10027746
Capabilities:
Delete registry value
Get common file path
Get file size
Query or enumerate registry value
Read file on windows
Write file on windows

Disassembly:
push ebp
mov eax, 0x3354
lea ebp, [esp - 0x32d4]
call fcn.10056840
mov eax, dword [0x10084500]
push ebx
push esi
push edi
push 0x5c
mov esi, 0x10085a50
push esi
mov dword [ebp + 0x32d0], eax
call fcn.100591b0
push 0x2f
push esi
mov edi, eax
call fcn.100591b0
add esp, 0x10
cmp edi, eax
jbe 0x10027788
push 0x5c
jmp 0x1002778a
push 0x2f
push esi
call fcn.100591b0
mov esi, eax
xor ebx, ebx
cmp byte [esi], bl
pop ecx
pop ecx
je 0x100277b2
lea edi, [ebp + 0x31cc]
inc esi
movsx eax, byte [esi]
push eax
call fcn.100592a5
mov byte [edi], al
inc edi
cmp byte [esi], bl
pop ecx
jne 0x100277a0
call fcn.1001e3c3
test al, al
je 0x10027945
push ebx
lea eax, [ebp - 0x78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SYSTEMCurrentControlSetControlSession_Manager
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x10027aa9
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x26a0]
push eax
push ebx
push ebx
push str.PendingFileRenameOperations
push dword [ebp - 0x78]
mov edi, 0xa28
mov dword [ebp - 0x7c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10027880
mov eax, dword [ebp - 0x7c]
cmp eax, ebx
mov dword [ebp - 0x74], ebx
jbe 0x10027837
mov esi, dword [ebp - 0x74]
lea esi, [ebp + esi + 0x26a0]
movsx eax, byte [esi]
push eax
call fcn.100592a5
inc dword [ebp - 0x74]
mov byte [esi], al
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x74], eax
pop ecx
jb 0x10027816
xor esi, esi
dec eax
je 0x10027880
lea ecx, [ebp + 0x31cc]
lea eax, [ebp + esi + 0x26a0]
push ecx
push eax
call fcn.10057d10
test eax, eax
pop ecx
pop ecx
jne 0x10027872
lea eax, [ebp + esi + 0x26a0]
push eax
call fcn.10056d60
lea esi, [esi + eax + 2]
mov eax, dword [ebp - 0x7c]
dec eax
cmp esi, eax
pop ecx
jb 0x1002783c
jmp 0x10027880
push str.PendingFileRenameOperations
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push edi
lea eax, [ebp + 0x26a0]
push ebx
push eax
call fcn.10056960
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x26a0]
push eax
push ebx
push ebx
push str.PendingFileRenameOperations2
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002792e
lea eax, [ebp + 0x26a0]
push eax
xor edi, edi
call fcn.10056d60
test eax, eax
pop ecx
jbe 0x100278eb
lea esi, [ebp + edi + 0x26a0]
movsx eax, byte [esi]
push eax
call fcn.100592a5
mov byte [esi], al
lea eax, [ebp + 0x26a0]
push eax
inc edi
call fcn.10056d60
cmp edi, eax
pop ecx
pop ecx
jb 0x100278c6
mov eax, dword [ebp - 0x7c]
dec eax
je 0x1002792e
lea eax, [ebp + 0x31cc]
push eax
lea esi, [ebp + ebx + 0x26a0]
push esi
call fcn.10057d10
test eax, eax
pop ecx
pop ecx
jne 0x10027920
push esi
call fcn.10056d60
lea ebx, [ebx + eax + 2]
mov eax, dword [ebp - 0x7c]
dec eax
cmp ebx, eax
pop ecx
jb 0x100278f1
jmp 0x1002792e
push str.PendingFileRenameOperations2
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10027aa9
push 0x104
lea eax, [ebp + 0x30c8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp + 0x30c8]
push str.wininit.ini
push eax
call fcn.10057db0
pop ecx
pop ecx
push ebx
push 0x8000080
push 3
push ebx
push ebx
push 0xc0000000
lea eax, [ebp + 0x30c8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x78], edi
je 0x10027aa9
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0x2710
jae 0x10027aa0
push ebx
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x70]
push eax
push edi
mov dword [ebp - 0x80], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x74], ebx
call fcn.10056d60
test eax, eax
pop ecx
jbe 0x100279f4
mov edi, dword [ebp - 0x74]
lea edi, [ebp + edi - 0x70]
movsx eax, byte [edi]
push eax
call fcn.100592a5
inc dword [ebp - 0x74]
mov byte [edi], al
lea eax, [ebp - 0x70]
push eax
call fcn.10056d60
cmp dword [ebp - 0x74], eax
pop ecx
pop ecx
jb 0x100279cf
lea eax, [ebp + 0x31cc]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.10057d10
cmp eax, ebx
pop ecx
pop ecx
je 0x10027aa0
lea esi, [ebp + esi - 0x70]
cmp eax, esi
mov ecx, eax
mov dword [ebp - 0x74], ebx
je 0x10027a2c
mov dl, byte [ecx]
cmp dl, 0xa
je 0x10027a2c
cmp dl, 0xd
je 0x10027a2c
inc ecx
cmp ecx, esi
jne 0x10027a1b
lea edx, [ebp - 0x70]
sub ecx, edx
mov edi, ecx
jmp 0x10027a49
lea ecx, [ebp - 0x70]
cmp eax, ecx
je 0x10027a52
mov cl, byte [eax]
cmp cl, 0xa
je 0x10027a52
cmp cl, 0xd
je 0x10027a52
dec eax
lea ecx, [ebp - 0x70]
cmp eax, ecx
ja 0x10027a35
jmp 0x10027a5a
lea ecx, [ebp - 0x70]
sub eax, ecx
mov dword [ebp - 0x74], eax
push ebx
push ebx
push ebx
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0x74]
inc eax
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x78]
call esi
push ebx
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0x80]
sub eax, edi
push eax
lea eax, [ebp + edi - 0x70]
push eax
push dword [ebp - 0x78]
call esi
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 0x78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x32d0]
pop edi
pop esi
pop ebx
call fcn.100568ae
add ebp, 0x32d4
leave
ret