Function at 0x1002b635
Capabilities:
Move file
Set registry value

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
mov ebx, section..data
mov ebp, 0x10238268
cmp eax, ebx
je 0x1002b665
test byte [eax + 0x1c], 1
je 0x1002b665
push ebp
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
mov eax, dword [0x102cb744]
xor esi, esi
test eax, eax
je 0x1002b67b
push esi
push esi
push 0x12
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.100311fc
push 0xa
call fcn.1002a528
pop ecx
test eax, eax
je 0x1002b6a2
push 0xa
call fcn.1002a528
push eax
call fcn.1003bec0
push eax
call fcn.1002b38f
add esp, 0xc
mov edi, esi
cmp dword [0x102cb098], esi
je 0x1002b96c
cmp dword [0x102cadf4], esi
je 0x1002b8b7
push 0xb
call fcn.1002a528
pop ecx
cmp word [eax], 0x31
jne 0x1002b708
xor edi, edi
inc edi
mov eax, dword [section..data]
cmp eax, ebx
je 0x1002b6ed
test byte [eax + 0x1c], 1
je 0x1002b6ed
push ebp
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
push 2
push 0x10237c8c
push 1
push esi
push 0x10237c90
push dword [0x102cb2b4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0xa
mov esi, 0x10237c94
call fcn.1002a528
pop ecx
mov cx, word [eax]
cmp cx, word [esi]
jne 0x1002b73d
test cx, cx
je 0x1002b737
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x1002b73d
add eax, 4
add esi, 4
test cx, cx
jne 0x1002b715
xor esi, esi
mov eax, esi
jmp 0x1002b744
sbb eax, eax
or eax, 1
xor esi, esi
test eax, eax
push 0x15
sete bl
mov byte [esp + 0x18], bl
call fcn.1002a528
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.1001f510
lea eax, [esp + 0x10]
push eax
call fcn.1002a4c1
mov ecx, eax
call fcn.1004096e
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.1000dde0
push dword [esp + 0x14]
call fcn.1002a4c1
mov ecx, eax
call fcn.1004097e
cmp dword [0x102cadf0], 0
je 0x1002b8e3
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002b7c1
test byte [eax + 0x1c], 1
je 0x1002b7c1
push ebp
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
mov eax, dword [section..data]
add esp, 0x10
test bl, bl
je 0x1002b89b
test edi, edi
je 0x1002b89b
mov ebx, section..data
cmp eax, ebx
je 0x1002b7f1
test byte [eax + 0x1c], 1
je 0x1002b7f1
push ebp
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
call fcn.10012120
push eax
lea ecx, [esp + 0x14]
call fcn.1000dd90
push 0x10237c98
push 0xc
call fcn.1002a528
pop ecx
push eax
lea eax, [esp + 0x18]
push str.__s_s_
push eax
call fcn.10020be8
add esp, 0x10
mov eax, dword [section..data]
cmp eax, ebx
je 0x1002b862
test byte [eax + 0x1c], 1
je 0x1002b862
mov esi, dword [esp + 0x10]
cmp dword [esi - 4], 1
jle 0x1002b84e
push dword [esi - 0xc]
lea ecx, [esp + 0x14]
call fcn.1000d3e0
mov esi, dword [esp + 0x10]
mov eax, dword [section..data]
push esi
push ebp
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1003022b
add esp, 0x14
jmp 0x1002b866
mov esi, dword [esp + 0x10]
push esi
call fcn.101972a0
pop ecx
test al, al
jne 0x1002b891
mov eax, dword [section..data]
cmp eax, ebx
je 0x1002b891
test byte [eax + 0x1c], 1
je 0x1002b891
push ebp
push 0x22
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
lea ecx, [esi - 0x10]
call fcn.1000dde0
jmp 0x1002b8b7
call fcn.1002a82b
test al, al
je 0x1002b8b2
push 4
push esi
push 0x102cb4c0
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, section..data
call fcn.1002aca7
mov eax, dword [section..data]
cmp eax, ebx
je 0x1002b8dc
test byte [eax + 0x1c], 1
je 0x1002b8dc
push ebp
push 0x2b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
mov eax, dword [section..data]
mov ebx, section..data
cmp eax, ebx
je 0x1002b908
test byte [eax + 0x1c], 1
je 0x1002b908
push ebp
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
push 0xa
call fcn.1002a528
pop ecx
cmp word [eax], 0x30
jne 0x1002b928
test edi, edi
je 0x1002b928
push 0x10237cc0
push 0xa
call fcn.1002a53c
pop ecx
pop ecx
push 0xa
call fcn.1002a528
pop ecx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x1002b933
sub eax, edx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push 0xa
call fcn.1002a528
pop ecx
push eax
push 1
push esi
push 0x10237cc4
push dword [0x102cb2b4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1002b8b7
mov eax, dword [section..data]
cmp eax, ebx
je 0x1002b8b7
test byte [eax + 0x1c], 1
je 0x1002b8b7
push ebp
push 0x2a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
jmp 0x1002b8b7