Function at 0x1029046
Capabilities:
Create directory
Delete file
Delete registry value
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x418]
push eax
push 3
xor esi, esi
push esi
push 0x10024d8
push 0x80000002
mov dword [ebp - 0x418], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10294d0
push ebx
push edi
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x41c]
push eax
push esi
mov edi, 0x10030a4
push edi
push dword [ebp - 0x418]
xor ebx, ebx
mov dword [ebp - 0x420], 0x208
mov dword [ebp - 0x41c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10290fb
cmp dword [ebp - 0x41c], 1
jne 0x10290fb
lea eax, [ebp - 0x414]
push 0x10024b0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
mov ebx, eax
neg ebx
push edi
push dword [ebp - 0x418]
sbb ebx, ebx
inc ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
je 0x10294ce
mov edi, 0x104
push edi
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10294ce
push 0x1003088
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.01028adc
lea eax, [ebp - 0x414]
push eax
call fcn.010326f3
test eax, eax
je 0x10294ce
push edi
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01034382
test eax, eax
je 0x10294ce
lea eax, [ebp - 0x414]
push eax
call fcn.01032458
mov edi, 0x1002244
push edi
lea eax, [ebp - 0x414]
push eax
push 0x100307c
mov ebx, 0x103
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.01028b64
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
je 0x1029339
push 1
push 0x208
lea eax, [ebp - 0x20c]
push eax
call fcn.01028de2
test eax, eax
je 0x1029339
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
push esi
push esi
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.010358a2
test eax, eax
jl 0x1029339
push esi
push esi
push esi
push esi
mov edi, 0x1003068
push edi
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.010358a2
push esi
push esi
push esi
push esi
mov eax, 0x1003054
push eax
lea ecx, [ebp - 0x20c]
push ecx
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.010358a2
lea eax, [ebp - 0x20c]
push eax
call fcn.01032458
push edi
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
push esi
lea eax, [ebp - 0x418]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1002db8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10292b6
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102927c
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1003040
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1002244
lea eax, [ebp - 0x414]
push eax
mov edi, 0x100307c
push edi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.01028b64
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x100302c
lea eax, [ebp - 0x414]
push eax
push edi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.01028b64
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1003054
lea eax, [ebp - 0x414]
push eax
push edi
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.01028b64
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov edi, 0x1002258
push edi
lea eax, [ebp - 0x414]
push eax
push 0x100307c
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.01028b64
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
je 0x10294ce
push 1
push 0x208
lea eax, [ebp - 0x20c]
push eax
call fcn.01028de2
test eax, eax
je 0x10294ce
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
push esi
push esi
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.010358a2
test eax, eax
jl 0x10294ce
push esi
push esi
push esi
push esi
mov eax, 0x1003018
push eax
lea ecx, [ebp - 0x20c]
push ecx
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.010358a2
push esi
push esi
push esi
push esi
mov edi, 0x1003004
push edi
lea eax, [ebp - 0x20c]
push eax
push edi
lea eax, [ebp - 0x414]
push eax
call fcn.010358a2
lea eax, [ebp - 0x20c]
call dword [eax - 0x18]
push edi
nop
add byte [eax], al