Function at 0x23a1af20
Capabilities:
Check if file exists
Copy file
Delete directory
Delete registry key
Delete registry value
Persist via run registry key
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
lea ebp, [esp - 0x64]
sub esp, 0x64
push 0xffffffffffffffff
push 0x23bcf671
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1f4
mov eax, dword [0x23c7a190]
push ebx
push esi
push edi
mov dword [ebp + 0x40], eax
mov al, byte [eax + 0x84]
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x10], esp
mov dword [ebp + 0x3c], esi
test al, al
je 0x23a1a8d6
mov eax, dword [esi + 0x30]
cmp eax, 2
je 0x23a1a8d6
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov dword [esi + 0x24], edi
call edx
jmp 0x23a1a8e4
push str.Restore_point_creation_disabled
call dword [0x23c41f2c]
add esp, 4
mov ecx, esi
call fcn.23a129c0
mov ecx, esi
mov bl, al
call fcn.23a19b30
test bl, bl
je 0x23a1a918
cmp dword [esi + 0xb4], 8
jb 0x23a1a909
mov eax, dword [esi + 0xa0]
jmp 0x23a1a90f
lea eax, [esi + 0xa0]
push eax
call fcn.23a0cce0
add esp, 4
mov dword [ebp + 0x60], edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp + 0x60]
push eax
push 0x20006
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x23a1a94a
mov ecx, dword [ebp + 0x60]
push str.actSessionUI32.exe
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp + 0x60]
mov dword [ebp - 4], 0xffffffff
cmp eax, edi
je 0x23a1a972
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x23a1a972
push eax
push str.RegCloseKey___failed_with_0x_08X_error
call dword [0x23c41f24]
add esp, 8
mov edx, dword [esi + 0x20]
shr edx, 4
test dl, 1
je 0x23a1ae01
xor eax, eax
mov dword [ebp + 0x38], 7
mov dword [ebp + 0x34], edi
mov word [ebp + 0x24], ax
cmp dword [esi + 0x30], 2
mov dword [ebp - 4], 1
jne 0x23a1a9b1
mov esi, dword [esi + 0x2c]
push str.DataFiles
push esi
lea ecx, [ebp + 0x20]
call fcn.23a034b0
jmp 0x23a1a9ce
mov ecx, dword [0x23c7a190]
mov eax, dword [ecx + 0x24]
push edi
lea edx, [ebp + 0x20]
push edx
push eax
push 0x23
push 0x23bf0598
mov ecx, esi
call fcn.23a01a80
push 0xffffffffffffffff
push edi
lea ecx, [ebp + 0x20]
xor eax, eax
push ecx
mov esi, 7
lea ecx, [ebp + 0x44]
mov dword [ebp + 0x5c], esi
mov dword [ebp + 0x58], edi
mov word [ebp + 0x48], ax
call fcn.23a02610
xor edx, edx
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], edi
mov word [ebp - 0x28], dx
mov dword [ebp + 0x60], edi
mov eax, dword [0x23c7a190]
mov eax, dword [eax + 0x48]
push eax
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 5
call fcn.23a01070
xor eax, eax
mov dword [ebp], eax
mov dword [ebp + 4], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], eax
cmp dword [ebp - 0x50], 8
mov esi, dword [ebp - 0x64]
mov byte [ebp - 4], 7
jae 0x23a1aa3c
lea esi, [ebp - 0x64]
mov eax, dword [ebp + 0x60]
cmp eax, edi
je 0x23a1aa60
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x23a1aa5d
push eax
push str.RegCloseKey___failed_with_0x_08X_error
call dword [0x23c41f24]
add esp, 8
mov dword [ebp + 0x60], edi
lea ecx, [ebp + 0x60]
push ecx
push 0x20019
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
cmp eax, edi
jne 0x23a1aabc
lea edx, [ebp - 0x4c]
push edx
mov edx, dword [ebp + 0x60]
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp - 0x6c]
push ecx
push edi
push str.AEDK
push edx
mov dword [ebp - 0x4c], 0x30
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jne 0x23a1aab1
lea eax, [ebp - 0x9c]
push eax
lea ecx, [ebp]
call fcn.23a053f0
jmp 0x23a1aace
mov ecx, dword [0x23c7a190]
mov eax, dword [ecx + 0x24]
jmp 0x23a1aac5
mov edx, dword [0x23c7a190]
mov eax, dword [edx + 0x24]
push eax
lea ecx, [ebp]
call fcn.23a05090
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x200]
call fcn.23a054c0
mov eax, dword [ebp + 0x24]
mov esi, 8
mov byte [ebp - 4], 8
cmp dword [ebp + 0x38], esi
jae 0x23a1aaf1
lea eax, [ebp + 0x24]
push 0x23be3f78
push eax
lea ecx, [ebp - 0x2c]
call fcn.23a034b0
lea ecx, [ebp - 0x10c]
call fcn.23a08700
mov eax, dword [ebp - 0x28]
mov byte [ebp - 4], 9
cmp dword [ebp - 0x14], esi
jae 0x23a1ab19
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x200]
push ecx
push eax
lea ecx, [ebp - 0x10c]
call fcn.23a0e3a0
push str.SettingsDataStoreFile
lea ecx, [ebp - 0x10c]
call fcn.23a096b0
cmp eax, edi
je 0x23a1ab88
cmp dword [eax + 0x54], esi
jb 0x23a1ab4a
mov eax, dword [eax + 0x40]
jmp 0x23a1ab4d
add eax, 0x40
cmp word [eax], di
je 0x23a1ab88
push eax
lea ecx, [ebp - 0x88]
call fcn.23a01070
push 0xffffffffffffffff
push edi
lea edx, [ebp - 0x88]
push edx
lea ecx, [ebp + 0x44]
mov byte [ebp - 4], 0xa
call fcn.23a02610
cmp dword [ebp - 0x70], esi
jb 0x23a1ab88
mov eax, dword [ebp - 0x84]
push eax
call fcn.23a2ed1b
add esp, 4
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 8
call fcn.23a09be0
push 0xf4
lea ecx, [ebp - 0x200]
push edi
push ecx
call fcn.23a49830
xor eax, eax
add esp, 0xc
mov dword [ebp], eax
mov dword [ebp + 4], eax
mov dword [ebp + 8], eax
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], eax
mov dword [ebp + 0x18], eax
mov dword [ebp + 0x1c], eax
cmp dword [ebp - 0x50], esi
jb 0x23a1abd7
mov edx, dword [ebp - 0x64]
push edx
call fcn.23a2ed1b
add esp, 4
xor eax, eax
mov word [ebp - 0x64], ax
mov eax, dword [ebp + 0x60]
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x54], edi
mov byte [ebp - 4], 4
cmp eax, edi
je 0x23a1ac0c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x23a1ac0c
push eax
push str.RegCloseKey___failed_with_0x_08X_error
call dword [0x23c41f24]
add esp, 8
mov dword [ebp - 4], 3
mov ebx, 7
xor ecx, ecx
lea edi, [ebx + 1]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], cx
mov eax, dword [ebp + 0x48]
mov byte [ebp - 4], 0xc
cmp dword [ebp + 0x5c], edi
jae 0x23a1ac3a
lea eax, [ebp + 0x48]
push 1
push str.Activities.actmon
push eax
lea ecx, [ebp - 0x48]
call fcn.23a034b0
push eax
call fcn.23a02070
mov eax, dword [ebp + 0x48]
add esp, 8
cmp dword [ebp + 0x5c], edi
jae 0x23a1ac5e
lea eax, [ebp + 0x48]
push 1
push str.Events.actmon
push eax
lea ecx, [ebp - 0x48]
call fcn.23a034b0
push eax
call fcn.23a02070
mov eax, dword [ebp + 0x48]
add esp, 8
cmp dword [ebp + 0x5c], edi
jae 0x23a1ac82
lea eax, [ebp + 0x48]
push 1
push str.EventsOlder.actmon
push eax
lea ecx, [ebp - 0x48]
call fcn.23a034b0
push eax
call fcn.23a02070
mov eax, dword [ebp + 0x48]
add esp, 8
cmp dword [ebp + 0x5c], edi
jae 0x23a1aca6
lea eax, [ebp + 0x48]
push 1
push str.Logs
push eax
lea ecx, [ebp - 0x48]
call fcn.23a034b0
push eax
call fcn.23a020e0
mov eax, dword [ebp + 0x48]
add esp, 8
cmp dword [ebp + 0x5c], edi
jae 0x23a1acca
lea eax, [ebp + 0x48]
push 1
push str.Screenshots
push eax
lea ecx, [ebp - 0x48]
call fcn.23a034b0
push eax
call fcn.23a020e0
mov eax, dword [ebp + 0x48]
add esp, 8
cmp dword [ebp + 0x5c], edi
jae 0x23a1acee
lea eax, [ebp + 0x48]
push 1
push str.InvalidPassword
push eax
lea ecx, [ebp - 0x48]
call fcn.23a034b0
push eax
call fcn.23a020e0
mov edx, dword [ebp + 0x3c]
mov eax, dword [edx + 0x2c]
add esp, 8
push 1
push str.Setup
push eax
lea ecx, [ebp - 0x48]
call fcn.23a034b0
push eax
call fcn.23a020e0
mov eax, dword [ebp - 0x28]
add esp, 8
cmp dword [ebp - 0x14], edi
jae 0x23a1ad31
lea eax, [ebp - 0x28]
push 1
push eax
call fcn.23a02070
mov eax, dword [ebp + 0x24]
add esp, 8
cmp dword [ebp + 0x38], edi
jae 0x23a1ad47
lea eax, [ebp + 0x24]
push 1
push str.Settings.xml
push eax
lea ecx, [ebp - 0x2c]
call fcn.23a034b0
push eax
call fcn.23a02070
mov eax, dword [ebp + 0x48]
add esp, 8
cmp dword [ebp + 0x5c], edi
jae 0x23a1ad6b
lea eax, [ebp + 0x48]
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push eax
call esi
mov eax, dword [ebp + 0x24]
cmp dword [ebp + 0x38], edi
jae 0x23a1ad7f
lea eax, [ebp + 0x24]
push eax
call esi
cmp dword [ebp - 0x30], edi
jb 0x23a1ad93
mov eax, dword [ebp - 0x44]
push eax
call fcn.23a2ed1b
add esp, 4
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], esi
mov word [ebp - 0x44], cx
cmp dword [ebp - 0x14], edi
jb 0x23a1adb2
mov edx, dword [ebp - 0x28]
push edx
call fcn.23a2ed1b
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], esi
mov word [ebp - 0x28], ax
cmp dword [ebp + 0x5c], edi
jb 0x23a1adcf
mov ecx, dword [ebp + 0x48]
push ecx
call fcn.23a2ed1b
add esp, 4
xor edx, edx
mov dword [ebp + 0x5c], ebx
mov dword [ebp + 0x58], esi
mov word [ebp + 0x48], dx
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp + 0x38], edi
jb 0x23a1adf3
mov eax, dword [ebp + 0x24]
push eax
call fcn.23a2ed1b
add esp, 4
xor ecx, ecx
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x34], esi
mov word [ebp + 0x24], cx
xor edi, edi
mov edx, dword [ebp + 0x40]
mov esi, dword [edx + 0x48]
cmp dword [esi - 0xc], edi
je 0x23a1ae50
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call edi
test eax, eax
je 0x23a1ae2e
push eax
push esi
push str.SHDeleteKey___s___failed_with_0x_08X_error
call dword [0x23c41f28]
add esp, 0xc
mov eax, dword [ebp + 0x40]
mov esi, dword [eax + 0x48]
push esi
push SysReAllocStringLen
call edi
test eax, eax
je 0x23a1ae50
push eax
push esi
push str.SHDeleteKey___s___failed_with_0x_08X_error
call dword [0x23c41f28]
add esp, 0xc
mov ecx, dword [ebp + 0x3c]
call fcn.23a13800
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add ebp, 0x64
mov esp, ebp
pop ebp
ret
mov eax, dword [ecx + 0x34]
dec eax
cmp eax, 5
ja case.default.0x23a1af29
jmp dword [eax*4 + 0x23a1af60]
jmp fcn.23a1a340
jmp 0x23a1a880
call fcn.23a1a340
mov eax, dword [0x23c7a190]
mov edx, dword [eax + 0x4c]
cmp dword [edx - 0xc], 0
lea ecx, [eax + 0x4c]
jne 0x23a1af53
lea ecx, [eax + 0x24]
mov eax, dword [ecx]
push eax
call fcn.23a0ce80
pop ecx
ret