Function at 0x1003f06d
Capabilities:
Delete file
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10066217
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70
push ebx
push esi
xor esi, esi
mov dword [esp + 0x20], ecx
push edi
inc esi
lea ecx, [esp + 0x48]
push esi
call fcn.1001d532
push 3
pop edi
xor ebx, ebx
lea ecx, [esp + 0x54]
push edi
mov dword [esp + 0x88], ebx
call fcn.1001d532
mov dword [esp + 0x2c], 0xfffffffb
mov dword [esp + 0x2c], 9
mov dword [esp + 0x2c], 0x96f8f9ed
mov dword [esp + 0x2c], 0x9ec0021f
mov dword [esp + 0x1c], ebx
jmp 0x1003f0ea
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x48]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1003f0db
mov dword [esp + 0x1c], ebx
jmp 0x1003f109
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x54]
mov dword [eax + ecx*4], 0x65b49d58
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x1003f0f6
mov eax, dword [esp + 0x48]
mov dword [eax], ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003f127
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x54]
call fcn.1001d5b4
or dword [esp + 0x84], 0xffffffff
lea ecx, [esp + 0x48]
call fcn.1001d5b4
push esi
lea ecx, [esp + 0x34]
call fcn.1001d532
push 2
pop edx
mov dword [esp + 0x84], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0xceef
mov dword [esp + 0x1c], ebx
jmp 0x1003f173
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x3c], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x1003f167
mov dword [esp + 0x1c], ebx
jmp 0x1003f192
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
mov dword [eax + ecx*4], 0x3f4f46db
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1003f17f
mov eax, dword [esp + 0x30]
mov dword [eax], edx
mov eax, dword [eax]
mov dword [esp + 0x28], 0xcbfcf419
mov dword [esp + 0x1c], 0xffffffff
cmp dword [esp + eax*4 + 0x3c], ebx
jne 0x1003f21e
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
imul eax, dword [ecx]
mov dword [esp + 0x1c], eax
mov eax, dword [ecx]
xor ecx, ecx
mov edx, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x1c]
imul edx, eax
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x3c]
cmp edx, eax
setl cl
cmp ecx, dword [esp + 0x18]
jne 0x1003f1f3
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x3c]
mov edx, dword [esp + 0x30]
cmp dword [edx], eax
sete cl
sub ecx, 0x508d4a8e
je 0x1003f218
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x30]
mov eax, dword [edx]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x30]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x3c]
cmp eax, 0x5d872073
mov eax, dword [esp + 0x30]
sete cl
mov dword [esp + 0x28], ecx
dec dword [eax]
jns 0x1003f19e
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jg 0x1003f35a
mov dword [esp + 0x18], ebx
jmp 0x1003f31b
mov dword [esp + 0x28], 0x5636
cmp dword [esp + 0x28], 0x5814
jle 0x1003f2e8
mov edi, ebx
mov esi, ebx
lea eax, [ebx + esi]
and eax, edi
lea ecx, [esp + 0x60]
cdq
push edx
push eax
call fcn.1000d93a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003f2b6
mov eax, dword [eax]
push eax
call fcn.10050266
pop ecx
push 0
push 1
lea ecx, [esp + 0x68]
call fcn.1001d982
inc ebx
cmp ebx, 0x403e
jl 0x1003f29b
inc esi
push 0
pop ebx
cmp esi, 0x4b8a
jl 0x1003f29b
inc edi
cmp edi, 0x7654
jl 0x1003f299
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x28], 0x531e
mov eax, dword [esp + 0x30]
mov dword [eax + ecx*4], 8
jge 0x1003f30c
push 0x1000b70c
call fcn.10050266
pop ecx
mov dword [esp + 0x84], 2
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x1003f285
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003f346
push 0x150e
push 0xe30
push ebx
push 0x413
call dword [sym.imp.USER32.dll_CreateCaret]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jle 0x1003f27c
xor esi, esi
push 3
inc esi
pop edi
lea ecx, [esp + 0x30]
call fcn.1001d5b4
mov eax, dword [esp + 0x24]
cmp byte [eax], 0
je 0x1003f373
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], 0xffbefa5f
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], ebx
jmp 0x1003f3a1
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x20], 0x574b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1003f391
mov eax, dword [esp + 0x14]
xor edx, edx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov ecx, 0xaa53f0d3
setge dl
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x18]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
mov edx, 0xffff1f04
setl cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
sub edx, eax
mov eax, dword [esp + 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor eax, eax
sub ecx, 7
cmp ecx, 0xa71a
setle al
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], ebx
je 0x1003f501
mov dword [esp + 0x2c], 0x27420ea1
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jl 0x1003f564
mov dword [esp + 0x24], 0x630971cf
mov dword [esp + 0x18], ebx
jmp 0x1003f482
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + eax*4 + 0x20]
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x20], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x1003f46e
mov dword [esp + 0x14], ebx
jmp 0x1003f4ef
mov eax, dword [esp + 0x1c]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0x20]
mov eax, dword [esp + 0x24]
cmp eax, ecx
setle dl
imul ecx, edx, 5
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
add ecx, dword [esp + 0x24]
imul eax, dword [esp + 0x2c], 0xfffffff9
cmp eax, ecx
jle 0x1003f4c0
mov edx, esi
cmp dword [esp + 0x24], ebx
jne 0x1003f4c2
mov edx, ebx
mov eax, dword [esp + 0x24]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x20]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setge dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x20]
cmp eax, edx
setge cl
mov dword [esp + 0x28], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x1003f48e
dec dword [esp + 0x1c]
jns 0x1003f460
jmp 0x1003f564
mov dword [esp + 0x14], ebx
jmp 0x1003f55e
mov dword [esp + 0x18], ebx
jmp 0x1003f554
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jl 0x1003f550
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003f52d
push 0x1ed0
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1003f54a
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1e16
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
dec dword [esp + 0x1c]
jns 0x1003f517
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x1003f50d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x1003f507
mov ecx, dword [esp + 0x7c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret