Function at 0x402a20
Capabilities:
Check if file exists
Copy file
Delete file
Delete registry key
Delete registry value
Read .ini file

Disassembly:
sub esp, 0xa50
cmp word [0x4d6a14], 0
push ebx
push ebp
push esi
push edi
je 0x402d9d
mov ax, word [0x4d6e34]
mov edx, dword [0x4d5dd4]
mov word [esp + 0x240], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x242]
rep stosd dword es:[edi], eax
push str.passlist.dat
lea ecx, [esp + 0x244]
push 0x104
push ecx
push edx
stosw word es:[edi], ax
call fcn.0040ef90
add esp, 0x10
lea eax, [esp + 0x240]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402d9d
lea ecx, [esp + 0x240]
push ecx
push 0
push str.Count
push str.DELKEYITEMS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebp, eax
test ebp, ebp
mov dword [esp + 0x2c], ebp
je 0x402d9d
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 0
push edx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402b7b
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea eax, [esp + 0x10]
push eax
push str.SeRestorePrivilege
push 0
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ebx, 1
test eax, eax
je 0x402b2e
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push 0
push 0
lea eax, [esp + 0x24]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x20]
push 0x10
push eax
push 0
push ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], 2
call esi
lea edx, [esp + 0x30]
push edx
push str.SeBackupPrivilege
push 0
call edi
test eax, eax
je 0x402b70
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
push 0
push 0
lea edx, [esp + 0x24]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x20]
push 0x10
push edx
push 0
push eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x40], 2
call esi
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dx, word [0x4d6e34]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x652]
mov word [esp + 0x650], dx
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x44a]
mov word [esp + 0x448], dx
rep stosd dword es:[edi], eax
push 0x4d6a14
push str._sRegHive
lea edx, [esp + 0x658]
push 0x103
push edx
stosw word es:[edi], ax
call esi
add esp, 0x10
lea eax, [esp + 0x650]
lea ecx, [esp + 0x448]
push eax
push str._s.new
push 0x103
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0x650]
push edx
push str.E5D1532D_63A2_4bdf_B2F5_8B7240FEEE7D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
jne 0x402d9d
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
push 0xf003f
push ebx
push str.E5D1532D_63A2_4bdf_B2F5_8B7240FEEE7D
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x402d67
cmp dword [esp + 0x10], ebx
je 0x402d67
mov dx, word [0x4d6e34]
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x85a]
mov word [esp + 0x858], dx
mov word [esp + 0x38], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x3a]
rep stosd dword es:[edi], eax
test ebp, ebp
stosw word es:[edi], ax
jle 0x402d47
mov ebp, dword [sym.imp.MSVCRT.dll__itow]
mov ecx, 0x82
xor eax, eax
lea edi, [esp + 0x858]
push 0xa
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x85c]
push ecx
push ebx
call ebp
add esp, 0xc
lea edx, [esp + 0x240]
lea eax, [esp + 0x38]
lea ecx, [esp + 0x858]
push edx
push 0x104
push eax
push 0x4d6e34
push ecx
push str.DELKEYITEMS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x402d3a
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.MSVCRT.dll_wcslen]
mov edi, eax
lea eax, [esp + 0x3c]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x402d3a
mov word [esi], 0
add esi, 2
lea ecx, [esp + edi*2 + 0x38]
cmp esi, ecx
jne 0x402d20
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x38]
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
jmp 0x402d3a
push esi
call fcn.0042e9e0
mov edx, dword [esp + 0x14]
add esp, 4
lea ecx, [esp + 0x38]
push esi
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov eax, dword [esp + 0x2c]
inc ebx
cmp ebx, eax
jl 0x402c8d
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x448]
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.E5D1532D_63A2_4bdf_B2F5_8B7240FEEE7D
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea eax, [esp + 0x650]
push 0
lea ecx, [esp + 0x44c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea edx, [esp + 0x448]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa50
ret