Function at 0x10001610
Capabilities:
Delete file
Query or enumerate registry key
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x404
mov eax, dword [0x10017078]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
mov ebx, dword [ebp + 0x28]
push esi
push edi
push 0x1c
lea eax, [esp + 0x3c]
push eax
mov ecx, 7
lea esi, [ebp + 8]
lea edi, [esp + 0x40]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0x24]
push sym.dlmqsjwy.dll_W6gGqQ0aAkKuU4LN
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10001668
mov ecx, dword [esp + 0x3c]
push 0x104
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x98
lea edx, [esp + 0x60]
push 0
push edx
call fcn.10009350
mov edi, dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
add esp, 0xc
push 1
push 2
push 0
push 0
mov dword [esp + 0x68], 0x9c
mov dword [esp + 0x6c], 6
mov dword [esp + 0x70], 0
mov dword [esp + 0x78], 2
call edi
push 1
push 1
push edx
push eax
call edi
push 1
push 8
push edx
push eax
call edi
push edx
push eax
push 0xb
lea eax, [esp + 0x64]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
push esi
push 0x1001443c
push 0x104
push 0x10019338
call fcn.10002f4d
add esp, 0x10
push esi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x10014440
push esi
call edi
push 0x10014444
push esi
call edi
push 0x10019338
call dword [sym.imp.SHLWAPI.dll_PathStripPathA]
push 0x100184d4
push str.rhncawjubglsajywomfhndzxfdagas
call dword [sym.imp.KERNEL32.dll_GetBinaryTypeA]
cmp dword [0x100184d4], 1
jne 0x1000172f
push str.mrStaVzdreUWrDuiSAJZFDMhUZrhGVISGtkbMUTuiKSxHlFZVQEnhhdDb
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
fld dword [0x100182a4]
call fcn.1000ee70
fstp dword [esp + 0xc]
fld dword [esp + 0xc]
mov eax, 0x10019338
fsub qword [0x100145d0]
lea edx, [eax + 1]
fstp qword [0x10019440]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001756
sub eax, edx
push 4
mov dword [ebx], eax
call dword [sym.imp.USER32.dll_GetQueueStatus]
test eax, eax
je 0x10001777
push 2
push 0x25
call dword [sym.imp.KERNEL32.dll_Beep]
push 0x10019338
push esi
lea ecx, [esp + 0x208]
push str._s__S
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [esp + 0x200]
push edx
push 0x10014494
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.COMDLG32.dll_FindTextA]
push 0x104
call fcn.100028b9
add esp, 4
lea ecx, [esp + 0xc]
push ecx
push 0x20019
push 0
push str.QUnHttJuPHTqT
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000182d
mov eax, dword [esp + 0xc]
push 0x104
lea edx, [esp + 0xfc]
push edx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
fld qword [0x100145c8]
call fcn.1000f01c
call fcn.1000ef30
and eax, 0x80000007
jns 0x10001849
dec eax
or eax, 0xfffffff8
inc eax
mov edx, dword [0x100184cc]
shl edx, 6
or eax, edx
mov dword [0x100184cc], eax
call fcn.10001540
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
call fcn.1000f01c
call fcn.1000ef30
mov ecx, dword [esp + 0x40c]
pop edi
pop esi
pop ebx
mov dword [0x100184d0], eax
xor ecx, esp
mov eax, 1
call fcn.100028c4
mov esp, ebp
pop ebp
ret