Function at 0x10017030
Capabilities:
Delete file
Delete service
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100676f6
mov eax, dword fs:[0]
push eax
sub esp, 0x24c
mov eax, dword [0x1007a200]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x206
xor ebx, ebx
lea ecx, [ebp - 0x216]
xor eax, eax
push ebx
push ecx
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x254], 0x104
mov word [ebp - 0x218], ax
call fcn.10049f60
add esp, 0xc
xor edx, edx
push ebx
mov eax, 0x1006dc30
lea esi, [ebp - 0x250]
mov dword [ebp - 0x238], 7
mov dword [ebp - 0x23c], ebx
mov word [ebp - 0x24c], dx
call fcn.10002d50
mov dword [ebp - 4], ebx
xor eax, eax
mov word [ebp - 0x230], ax
push 0x22
mov eax, str.SYSTEMCurrentControlSet_services_
lea esi, [ebp - 0x234]
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
call fcn.10002d50
mov eax, edi
mov byte [ebp - 4], 1
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x100170f1
sub eax, edx
sar eax, 1
push edi
lea edx, [ebp - 0x234]
call fcn.100095e0
push 0x104
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x10017127
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
lea esi, [ebp - 0x250]
call fcn.10002d50
push 0x1006d824
mov eax, 1
mov edx, esi
call fcn.100095e0
push 0x208
lea edx, [ebp - 0x218]
push ebx
push edx
call fcn.10049f60
mov eax, dword [ebp - 0x230]
mov esi, 8
add esp, 0xc
mov dword [ebp - 0x254], 0x208
cmp dword [ebp - 0x21c], esi
jae 0x10017191
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x254]
push ecx
lea edx, [ebp - 0x218]
push edx
push ebx
push str.ImagePath
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x100171c0
sub eax, edx
lea ecx, [ebp - 0x218]
sar eax, 1
push ecx
lea edx, [ebp - 0x250]
call fcn.100095e0
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x238], esi
jae 0x100171f5
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, ebx
jne 0x1001725d
cmp dword [ebp - 0x21c], esi
jb 0x10017226
mov edx, dword [ebp - 0x230]
push edx
call fcn.10047382
add esp, 4
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], ax
cmp dword [ebp - 0x238], esi
jb 0x10017256
mov ecx, dword [ebp - 0x24c]
push ecx
call fcn.10047382
add esp, 4
xor eax, eax
jmp 0x10017334
mov edx, dword [ebp - 0x258]
push 0x10000000
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
cmp esi, ebx
jne 0x100172cd
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, 8
cmp dword [ebp - 0x21c], esi
jb 0x10017299
mov eax, dword [ebp - 0x230]
push eax
call fcn.10047382
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], ebx
mov word [ebp - 0x230], cx
cmp dword [ebp - 0x238], esi
jb 0x10017256
mov edx, dword [ebp - 0x24c]
push edx
call fcn.10047382
add esp, 4
xor eax, eax
jmp 0x10017334
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call esi
push edi
call esi
mov esi, 8
cmp dword [ebp - 0x21c], esi
jb 0x100172fe
mov eax, dword [ebp - 0x230]
push eax
call fcn.10047382
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], cx
cmp dword [ebp - 0x238], esi
jb 0x10017332
mov edx, dword [ebp - 0x24c]
push edx
call fcn.10047382
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1004738d
mov esp, ebp
pop ebp
ret