Function at 0x1010f4f0
Capabilities:
Delete file
Get common file path
Move file
Query or enumerate registry value

Disassembly:
push 0x228
mov eax, 0x1013df81
call fcn.1011094a
mov esi, ecx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x220], esi
push 1
mov dword [ebp - 0x234], esi
call fcn.100ed356
xor edi, edi
lea eax, [esi + 0xb0]
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
push eax
mov byte [ebp - 4], 1
call sub.MSVCP140.dll__Mtx_init_in_situ
pop ecx
pop ecx
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], bl
push eax
push 1
push edi
push str.SOFTWAREAdobeAcrobat_ReaderDCAVEntitlement
push SysReAllocString
mov dword [ebp - 0x220], 4
mov dword [ebp - 0x228], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1010f59c
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
push eax
push edi
push edi
push str.iNGLLogLevel
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x22c]
test eax, eax
cmove ebx, dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x64
pop eax
push 5
pop ecx
cmp ebx, 0x169d
mov dword [esi + 0xe0], ebx
cmove eax, ecx
mov dword [esi + 0xe4], eax
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
mov ebx, 0xfde9
push eax
push edi
push ebx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
jle 0x1010f644
push 0x101a5480
push esi
call fcn.10063887
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x1010f644
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
test eax, eax
jle 0x1010f636
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1010f61d
sub ecx, edx
mov esi, 0x101e8adc
push ecx
push edi
mov ecx, esi
call fcn.10063887
jmp 0x1010f63b
mov esi, 0x101e8adc
push edi
call fcn.101109bc
pop ecx
jmp 0x1010f649
mov esi, 0x101e8adc
mov edi, 0x101e8aac
push esi
mov ecx, edi
call fcn.10063887
push 0x10
pop ebx
cmp dword [0x101e8ad8], ebx
mov eax, 0x101e8ac4
push dword [0x101e8ad4]
cmovae eax, dword [0x101e8ac4]
mov ecx, edi
push eax
call fcn.10063887
cmp dword [0x101e8aa8], ebx
mov eax, 0x101e8a94
push dword [0x101e8aa4]
cmovae eax, dword [0x101e8a94]
mov ecx, esi
push eax
call fcn.10063887
push esi
mov byte [ebp - 4], 3
call fcn.1010f8fc
pop ecx
test al, al
je 0x1010f732
lea eax, [ebp - 0x224]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [ebp - 0x224], xmm0
call fcn.1010f859
pop ecx
pop ecx
test al, al
je 0x1010f732
cmp dword [ebp - 0x220], 0
jl 0x1010f732
jg 0x1010f6e1
cmp dword [ebp - 0x224], 0x200000
jb 0x1010f732
push edi
call fcn.1010f8fc
pop ecx
test al, al
je 0x1010f703
cmp dword [0x101e8ac0], ebx
mov eax, edi
cmovae eax, dword [0x101e8aac]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
pop ecx
push edi
call fcn.1010f8fc
pop ecx
test al, al
jne 0x1010f732
cmp dword [0x101e8ac0], ebx
cmovae edi, dword [0x101e8aac]
cmp dword [0x101e8af0], ebx
push edi
cmovae esi, dword [0x101e8adc]
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
pop ecx
pop ecx
mov eax, dword [ebp - 0x230]
jmp 0x1010f746
call fcn.10110897
ret