Function at 0x1000ba34
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000e488
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x410
push esi
push edi
mov dword [ebp - 4], 0
mov byte [ebp - 0x330], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x32f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x124]
call fcn.1000d032
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12c]
call fcn.1000d032
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x120]
call fcn.1000d032
mov byte [ebp - 4], 3
mov dword [ebp - 0x18], 0
push 0x10102e00
lea ecx, [ebp - 0x338]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 4
push 0x200
push 0
lea eax, [ebp - 0x330]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x368]
push ecx
call fcn.10007a51
add esp, 4
mov dword [ebp - 0x3ac], eax
mov edx, dword [ebp - 0x3ac]
mov dword [ebp - 0x3b0], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0x3b0]
push eax
lea ecx, [ebp - 0x12c]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x368]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x12c]
call sub.MFC42.DLL_CString::MakeUpper
mov byte [ebp - 0x11c], 0
mov ecx, 0x3f
xor eax, eax
lea edi, [ebp - 0x11b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x10102e04
lea ecx, [ebp - 0x128]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x334]
call fcn.1000d032
mov byte [ebp - 4], 7
fld dword [0x10102d00]
call sub.MSVCRT.dll__ftol
mov dword [ebp - 0x1c], eax
push 0x100
push 0
lea ecx, [ebp - 0x11c]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x100
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString_2
mov byte [ebp - 4], 8
push 2
lea ecx, [ebp - 0x36c]
push ecx
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x3b4], eax
mov edx, dword [ebp - 0x3b4]
mov dword [ebp - 0x3b8], edx
mov byte [ebp - 4], 9
mov eax, dword [ebp - 0x3b8]
push eax
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x36c]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::MakeUpper
mov ecx, dword [ebp - 0x10]
push ecx
push 0x7c
lea ecx, [ebp - 0x12c]
call sub.MFC42.DLL_CString::Find
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 0xffffffff
je 0x1000c326
mov dword [ebp - 0x18], 0
push 0x10102e08
lea ecx, [ebp - 0x338]
call sub.MFC42.DLL_CString::operator_2
mov edx, dword [ebp - 0x130]
sub edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
lea ecx, [ebp - 0x370]
push ecx
lea ecx, [ebp - 0x12c]
call sub.MFC42.DLL_CString::Mid
mov dword [ebp - 0x3bc], eax
mov edx, dword [ebp - 0x3bc]
mov dword [ebp - 0x3c0], edx
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0x3c0]
push eax
lea ecx, [ebp - 0x124]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x370]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x124]
call sub.MFC42.DLL_CString::TrimRight
lea ecx, [ebp - 0x124]
call sub.MFC42.DLL_CString::TrimLeft
push 0x10102e0c
lea ecx, [ebp - 0x124]
push ecx
call fcn.10003430
and eax, 0xff
test eax, eax
je 0x1000bcd9
mov edx, dword [ebp - 0x130]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x1000bc06
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x124]
push ecx
call fcn.1000ce20
and eax, 0xff
test eax, eax
je 0x1000bf4a
lea edx, [ebp - 0x124]
push edx
lea ecx, [ebp - 0x128]
call sub.MFC42.DLL_CString::operator_1
push str.windows_system32config
lea ecx, [ebp - 0x128]
call fcn.1000d044
push 0
lea ecx, [ebp - 0x128]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call fcn.10003b1b
add esp, 4
test eax, eax
je 0x1000be19
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x374], esp
lea eax, [ebp - 0x124]
push eax
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x3c4], eax
call fcn.1000538f
add esp, 8
push ecx
mov ecx, esp
mov dword [ebp - 0x378], esp
lea edx, [ebp - 0x124]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x3c8], eax
lea eax, [ebp - 0x37c]
push eax
call fcn.10008030
add esp, 8
mov dword [ebp - 0x3cc], eax
mov ecx, dword [ebp - 0x3cc]
mov dword [ebp - 0x3d0], ecx
mov byte [ebp - 4], 0xb
mov edx, dword [ebp - 0x3d0]
push edx
lea ecx, [ebp - 0x334]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x37c]
call sub.MFC42.DLL_CString::CString
push 1
lea eax, [ebp - 0x380]
push eax
lea ecx, [ebp - 0x334]
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x3d4], eax
mov ecx, dword [ebp - 0x3d4]
mov dword [ebp - 0x3d8], ecx
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x3d8]
call fcn.10003420
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x380]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 0x18], 1
jmp 0x1000bf4a
lea edx, [ebp - 0x124]
push edx
lea ecx, [ebp - 0x128]
call sub.MFC42.DLL_CString::operator_1
push str.winnt_system32config
lea ecx, [ebp - 0x128]
call fcn.1000d044
push 0
lea ecx, [ebp - 0x128]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call fcn.10003b1b
add esp, 4
test eax, eax
je 0x1000bf39
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x384], esp
lea eax, [ebp - 0x124]
push eax
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x3dc], eax
call fcn.1000538f
add esp, 8
push ecx
mov ecx, esp
mov dword [ebp - 0x388], esp
lea edx, [ebp - 0x124]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x3e0], eax
lea eax, [ebp - 0x38c]
push eax
call fcn.10008030
add esp, 8
mov dword [ebp - 0x3e4], eax
mov ecx, dword [ebp - 0x3e4]
mov dword [ebp - 0x3e8], ecx
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x3e8]
push edx
lea ecx, [ebp - 0x334]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x38c]
call sub.MFC42.DLL_CString::CString
push 1
lea eax, [ebp - 0x390]
push eax
lea ecx, [ebp - 0x334]
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x3ec], eax
mov ecx, dword [ebp - 0x3ec]
mov dword [ebp - 0x3f0], ecx
mov byte [ebp - 4], 0xe
mov ecx, dword [ebp - 0x3f0]
call fcn.10003420
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x390]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 0x18], 1
jmp 0x1000bf4a
mov edx, dword [ebp - 0x130]
add edx, 1
mov dword [ebp - 0x10], edx
jmp 0x1000bc06
mov eax, dword [ebp - 0x1c]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x394], esp
lea edx, [ebp - 0x124]
push edx
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x3f4], eax
lea eax, [ebp - 0x398]
push eax
call fcn.100083ff
add esp, 0xc
mov dword [ebp - 0x3f8], eax
mov ecx, dword [ebp - 0x3f8]
mov dword [ebp - 0x3fc], ecx
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x3fc]
push edx
lea ecx, [ebp - 0x338]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x398]
call sub.MFC42.DLL_CString::CString
mov eax, dword [ebp - 0x130]
add eax, 1
mov dword [ebp - 0x10], eax
push 0xa
lea ecx, [ebp - 0x354]
call sub.MFC42.DLL_CStringList::CStringList
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x338]
push ecx
lea ecx, [ebp - 0x360]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 0x11
push 0x100ffd68
lea ecx, [ebp - 0x360]
call sub.MFC42.DLL_CString::Find_1
cmp eax, 0xffffffff
je 0x1000c07b
push 0x100ffd6c
lea ecx, [ebp - 0x360]
call sub.MFC42.DLL_CString::Find_1
push eax
lea edx, [ebp - 0x39c]
push edx
lea ecx, [ebp - 0x360]
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x400], eax
mov eax, dword [ebp - 0x400]
mov dword [ebp - 0x404], eax
mov byte [ebp - 4], 0x12
mov ecx, dword [ebp - 0x404]
push ecx
lea ecx, [ebp - 0x354]
call sub.MFC42.DLL_CStringList::AddTail
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x39c]
call sub.MFC42.DLL_CString::CString
push 0x100ffd70
lea ecx, [ebp - 0x360]
call sub.MFC42.DLL_CString::Find_1
add eax, 1
push eax
push 0
lea ecx, [ebp - 0x360]
call sub.MFC42.DLL_CString::Delete
jmp 0x1000bfe2
lea ecx, [ebp - 0x354]
call fcn.10009df0
mov dword [ebp - 0x358], eax
mov dword [ebp - 0x35c], 0
jmp 0x1000c0a7
mov edx, dword [ebp - 0x35c]
add edx, 1
mov dword [ebp - 0x35c], edx
mov eax, dword [ebp - 0x35c]
cmp eax, dword [ebp - 0x358]
jge 0x1000c303
mov ecx, dword [ebp - 0x35c]
push ecx
lea ecx, [ebp - 0x354]
call sub.MFC42.DLL_CStringList::FindIndex
push eax
lea ecx, [ebp - 0x354]
call fcn.10009e10
push eax
lea ecx, [ebp - 0x338]
call sub.MFC42.DLL_CString::operator_1
push 0x100ffd74
lea ecx, [ebp - 0x338]
call sub.MFC42.DLL_CString::Find_1
cmp eax, 0xffffffff
je 0x1000c115
mov edx, dword [ebp - 0x338]
push edx
push str._sRecent_
lea eax, [ebp - 0x120]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0xc
jmp 0x1000c130
mov ecx, dword [ebp - 0x338]
push ecx
push str._sAppDataRoamingMicrosoftWindowsRecent_
lea edx, [ebp - 0x120]
push edx
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x120]
call fcn.1000d08c
push str..lnk
lea ecx, [ebp - 0x120]
call fcn.1000d044
push 0
push 0
lea ecx, [ebp - 0x120]
call fcn.10003420
push eax
call fcn.1000c3ab
cmp dword [ebp - 0x18], 0
jne 0x1000c18f
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSaveMRU
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
jmp 0x1000c2fe
lea ecx, [ebp - 0x364]
call fcn.1000d032
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x338]
call fcn.10003490
mov esi, eax
push 0x5c
lea ecx, [ebp - 0x338]
call sub.MFC42.DLL_CString::ReverseFind
sub esi, eax
sub esi, 1
push esi
lea ecx, [ebp - 0x3a0]
push ecx
lea ecx, [ebp - 0x338]
call sub.MFC42.DLL_CString::Right
mov dword [ebp - 0x408], eax
mov edx, dword [ebp - 0x408]
mov dword [ebp - 0x40c], edx
mov byte [ebp - 4], 0x14
mov eax, dword [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x364]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x3a0]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0x364]
push ecx
push 1
lea edx, [ebp - 0x3a4]
push edx
lea ecx, [ebp - 0x124]
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x410], eax
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x414], eax
mov byte [ebp - 4], 0x15
mov ecx, dword [ebp - 0x414]
mov edx, dword [ecx]
push edx
push str._s__sSoftwareMicrosoftWindowsCurrentVersionExplorerComDlg32OpenSaveMRU
lea eax, [ebp - 0x120]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x3a4]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x120]
call fcn.10003420
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov ecx, dword [ebp - 0x364]
push ecx
push 1
lea edx, [ebp - 0x3a8]
push edx
lea ecx, [ebp - 0x124]
call sub.MFC42.DLL_CString::Left
mov dword [ebp - 0x418], eax
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x41c], eax
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x41c]
mov edx, dword [ecx]
push edx
push str._s__sSoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs
lea eax, [ebp - 0x120]
push eax
call sub.MFC42.DLL_CString::Format
add esp, 0x10
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x3a8]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x120]
call fcn.10003420
push eax
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x364]
call sub.MFC42.DLL_CString::CString
jmp 0x1000c098
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x360]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x354]
call fcn.1000d06e
jmp 0x1000bc06
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x334]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x128]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x338]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x120]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x12c]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x124]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret