Function at 0x1001d375
Capabilities:
Check if file exists
Delete registry key
Get common file path
Get file attributes
Get session user name
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x3e0
lea ebp, [esp - 4]
mov eax, dword [0x10068510]
xor eax, ebp
mov dword [ebp + 0x3e0], eax
push 0x28
mov eax, 0x1005265d
call fcn.10037f59
xor ebx, ebx
cmp dword [0x1006a458], ebx
jne 0x1001d68b
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x24]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1001d3f1
lea eax, [ebp - 0x30]
push eax
push str.SeRestorePrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
xor edi, edi
inc edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x28], 2
push ebx
push ebx
push ebx
lea eax, [ebp - 0x34]
push eax
push ebx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x1001d3f4
xor edi, edi
inc edi
mov dword [ebp - 0x18], ebx
mov esi, 0x94
push esi
push ebx
lea eax, [ebp]
push eax
call fcn.100388b0
add esp, 0xc
mov dword [ebp], esi
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1001d4d5
cmp dword [ebp + 0x10], 2
jne 0x1001d4d5
lea eax, [ebp - 0x1c]
push eax
push edi
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001d4d5
mov dword [ebp - 0x14], 0x104
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x29c]
push eax
push ebx
push ebx
push str.AppData
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001d4c3
lea eax, [ebp + 0x29c]
push eax
call fcn.10038190
pop ecx
dec eax
mov dword [ebp - 0x14], eax
cmp byte [ebp + eax + 0x29c], 0x5c
mov eax, 0x10055e52
je 0x1001d492
mov eax, 0x10055be4
push eax
lea eax, [ebp + 0x29c]
push eax
push str._s_sDMCache
lea eax, [ebp + 0x198]
push eax
call fcn.1003b325
add esp, 0x10
lea eax, [ebp + 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1001d4c3
mov dword [ebp - 0x18], edi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], ebx
jne 0x1001d5b8
push 0x104
lea eax, [ebp + 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1001d68b
lea eax, [ebp + 0x29c]
push eax
call fcn.10038190
pop ecx
dec eax
mov dword [ebp - 0x14], eax
cmp byte [ebp + eax + 0x29c], 0x5c
mov eax, 0x10055e52
je 0x1001d514
mov eax, 0x10055be4
push eax
lea eax, [ebp + 0x29c]
push eax
push str._s_sDMCache
lea eax, [ebp + 0x198]
push eax
call fcn.1003b325
add esp, 0x10
cmp dword [ebp + 0x10], 2
jne 0x1001d59f
mov dword [ebp - 0x20], 0x40
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0x3a0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x1001d565
push str.default_user
lea eax, [ebp + 0x3a0]
push eax
call fcn.1003b325
pop ecx
pop ecx
mov eax, dword [ebp - 0x14]
cmp byte [ebp + eax + 0x29c], 0x5c
mov eax, 0x10055e52
je 0x1001d57c
mov eax, 0x10055be4
lea ecx, [ebp + 0x3a0]
push ecx
push eax
lea eax, [ebp + 0x29c]
push eax
push str._s_sDMCache_s
lea eax, [ebp + 0x198]
push eax
call fcn.1003b325
add esp, 0x14
lea eax, [ebp + 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1001d68b
mov dword [ebp - 0x18], edi
lea eax, [ebp + 0x198]
push eax
push str._s_settings.bak
lea eax, [ebp + 0x94]
push eax
call fcn.1003b325
add esp, 0xc
lea eax, [ebp + 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1001d687
lea eax, [ebp + 0x94]
cmp dword [ebp + 0x10], 2
jne 0x1001d605
push ebx
push eax
push dword [0x10069bc4]
call dword [sym.imp.ADVAPI32.dll_RegRestoreKeyA]
jmp 0x1001d65a
push eax
mov edi, str.idmtmp
push edi
mov esi, SysStringLen
push esi
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyA]
test eax, eax
jne 0x1001d652
push str.shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x1001d650
push str.SHCopyKeyA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001d649
push 0
push dword [0x10069bc4]
push edi
push esi
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.C:Program_FilesSpyhunter
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 0x10000
push str.Intenet_Download_Manager
cmp eax, 0xffffffff
je 0x1001d67b
push str.Internet_Download_Manager_detected_that_its_registry_keys_had_been_damaged_since_the_last_run._Its_possible_that_you_run_a_flaky_spyware_remover_program_like_Spyhunter_which_corrupted_system_registry._Internet_Download_Manager_will_try_to_restore_all_damaged_data__but_some_data_may_remain_corrupted.
jmp 0x1001d680
push str.Internet_Download_Manager_detected_that_its_registry_keys_had_been_damaged_since_the_last_run._Its_possible_that_you_run_a_flaky_spyware_remover_program_which_corrupted_system_registry._Internet_Download_Manager_will_try_to_restore_all_damaged_data__but_some_data_may_remain_corrupted.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x3e0]
xor ecx, ebp
call fcn.10037f17
add ebp, 0x3e4
leave
ret