Function at 0x10029438
Capabilities:
Move file
Set registry value

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
mov ebx, section..data
mov ebp, 0x101d4a68
cmp eax, ebx
je 0x10029462
push ebp
push 0x1d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
mov eax, dword [0x10255f54]
xor esi, esi
test eax, eax
je 0x10029478
push esi
push esi
push 0x12
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.100314e1
mov edi, esi
cmp dword [0x10255778], esi
je 0x10029717
cmp dword [0x102556dc], esi
je 0x1002966e
push 0xb
call fcn.10028633
pop ecx
cmp word [eax], 0x31
jne 0x100294dd
xor edi, edi
inc edi
mov eax, dword [section..data]
cmp eax, ebx
je 0x100294c2
push ebp
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
push 2
push 0x101d46f4
push 1
push esi
push 0x101d46f8
push dword [0x10255dac]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0xa
mov esi, 0x101d46fc
call fcn.10028633
pop ecx
mov cx, word [eax]
cmp cx, word [esi]
jne 0x10029512
test cx, cx
je 0x1002950c
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x10029512
add eax, 4
add esi, 4
test cx, cx
jne 0x100294ea
xor esi, esi
mov eax, esi
jmp 0x10029519
sbb eax, eax
or eax, 1
xor esi, esi
test eax, eax
push 0x15
sete bl
mov byte [esp + 0x18], bl
call fcn.10028633
pop ecx
push eax
lea ecx, [esp + 0x14]
call fcn.100224c2
lea eax, [esp + 0x10]
push eax
call fcn.100285f2
mov ecx, eax
call fcn.1003b804
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.1000c230
push dword [esp + 0x14]
call fcn.100285f2
mov ecx, eax
call fcn.1003b814
cmp dword [0x102556d8], 0
je 0x10029694
mov eax, dword [section..data]
cmp eax, section..data
je 0x10029590
push ebp
push 0x1f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
mov eax, dword [section..data]
add esp, 0x10
test bl, bl
je 0x10029652
test edi, edi
je 0x10029652
mov ebx, section..data
cmp eax, ebx
je 0x100295ba
push ebp
push 0x20
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
call fcn.10010450
push eax
lea ecx, [esp + 0x14]
call fcn.1000c200
push str.DTPro.exe
push 0xc
call fcn.10028633
pop ecx
push eax
lea eax, [esp + 0x18]
push str.__s_s_
push eax
call fcn.10022679
add esp, 0x10
mov eax, dword [section..data]
mov esi, dword [esp + 0x10]
cmp eax, ebx
je 0x10029623
cmp dword [esi - 4], 1
jle 0x10029611
push dword [esi - 0xc]
lea ecx, [esp + 0x14]
call fcn.1000ba60
mov esi, dword [esp + 0x10]
mov eax, dword [section..data]
push esi
push ebp
push 0x21
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002e42c
add esp, 0x14
push esi
call fcn.1015ab60
pop ecx
test al, al
jne 0x10029648
mov eax, dword [section..data]
cmp eax, ebx
je 0x10029648
push ebp
push 0x22
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
lea ecx, [esi - 0x10]
call fcn.1000c230
jmp 0x1002966e
call fcn.100289a0
test al, al
je 0x10029669
push 4
push esi
push 0x10255ba0
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov ebx, section..data
call fcn.10028da4
mov eax, dword [section..data]
cmp eax, ebx
je 0x1002968d
push ebp
push 0x2b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
mov eax, dword [section..data]
mov ebx, section..data
cmp eax, ebx
je 0x100296b3
push ebp
push 0x29
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
push 0xa
call fcn.10028633
pop ecx
cmp word [eax], 0x30
jne 0x100296d3
test edi, edi
je 0x100296d3
push 0x101d47fc
push 0xa
call fcn.10028647
pop ecx
pop ecx
push 0xa
call fcn.10028633
pop ecx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x100296de
sub eax, edx
sar eax, 1
lea eax, [eax*2 + 2]
push eax
push 0xa
call fcn.10028633
pop ecx
push eax
push 1
push esi
push 0x101d4800
push dword [0x10255dac]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1002966e
mov eax, dword [section..data]
cmp eax, ebx
je 0x1002966e
push ebp
push 0x2a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
jmp 0x1002966e