Function at 0x1006b95
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xac
push ebx
mov ebx, dword [ebp + 0x10]
xor ecx, ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x30], ecx
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x20]
push ecx
stosd dword es:[edi], eax
lea ecx, [ebx + 0x410]
push ecx
stosd dword es:[edi], eax
mov eax, dword [esi]
push esi
call dword [eax + 0xc0]
test eax, eax
jl 0x1006c34
lea eax, [ebp - 0x30]
push eax
push ebx
call fcn.0100c0c5
test eax, eax
mov dword [ebp - 4], eax
jl 0x1006c34
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0x30]
push ebx
push eax
call fcn.01005c90
test eax, eax
mov dword [ebp - 4], eax
jl 0x1006c34
mov edi, dword [ebp + 0x18]
and dword [ebp + 0xc], 0
test edi, edi
jbe 0x1006b47
mov ebx, dword [ebp - 8]
xor eax, eax
cmp dword [ebx], eax
jne 0x1006b07
mov eax, dword [esi]
lea ecx, [ebp - 0xac]
push ecx
push dword [ebp - 0x20]
push esi
call dword [eax + 0xe0]
test eax, eax
mov dword [ebp - 4], eax
jl 0x1006c34
mov al, byte [ebx + 0x22f]
lea ecx, [ebp - 0xac]
push ecx
mov byte [ebp - 0x6a], al
mov eax, dword [esi]
push esi
call dword [eax + reloc.ADVAPI32.dll_RegQueryInfoKeyA]
lea ecx, [ebp - 0xac]
push ecx
mov dword [ebp - 4], eax
mov eax, dword [esi]
push esi
call dword [eax + 0x28]
cmp dword [ebp - 4], 0
jmp 0x1006b2c
cmp dword [ebx + 0x20b], eax
jne 0x1006b32
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x20]
push dword [ebp - 8]
push edi
push ebx
push esi
push dword [ebp + 8]
call fcn.01006596
mov dword [ebp - 4], eax
test eax, eax
jl 0x1006c34
inc dword [ebp + 0xc]
add ebx, 0x23c
cmp dword [ebp + 0xc], edi
jb 0x1006ab7
mov ebx, dword [ebp + 0x10]
cmp dword [ebx + 0x630], 4
jne 0x1006c34
mov eax, dword [0x100e2c4]
mov edx, dword [eax]
lea ecx, [edi*8 + 4]
push ecx
push eax
mov dword [ebp + 0x10], ecx
call dword [edx + LCMapStringW]
mov ecx, eax
test ecx, ecx
mov dword [ebp - 0xc], ecx
jne 0x1006b7f
mov dword [ebp - 4], 0x8007000e
jmp 0x1006c34
xor edx, edx
test edi, edi
mov dword [ecx], edi
jbe 0x1006ba4
mov eax, dword [ebp - 8]
mov esi, dword [eax]
mov dword [ecx + edx*8 + 4], esi
mov esi, dword [eax + 0x238]
mov dword [ecx + edx*8 + 8], esi
inc edx
add eax, 0x23c
cmp edx, edi
jb 0x1006b8a
lea eax, [ebp - 0x10]
push eax
push 0x100209c
push 1
xor esi, esi
push esi
push 0x10020ac
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1006c34
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x18]
push edx
push 0x100208c
push eax
call dword [ecx + reloc.KERNEL32.dll_SetEndOfFile]
test eax, eax
jl 0x1006c34
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
lea edx, [ebp - 0x14]
push edx
push 0x20006
push eax
call dword [ecx + HeapFree]
test eax, eax
jl 0x1006c34
lea eax, [ebp - 0x1c]
push eax
push 0xf003f
push esi
push 0x1001ff0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1006c12
mov dword [ebp - 4], 0x800c0064
jmp 0x1006c34
push dword [ebp + 0x10]
push dword [ebp - 0xc]
push 3
push esi
push 0x1001fe0
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1006c34
mov dword [ebp - 4], 0x800c007e
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
cmp dword [ebp - 0x1c], edi
je 0x1006c46
push dword [ebp - 0x1c]
call esi
cmp dword [ebp - 0x14], edi
je 0x1006c50
push dword [ebp - 0x14]
call esi
cmp dword [ebp - 0xc], edi
je 0x1006c63
mov eax, dword [0x100e2c4]
push dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + HeapFree]
cmp dword [ebp - 8], edi
je 0x1006c76
mov eax, dword [0x100e2c4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + HeapFree]
mov eax, dword [ebp - 0x18]
cmp eax, edi
je 0x1006c86
mov ecx, dword [eax]
push eax
call dword [ecx + reloc.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x10]
cmp eax, edi
je 0x1006c96
mov ecx, dword [eax]
push eax
call dword [ecx + reloc.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x30]
push eax
call fcn.0100c081
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x14