Function at 0x410eb8
Capabilities:
Delete file
Get file size
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xffffffe8
mov ebx, 0x491d7c
mov esi, 0x494892
mov eax, dword [0x48bc6c]
call fcn.00412904
call fcn.00412584
mov byte [0x49481b], al
cmp byte [0x49481b], 0
je 0x410f27
lea eax, [esp + 4]
push eax
mov eax, dword [0x48d62c]
mov eax, dword [eax]
push eax
push 0x80000001
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x410f27
mov dword [esp], 0x1e1c
push esp
push ebx
push 0
push 0
mov eax, dword [0x48bc68]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x410f2c
call fcn.00410e38
jmp 0x410f2c
call fcn.00410e38
mov al, byte [ebx + 0x18b6]
mov byte [0x49481e], al
xor eax, eax
mov al, byte [0x49483a]
cmp word [ebx + eax*2 + 0x180e], 0
jne 0x410f62
xor edx, edx
mov dl, byte [0x49483d]
add edx, edx
add dx, word [0x48c1c0]
mov word [ebx + eax*2 + 0x180e], dx
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0x30
call sub.user32.dll_SystemParametersInfoA
mov ax, word [esp + 0x14]
sub ax, word [esp + 0xc]
mov word [esi], ax
mov ax, word [esp + 0x10]
sub ax, word [esp + 8]
mov word [0x494894], ax
cmp word [esi], 0x258
je 0x410fab
cmp word [esi], 0x300
je 0x410fab
cmp word [esi], 0x360
je 0x410fab
cmp word [esi], 0x400
jne 0x410faf
sub word [esi], 2
xor eax, eax
mov al, byte [0x49483a]
cmp word [ebx + eax*2 + 0x1802], 0
jne 0x410fcc
mov dx, word [esi]
mov word [ebx + eax*2 + 0x1802], dx
mov eax, 0x411144
call fcn.00412904
call fcn.00412584
test al, al
je 0x410ff0
push 0x499714
call sub.kernel32.dll_DeleteFileA_1
mov byte [ebx + 0x188c], 0
mov eax, 0x411150
call fcn.00412904
call fcn.00412584
test al, al
je 0x411014
push 0x499714
call sub.kernel32.dll_DeleteFileA_1
mov byte [ebx + 0x188c], 2
mov eax, 0x41115c
call fcn.00412904
call fcn.00412584
test al, al
je 0x411038
push 0x499714
call sub.kernel32.dll_DeleteFileA_1
mov byte [ebx + 0x188c], 3
mov eax, 0x411168
call fcn.00412904
call fcn.00412584
test al, al
je 0x41105c
push 0x499714
call sub.kernel32.dll_DeleteFileA_1
mov byte [ebx + 0x188c], 4
mov eax, 0x411174
call fcn.00412904
call fcn.00412584
test al, al
je 0x411080
push 0x499714
call sub.kernel32.dll_DeleteFileA_1
mov byte [ebx + 0x188c], 5
push 4
push 0x1000
xor eax, eax
mov al, byte [ebx + 0x18a0]
imul eax, eax, 0x12c
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [0x493bb8], eax
cmp dword [0x493bb8], 0
je 0x41113c
xor eax, eax
mov al, byte [ebx + 0x18a0]
imul eax, eax, 0x12c
mov dword [esp], eax
cmp byte [0x49481b], 0
je 0x4110e8
push esp
mov eax, dword [0x493bb8]
push eax
push 0
push 0
mov eax, dword [0x48bc64]
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x41113c
mov eax, dword [0x48bc64]
call fcn.00412904
mov ecx, 0x8000000
mov edx, 0x80000000
call fcn.0040eba4
mov esi, eax
push 0
push esi
call sub.kernel32.dll_GetFileSize_1
mov ecx, 0x12c
xor edx, edx
div ecx
mov edx, eax
xor eax, eax
mov al, byte [ebx + 0x18a0]
call fcn.0040bb7c
imul eax, eax, 0x12c
push eax
mov eax, dword [0x493bb8]
push eax
push esi
call sub.kernel32.dll__lread
push esi
call sub.kernel32.dll_CloseHandle_1
add esp, 0x18
pop esi
pop ebx
ret