Function at 0x1028dc5
Capabilities:
Delete file
Delete registry value
Get common file path
Get system information on windows
Move file
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3dc
mov eax, dword [0x10723e4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 4], eax
push 0x111
lea eax, [ebp - 0x228]
xor ebx, ebx
push eax
mov dword [ebp - 0x234], ebx
call edi
lea eax, [ebp - 0x228]
push 0x1012ac4
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea eax, [ebp - 0x240]
push eax
push 0x18
lea eax, [ebp - 0x2a4]
push eax
push 0x12
call esi
push ebx
mov dword [ebp - 0x260], eax
push 0x138
lea eax, [ebp - 0x3dc]
push eax
push 2
call esi
cmp dword [ebp - 0x260], ebx
jl 0x1028e59
cmp dword [ebp - 0x240], ebx
je 0x1028e71
cmp eax, ebx
jl 0x102903b
cmp dword [ebp - 0x3a8], 0x157c
ja 0x102903b
lea eax, [ebp - 0x22c]
push eax
push 0x20019
push ebx
push str.SystemCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
mov byte [0x1073348], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1028f02
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x24c]
push eax
push ebx
push 0x1012aac
push dword [ebp - 0x22c]
mov dword [ebp - 0x230], 0x222
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1028ef6
cmp dword [ebp - 0x230], ebx
jbe 0x1028ee8
cmp byte [ebp + eax - 0x228], bl
jne 0x1028ee8
inc eax
cmp eax, dword [ebp - 0x230]
jb 0x1028ed6
cmp eax, dword [ebp - 0x230]
jne 0x1028ef6
mov byte [0x1073348], bl
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x1073348], bl
je 0x10290a1
push 0x111
lea eax, [ebp - 0x228]
push eax
mov dword [ebp - 0x234], 1
call edi
push 0x1012ac4
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
push 0x2c
lea eax, [ebp - 0x28c]
push eax
push ebx
call esi
test eax, eax
jl 0x1028f6e
mov eax, 0x10000
cmp dword [ebp - 0x280], eax
jbe 0x1028f5c
mov dword [ebp - 0x280], eax
mov esi, dword [ebp - 0x284]
imul esi, dword [ebp - 0x280]
shr esi, 0x14
jmp 0x1028f71
push 0x40
pop esi
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push ebx
mov eax, esi
cdq
mov edi, 0x100000
push edi
push edx
push eax
call fcn.0103d579
push ebx
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x248], eax
push ebx
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x244], edx
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x102903b
jmp 0x1028ff3
cmp esi, ebx
jle 0x1029022
dec esi
dec esi
push ebx
mov eax, esi
cdq
push edi
push edx
push eax
call fcn.0103d579
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x244], edx
push ebx
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.ntdll.dll_NtCreatePagingFile]
test eax, eax
jl 0x1028fc9
push 4
push ebx
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov eax, dword fs:[0x18]
push dword [ebp - 0x250]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
lea eax, [ebp - 0x22c]
push eax
push 0x20006
push ebx
push str.SystemCurrentControlSetControlSession_ManagerMemory_Management
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10290a1
cmp dword [ebp - 0x234], 1
jne 0x1029084
push 4
lea eax, [ebp - 0x234]
push eax
push 4
push ebx
push str.TempPageFile
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1029095
push str.TempPageFile
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0103d24a
leave
ret