Function at 0x10ca6a8
Capabilities:
Create directory
Delete file
Query environment variable
Query or enumerate registry value
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa64
mov eax, dword [0x10e607c]
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x34]
mov ebx, dword [esi + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
test byte [eax + 0x41], 0x40
mov dword [ebp - 0xa5c], esi
mov dword [ebp - 0xa58], eax
mov dword [ebp - 0xa60], ecx
mov dword [ebp - 0xa4c], ebx
mov dword [ebp - 0xa44], 0x80
mov dword [ebp - 0xa54], edi
mov dword [ebp - 0xa38], edi
jne 0x10ca70f
cmp word [ecx + 0x30], di
je 0x10ca70f
mov dword [ebp - 0xa44], 4
mov word [eax + 0x88], di
mov dword [eax + 0x84], edi
mov eax, dword [eax + 0x7c]
mov eax, dword [eax + 0x18]
push 0x10125f0
push dword [esi + 0xc]
mov dword [ebp - 0xa40], eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x10ca790
lea eax, [ebp - 0xa3c]
push eax
lea eax, [ebp - 0xa34]
push eax
lea eax, [ebp - 0xa50]
push eax
push 0x1012704
push dword [ebp - 0xa40]
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x14
push dword [ebp - 0xa3c]
push dword [ebp - 0xa34]
push dword [ebp - 0xa50]
push esi
call fcn.010ab9f3
cmp eax, edi
je 0x10ca790
mov ebx, dword [eax + 0x10]
mov dword [ebp - 0xa40], edi
mov dword [ebp - 0xa4c], ebx
push edi
push edi
lea eax, [ebp - 0xa30]
push eax
push dword [ebp - 0xa40]
push ebx
push esi
call fcn.010bab05
test ax, ax
jne 0x10caece
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x5c]
test byte [eax + 0x10], 0x80
je 0x10ca7c5
mov dword [ebp - 0xa54], 0x200000
mov eax, dword [ebp - 0xa58]
mov eax, dword [eax + 0x40]
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, dword [sym.imp.msvcrt.dll_wcschr]
and eax, 0x4000
neg eax
sbb eax, eax
and eax, 0x400f0183
add eax, 0xc10d0000
cmp dword [0x10f8840], 0
mov dword [ebp - 0xa3c], eax
mov ebx, 0x208
jne 0x10ca848
push ebx
push 0x10f8430
push 0x1013708
call edi
test eax, eax
mov dword [0x10f8428], eax
je 0x10ca841
cmp eax, ebx
ja 0x10ca841
push 0x3a
push 0x10f8430
call esi
test eax, eax
pop ecx
pop ecx
je 0x10ca848
add eax, 0xfffffffe
push eax
mov dword [0x10f8840], eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov dword [0x10f8428], eax
jmp 0x10ca848
and dword [0x10f8428], 0
push 0x104
lea eax, [ebp - 0xa2c]
push eax
push 0x10136c0
call edi
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.msvcrt.dll__wcsupr]
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
push 0x5c
push dword [ebp - 0xa30]
mov dword [ebp - 0xa48], eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
add esp, 0x10
test eax, eax
mov dword [ebp - 0xa34], eax
je 0x10cabd9
add eax, 2
push 0x10136a4
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10caab4
mov eax, dword [ebp - 0xa34]
add eax, 2
push 0x1013688
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10caab4
mov eax, dword [ebp - 0xa34]
add eax, 2
push 0x1013670
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x10caa39
push ebx
lea eax, [ebp - 0x414]
push eax
push 0x10135e0
call edi
push dword [ebp - 0xa34]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x414]
push 0x3a
push eax
call esi
push 0x3a
push dword [ebp - 0xa30]
mov edi, eax
call esi
add esp, 0x18
test edi, edi
je 0x10cac73
test eax, eax
je 0x10cac73
add eax, 0xfffffffe
push eax
add edi, 0xfffffffe
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x10cac73
lea eax, [ebp - 0xa48]
push eax
push 0x20019
push 0
push 0x1013560
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10cac73
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
lea eax, [ebp - 0x414]
push 0x1005efc
push eax
call edi
pop ecx
pop ecx
lea eax, [ebp - 0xa50]
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0xa64]
push eax
push 0
push 0x1013550
push dword [ebp - 0xa48]
mov dword [ebp - 0xa50], 0x40c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10cac73
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x414]
push 0x3a
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x10ca9f8
add eax, 2
push eax
push dword [ebp - 0xa4c]
call edi
pop ecx
pop ecx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov ecx, 0x207
sub ecx, eax
push ecx
push dword [ebp - 0xa34]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.msvcrt.dll_wcsncat]
add esp, 0x10
and word [ebp - 6], 0
lea eax, [ebp - 0x414]
mov dword [ebp - 0xa30], eax
jmp 0x10cac73
mov eax, dword [ebp - 0xa34]
add eax, 2
push 0x100c840
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x10caa63
push ebx
lea eax, [ebp - 0x824]
push eax
push 0x1013510
jmp 0x10caac1
mov eax, dword [ebp - 0xa34]
add eax, 2
push 0x100c820
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10caa54
mov eax, dword [ebp - 0xa34]
add eax, 2
push 0x100c830
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10caa54
mov eax, dword [ebp - 0xa34]
add eax, 2
push 0x10134f4
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x10cab15
push ebx
lea eax, [ebp - 0x824]
push eax
push 0x10134b8
call edi
push dword [ebp - 0xa34]
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x824]
push 0x3a
push eax
call esi
push 0x3a
push dword [ebp - 0xa30]
mov edi, eax
call esi
add esp, 0x18
test edi, edi
je 0x10cac73
test eax, eax
je 0x10cac73
add eax, 0xfffffffe
push eax
add edi, 0xfffffffe
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
jmp 0x10cac65
mov eax, dword [ebp - 0xa34]
add eax, 2
push 0x10134a8
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x10cabd9
push ebx
lea eax, [ebp - 0x414]
push eax
push 0x1013438
call edi
push dword [ebp - 0xa34]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x414]
push 0x3a
push eax
call esi
push 0x3a
push dword [ebp - 0xa30]
mov dword [ebp - 0xa34], eax
call esi
add esp, 0x18
cmp dword [ebp - 0xa34], 0
je 0x10cac73
test eax, eax
je 0x10cac73
add eax, 0xfffffffe
push eax
mov eax, dword [ebp - 0xa34]
add eax, 0xfffffffe
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x10cac73
push ebx
lea eax, [ebp - 0x414]
push eax
push 0x1013400
call edi
push 0
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
lea eax, [ebp - 0x414]
push eax
push 0x10133c0
call edi
jmp 0x10caa28
push 4
push 0x1005efc
push dword [ebp - 0xa30]
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x10cac08
mov eax, dword [ebp - 0xa30]
add eax, 8
push eax
push 0
call sub.sfc_os.dll_SfcIsFileProtected
test eax, eax
jne 0x10cac69
push dword [ebp - 0xa30]
push 0
call sub.sfc_os.dll_SfcIsFileProtected
test eax, eax
jne 0x10cac69
push dword [ebp - 0xa48]
mov edi, dword [sym.imp.msvcrt.dll__wcsnicmp]
push dword [ebp - 0xa30]
lea eax, [ebp - 0xa2c]
push eax
call edi
add esp, 0xc
test eax, eax
je 0x10cac69
push 0x3a
push dword [ebp - 0xa30]
call esi
test eax, eax
pop ecx
pop ecx
je 0x10cac73
mov ecx, dword [0x10f8840]
test ecx, ecx
je 0x10cac73
push dword [0x10f8428]
add eax, 0xfffffffe
push eax
push ecx
call edi
add esp, 0xc
test eax, eax
jne 0x10cac73
mov dword [ebp - 0xa38], 1
mov esi, dword [ebp - 0xa58]
test byte [esi + 0x41], 0x40
jne 0x10cac98
mov eax, dword [ebp - 0xa60]
cmp word [eax + 0x30], 0
je 0x10cac98
push dword [ebp - 0xa30]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp word [ebp - 0xa38], 0
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
je 0x10cacbc
or dword [esi + 0x80], 0xffffffff
push 0x20
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10cad86
mov ebx, dword [ebp - 0xa54]
or ebx, dword [ebp - 0xa44]
push 0
or ebx, 0xa000000
push ebx
push 2
push 0
push 7
push dword [ebp - 0xa3c]
push dword [ebp - 0xa30]
call edi
mov dword [esi + 0x80], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.010ac058
cmp dword [esi + 0x80], 0xffffffff
jne 0x10cae74
cmp ax, 0xfe05
jne 0x10cad44
push 0x80
push dword [ebp - 0xa30]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push ebx
push 2
push 0
push 7
push dword [ebp - 0xa3c]
push dword [ebp - 0xa30]
call edi
mov dword [esi + 0x80], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.010ac058
cmp dword [esi + 0x80], 0xffffffff
jne 0x10cae74
cmp ax, 0xfe05
jne 0x10cad86
mov eax, dword [ebp - 0xa3c]
push 0
push ebx
push 2
push 0
push 7
and eax, 0xfeffffff
push eax
push dword [ebp - 0xa30]
call edi
mov dword [esi + 0x80], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.010ac058
cmp dword [esi + 0x80], 0xffffffff
jne 0x10cae74
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push ebx
call fcn.010ac058
mov dword [ebp - 0xa34], eax
mov eax, dword [ebp - 0xa5c]
mov eax, dword [eax + 4]
test byte [eax + 0x60], 0x80
jne 0x10cae8a
cmp ebx, 0x20
je 0x10cadcb
cmp ebx, 0x4c8
jne 0x10cae8a
push dword [ebp - 0xa30]
push eax
call fcn.0109eea7
test ax, ax
je 0x10cade5
mov word [esi + 0x88], 1
push 0x1012624
push dword [ebp - 0xa30]
call fcn.010b2fb3
test eax, eax
mov dword [ebp - 0xa38], eax
je 0x10cae8a
mov eax, dword [ebp - 0xa54]
or eax, dword [ebp - 0xa44]
mov ebx, eax
xor eax, eax
push eax
or ebx, 0xa000000
push ebx
push 4
push eax
push eax
push 0xc10c0000
push dword [ebp - 0xa38]
call edi
cmp eax, 0xffffffff
mov dword [esi + 0x80], eax
jne 0x10cae53
push 0
push ebx
push 4
push 0
push 7
push 0xc00c0000
push dword [ebp - 0xa38]
call edi
mov dword [esi + 0x80], eax
cmp dword [esi + 0x80], 0xffffffff
je 0x10cae7d
mov edi, dword [ebp - 0xa38]
push edi
push dword [ebp - 0xa30]
call fcn.010b9498
mov dword [esi + 0x84], edi
and dword [ebp - 0xa34], 0
jmp 0x10cae8a
push dword [ebp - 0xa38]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov edi, dword [ebp - 0xa5c]
push edi
call fcn.010ba429
cmp word [ebp - 0xa34], 0
je 0x10caf54
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push 1
mov ebx, eax
lea eax, [ebp - 0xa30]
push eax
push dword [ebp - 0xa40]
push dword [ebp - 0xa4c]
push edi
call fcn.010bab05
test ax, ax
je 0x10caed7
or ax, 0xffff
jmp 0x10caf57
mov esi, dword [sym.imp.msvcrt.dll_wcsncmp]
push 8
push 0x1012740
push dword [ebp - 0xa30]
call esi
add esp, 0xc
test eax, eax
jne 0x10caf08
add dword [ebp - 0xa30], 0xc
mov eax, dword [ebp - 0xa30]
mov dword [eax], 0x5c005c
jmp 0x10caf25
push 4
push 0x1005efc
push dword [ebp - 0xa30]
call esi
add esp, 0xc
test eax, eax
jne 0x10caf25
add dword [ebp - 0xa30], 8
push dword [ebp - 0xa30]
push 0x232f
push ebx
push 0
push edi
call fcn.0108dc85
push edi
call fcn.010ba429
xor eax, eax
cmp word [ebp - 0xa34], 0xfe30
sete al
add eax, 0xfffffe3f
jmp 0x10caf57
xor ax, ax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01078836
leave
ret 4