Function at 0x100d2737
Capabilities:
Delete file
Get common file path
Move file
Query or enumerate registry value

Disassembly:
push 0x228
mov eax, 0x100f0b55
call fcn.100d393a
mov esi, ecx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x220], esi
push 1
mov dword [ebp - 0x234], esi
call fcn.100c1a98
xor edi, edi
lea eax, [esi + 0xb0]
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
push eax
mov byte [ebp - 4], 1
call sub.MSVCP140.dll__Mtx_init_in_situ
pop ecx
pop ecx
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], bl
push eax
push 1
push edi
push str.SOFTWAREAdobeAcrobat_ReaderDCAVEntitlement
push SysReAllocStringLen
mov dword [ebp - 0x220], 4
mov dword [ebp - 0x228], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100d27e3
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
push eax
push edi
push edi
push str.iNGLLogLevel
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x22c]
test eax, eax
cmove ebx, dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x64
pop eax
push 5
pop ecx
cmp ebx, 0x169d
mov dword [esi + 0xe0], ebx
cmove eax, ecx
mov dword [esi + 0xe4], eax
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
mov ebx, 0xfde9
push eax
push edi
push ebx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
jle 0x100d288b
push 0x101b3e75
push esi
call fcn.10042e1e
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100d288b
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
test eax, eax
jle 0x100d287d
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100d2864
sub ecx, edx
mov esi, 0x101ae7d0
push ecx
push edi
mov ecx, esi
call fcn.10042e1e
jmp 0x100d2882
mov esi, 0x101ae7d0
push edi
call fcn.100d3a96
pop ecx
jmp 0x100d2890
mov esi, 0x101ae7d0
mov edi, 0x101ae7e8
push esi
mov ecx, edi
call fcn.10042e1e
push 0x10
pop ebx
cmp dword [0x101ae7cc], ebx
mov eax, 0x101ae7b8
push dword [0x101ae7c8]
cmovae eax, dword [0x101ae7b8]
mov ecx, edi
push eax
call fcn.10042e1e
cmp dword [0x101ae7b4], ebx
mov eax, 0x101ae7a0
push dword [0x101ae7b0]
cmovae eax, dword [0x101ae7a0]
mov ecx, esi
push eax
call fcn.10042e1e
push esi
mov byte [ebp - 4], 3
call fcn.100d2b5b
pop ecx
test al, al
je 0x100d2979
lea eax, [ebp - 0x224]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [ebp - 0x224], xmm0
call fcn.100d2ab4
pop ecx
pop ecx
test al, al
je 0x100d2979
cmp dword [ebp - 0x220], 0
jl 0x100d2979
jg 0x100d2928
cmp dword [ebp - 0x224], 0x200000
jb 0x100d2979
push edi
call fcn.100d2b5b
pop ecx
test al, al
je 0x100d294a
cmp dword [0x101ae7fc], ebx
mov eax, edi
cmovae eax, dword [0x101ae7e8]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
pop ecx
push edi
call fcn.100d2b5b
pop ecx
test al, al
jne 0x100d2979
cmp dword [0x101ae7fc], ebx
cmovae edi, dword [0x101ae7e8]
cmp dword [0x101ae7e4], ebx
push edi
cmovae esi, dword [0x101ae7d0]
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
pop ecx
pop ecx
mov eax, dword [ebp - 0x230]
jmp 0x100d298d
call fcn.100d3887
ret