Function at 0x409d19
Capabilities:
Delete directory
Delete file
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1234
call fcn.00412450
and word [ebp - 0x82c], 0
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x82a]
and word [ebp - 0x1234], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x1232]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x41fcd0
push 0x41fcb0
lea eax, [ebp - 0x1234]
mov ebx, 0x103
push 0x3ff
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], ebx
call esi
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1234]
push 0x41ffe4
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x409e9f
xor edx, edx
mov ecx, 0x81
lea edi, [ebp - 0x41a]
mov word [ebp - 0x41c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x41c]
push eax
push edx
push edx
push 0x19
push edx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x409e2d
and word [ebp - 0x214], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x41ffd0
lea eax, [ebp - 0x214]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
push 0x208
lea eax, [ebp - 0x41c]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
push edi
push edi
push 0x10
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x409e9f
mov word [ebp - 0x214], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x41ffd0
lea eax, [ebp - 0x214]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and word [ebp - 0x624], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x622]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 4], 0x417aa8
lea eax, [ebp - 0x624]
xor edi, edi
push eax
mov eax, dword [ebp - 4]
push edi
push edi
push dword [eax - 8]
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x409f74
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x409f74
cmp dword [eax - 4], edi
je 0x409f32
mov word [ebp - 0x214], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
push dword [ebp - 4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x624]
push eax
push 0x417590
lea eax, [ebp - 0x214]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x409f72
mov word [ebp - 0x41c], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x41a]
push dword [ebp - 4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x624]
push eax
push 0x417590
lea eax, [ebp - 0x41c]
push ebx
push eax
call esi
lea eax, [ebp - 0x41c]
push eax
call fcn.0040bf9f
add esp, 0x18
xor edi, edi
add dword [ebp - 4], 0x210
cmp dword [ebp - 4], 0x419998
jl 0x409ebf
lea eax, [ebp - 0x624]
push eax
push edi
push edi
push 2
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov word [ebp - 0xa34], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa32]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x624]
push eax
push 0x41ffb8
lea eax, [ebp - 0xa34]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0xa34]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret