Function at 0x23a19b30
Capabilities:
Delete file
Move file
Query or enumerate registry value
Resolve function by parsing pe exports
Set file attributes
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x23bcf5ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xa4
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.23a198f0
mov eax, dword [edi + 0xb8]
mov ecx, dword [edi + 0xbc]
mov edx, dword [edi + 0xc0]
mov dword [edi + 0x14c], eax
mov eax, dword [edi + 0xc4]
mov dword [edi + 0x150], ecx
mov dword [edi + 0x154], edx
mov dword [edi + 0x158], eax
xor eax, eax
xor ecx, ecx
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], eax
mov word [esp + 0x44], cx
mov ebx, dword [edi + 0x378]
mov dword [esp + 0xbc], eax
mov eax, dword [edi + 0x390]
mov eax, dword [eax]
mov ebp, eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebp
mov esi, dword [edi + 0x390]
mov eax, dword [edi + 0x378]
test ebx, ebx
je 0x23a19bd4
cmp ebx, eax
je 0x23a19bd9
call fcn.23a49e3d
cmp ebp, esi
je 0x23a19d18
test ebx, ebx
jne 0x23a19c01
call fcn.23a49e3d
xor eax, eax
cmp ebp, dword [eax + 0x18]
jne 0x23a19bf6
call fcn.23a49e3d
cmp dword [ebp + 0x24], 8
jb 0x23a19c05
mov ebp, dword [ebp + 0x10]
jmp 0x23a19c08
mov eax, dword [ebx]
jmp 0x23a19bec
add ebp, 0x10
push ebp
lea ecx, [esp + 0x28]
call fcn.23a01070
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x84]
lea esi, [edi + 0x358]
push eax
mov ecx, esi
call fcn.23a11460
cmp dword [esp + 0x3c], 8
jb 0x23a19c40
mov ecx, dword [esp + 0x28]
push ecx
call fcn.23a2ed1b
add esp, 4
mov eax, dword [esi + 0x18]
mov esi, dword [esi]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x80]
xor edx, edx
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], dx
test eax, eax
je 0x23a19c72
cmp eax, esi
je 0x23a19c77
call fcn.23a49e3d
mov ecx, dword [esp + 0x94]
cmp dword [esp + 0x84], ecx
je 0x23a19cfe
lea edx, [esp + 0x40]
push edx
push ebp
mov ecx, edi
call fcn.23a138c0
test ebx, ebx
jne 0x23a19d14
call fcn.23a49e3d
mov esi, dword [esp + 0x1c]
cmp esi, dword [ebx + 0x18]
jne 0x23a19cab
call fcn.23a49e3d
push ebp
lea ebx, [esi + 0x28]
mov esi, dword [sym.Setup.exe_void___cdecl_logInformation_wchar_t_const__]
push str.Extracting_package:__s
call esi
mov eax, dword [esp + 0x4c]
mov ebp, 8
add esp, 8
cmp dword [esp + 0x58], ebp
jae 0x23a19cd2
lea eax, [esp + 0x44]
push eax
push str.with_base_path:__s
call esi
mov eax, dword [esp + 0x4c]
add esp, 8
cmp dword [esp + 0x58], ebp
jae 0x23a19ceb
lea eax, [esp + 0x44]
push eax
push ebx
mov ecx, edi
call fcn.23a15c80
push str.Package_extracted_r_n
call esi
add esp, 4
lea ecx, [esp + 0x18]
call fcn.23a10170
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x1c]
jmp 0x23a19bc0
mov ebx, dword [ebx]
jmp 0x23a19c9d
cmp dword [esp + 0x58], 8
mov dword [esp + 0xbc], 0xffffffff
jb 0x23a19d37
mov eax, dword [esp + 0x44]
push eax
call fcn.23a2ed1b
add esp, 4
mov ecx, edi
call fcn.23a195f0
lea esi, [edi + 0x230]
mov ecx, esi
call fcn.23a11170
test al, al
je 0x23a19e79
lea ebp, [edi + 0x19c]
mov ecx, ebp
call fcn.23a11170
test al, al
je 0x23a19e79
mov ecx, esi
mov bl, 1
call fcn.23a118f0
mov ecx, ebp
call fcn.23a118f0
mov eax, dword [edi + 0x2c]
push str.Config.xml
push eax
lea ecx, [edi + 0x58]
call fcn.23a034b0
mov ecx, esi
call fcn.23a11200
lea ebp, [edi + 0x19c]
mov ecx, ebp
call fcn.23a11200
test bl, bl
jne 0x23a19dc7
lea ecx, [esp + 0x17]
push ecx
mov ecx, esi
mov byte [esp + 0x1b], bl
call fcn.23a112a0
lea edx, [esp + 0x17]
push edx
mov ecx, ebp
call fcn.23a112a0
cmp byte [esp + 0x17], bl
je 0x23a19dc7
or dword [edi + 0x20], 8
lea eax, [esp + 0x17]
push eax
lea ecx, [esp + 0x1b]
push ecx
lea ecx, [esp + 0x68]
call fcn.23a13440
mov eax, dword [edi + 0x2dc]
mov eax, dword [eax]
mov esi, dword [edi + 0x2c4]
mov ebx, eax
mov dword [esp + 0xbc], 1
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebx
lea ecx, [ecx]
mov ebp, dword [edi + 0x2dc]
mov eax, dword [edi + 0x2c4]
test esi, esi
je 0x23a19e14
cmp esi, eax
je 0x23a19e19
call fcn.23a49e3d
cmp ebx, ebp
je 0x23a1a116
test esi, esi
jne 0x23a19e80
call fcn.23a49e3d
cmp ebx, dword [esi + 0x18]
jne 0x23a19e34
call fcn.23a49e3d
cmp dword [edi + 0x30], 2
mov esi, dword [ebx + 0x28]
mov dword [edi + 0x24], 4
mov ebp, esi
jne 0x23a19e6e
mov eax, dword [edi + 0x2c]
mov ecx, dword [eax - 0xc]
push ecx
push esi
push eax
call fcn.23a4a133
add esp, 0xc
test eax, eax
jne 0x23a19e6e
mov edx, dword [edi + 0x2c]
mov eax, dword [edx - 0xc]
cmp word [esi + eax*2], 0x5c
lea ebp, [esi + eax*2]
jne 0x23a19e6e
add ebp, 2
lea ecx, [edi + 0x28]
test ebp, ebp
jne 0x23a19e84
xor eax, eax
jmp 0x23a19e9f
xor bl, bl
jmp 0x23a19d89
mov esi, dword [esi]
jmp 0x23a19e2a
mov eax, ebp
lea ebx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x23a19e90
sub eax, ebx
sar eax, 1
push eax
push ebp
call fcn.23a10f60
mov eax, dword [edi]
mov edx, dword [eax + 4]
mov ecx, edi
call edx
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x58], 7
mov dword [esp + 0x54], ebx
mov word [esp + 0x44], ax
mov eax, esi
mov byte [esp + 0xbc], 2
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x23a19ed1
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x48]
call fcn.23a02320
lea ecx, [esp + 0x40]
mov byte [esp + 0xbc], 3
call fcn.23a035f0
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x94]
push edx
lea ecx, [esp + 0x68]
call fcn.23a15e00
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [edi + 0x20]
shr eax, 3
test al, 1
je 0x23a19f82
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x23a19f4f
push esi
push str.File___s__scheduled_to_be_deleted_after_reboot
call dword [0x23c41f20]
add esp, 8
mov ebp, 8
jmp 0x23a1a0e5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.MoveFileEx___s___NULL__MOVEFILE_DELAY_UNTIL_REBOOT__failed_with_0x_08X_error
call dword [0x23c41f28]
add esp, 0xc
cmp dword [esp + 0x58], 8
mov byte [esp + 0xbc], 1
jb 0x23a1a100
mov ecx, dword [esp + 0x44]
push ecx
jmp 0x23a1a0f8
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x23a19fb9
push esi
push str.File_deleted:__s
call dword [0x23c41f28]
add esp, 8
cmp dword [esp + 0x58], 8
mov byte [esp + 0xbc], 1
jb 0x23a1a100
mov edx, dword [esp + 0x44]
push edx
jmp 0x23a1a0f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
push ebp
push esi
push str.DeleteFile___s___failed_with_0x_08X_error
call dword [0x23c41f28]
add esp, 0xc
cmp ebp, 0x20
je 0x23a19fe5
cmp ebp, 5
je 0x23a19fe5
cmp dword [esp + 0x58], 8
jmp 0x23a1a0e9
xor ecx, ecx
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], ebx
mov word [esp + 0x28], cx
lea ecx, [esp + 0x24]
mov byte [esp + 0xbc], 4
call fcn.23a037d0
mov eax, dword [esp + 0x28]
mov ebp, 8
cmp dword [esp + 0x3c], ebp
jae 0x23a1a01c
lea eax, [esp + 0x28]
mov ebx, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 3
push eax
push esi
call ebx
test eax, eax
jne 0x23a1a090
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x3c], ebp
jae 0x23a1a040
lea ecx, [esp + 0x28]
push eax
push ecx
push esi
push str.MoveFileEx___s_____s___failed_with_0x_08X_error
call dword [0x23c41f28]
add esp, 0x10
cmp dword [esp + 0x3c], ebp
jb 0x23a1a064
mov edx, dword [esp + 0x28]
push edx
call fcn.23a2ed1b
add esp, 4
xor eax, eax
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 0
mov word [esp + 0x28], ax
mov byte [esp + 0xbc], 1
cmp dword [esp + 0x58], ebp
jb 0x23a1a100
mov ecx, dword [esp + 0x44]
push ecx
jmp 0x23a1a0f8
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x3c], ebp
jae 0x23a1a09e
lea eax, [esp + 0x28]
push 4
push 0
push eax
call ebx
test eax, eax
jne 0x23a1a0cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x3c], ebp
jae 0x23a1a0bd
lea ecx, [esp + 0x28]
push eax
push ecx
push str.MoveFileEx___s___NULL__MOVEFILE_DELAY_UNTIL_REBOOT__failed_with_0x_08X_error
call dword [0x23c41f28]
add esp, 0xc
jmp 0x23a1a051
or dword [edi + 0x20], ebp
cmp dword [esp + 0x3c], ebp
jb 0x23a1a0e5
mov edx, dword [esp + 0x28]
push edx
call fcn.23a2ed1b
add esp, 4
cmp dword [esp + 0x58], ebp
mov byte [esp + 0xbc], 1
jb 0x23a1a100
mov eax, dword [esp + 0x44]
push eax
call fcn.23a2ed1b
add esp, 4
lea ecx, [esp + 0x18]
call fcn.23a0ffd0
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
jmp 0x23a19e00
mov dword [edi + 0x24], 8
mov ecx, dword [edi + 0x28]
mov esi, dword [ecx - 0x10]
lea eax, [ecx - 0x10]
xor ebx, ebx
cmp dword [eax + 4], ebx
je 0x23a1a176
cmp dword [eax + 0xc], ebx
lea edx, [eax + 0xc]
jge 0x23a1a151
cmp dword [ecx - 8], ebx
jge 0x23a1a144
push 0x80070057
call fcn.23a0ef50
mov dword [ecx - 0xc], ebx
mov ecx, dword [edi + 0x28]
xor edx, edx
mov word [ecx], dx
jmp 0x23a1a176
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x23a1a167
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0xc]
mov ecx, esi
call eax
add eax, 0x10
mov dword [edi + 0x28], eax
mov edx, dword [edi]
mov eax, dword [edx + 4]
mov ecx, edi
call eax
mov ecx, dword [esp + 0x78]
mov edi, dword [ecx]
mov esi, dword [esp + 0x60]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], edi
mov ebp, dword [esp + 0x78]
cmp esi, ebx
je 0x23a1a19f
cmp esi, dword [esp + 0x60]
je 0x23a1a1a4
call fcn.23a49e3d
cmp edi, ebp
je 0x23a1a1eb
cmp esi, ebx
jne 0x23a1a1c8
call fcn.23a49e3d
xor esi, esi
cmp edi, dword [esi + 0x18]
jne 0x23a1a1bd
call fcn.23a49e3d
cmp dword [edi + 0x24], 8
jb 0x23a1a1cc
mov eax, dword [edi + 0x10]
jmp 0x23a1a1cf
mov esi, dword [esi]
jmp 0x23a1a1b3
lea eax, [edi + 0x10]
push eax
call fcn.23a01f50
add esp, 4
lea ecx, [esp + 0x18]
call fcn.23a10040
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
jmp 0x23a1a191
mov ecx, dword [esp + 0x78]
mov eax, dword [ecx]
push ecx
mov ecx, dword [esp + 0x64]
push ecx
push eax
push ecx
lea edx, [esp + 0xa0]
push edx
lea ecx, [esp + 0x74]
mov dword [esp + 0xd0], 5
call fcn.23a16290
mov eax, dword [esp + 0x78]
push eax
call fcn.23a2ed1b
mov ecx, dword [esp + 0x64]
push ecx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
call fcn.23a2ed1b
add esp, 8
mov dword [esp + 0x20], ebx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
push ebx
push 3
push ebx
push ebx
push ebx
push str.SoftwareMicrosoftFmtAdv
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0xe0], 6
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
je 0x23a1a27e
push eax
push str.key.create_HKEY_LOCAL_MACHINE___S_SECRET_KEY__failed_with_0x_08X_error
call dword [0x23c41f28]
add esp, 8
jmp 0x23a1a2f1
lea ecx, [esp + 0x5c]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x8c]
push edx
lea eax, [esp + 0xa4]
push eax
push ebx
push str.ITValue
push ecx
mov dword [esp + 0x74], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x23a1a2f1
lea edx, [esp + 0xa0]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea eax, [esp + 0x88]
push eax
lea ecx, [esp + 0xa4]
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [esp + 0x20]
push 8
lea edx, [esp + 0x8c]
push edx
push 3
push ebx
push str.ITValue
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp + 0x20]
mov dword [esp + 0xbc], 0xffffffff
cmp eax, ebx
je 0x23a1a31e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x23a1a31e
push eax
push str.RegCloseKey___failed_with_0x_08X_error
call dword [0x23c41f24]
add esp, 8
mov ecx, dword [esp + 0xb4]
pop edi
mov dword fs:[0], ecx
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret