Function at 0x1003b18e
Capabilities:
Delete registry key
Get disk information
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100754c1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x118
push esi
mov dword [ebp - 0x1c], 0x824a8c6a
mov dword [ebp - 0x34], 0x9d01
mov dword [ebp - 0xd8], 0
mov dword [ebp - 0x1c], 0
jmp 0x1003b1d5
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 5
jg 0x1003b1f8
mov byte [ebp - 0x25], 0
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x1003b1f6
push 0x2a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1003b1ce
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x34], eax
jne 0x1003b227
mov dword [ebp - 0xa4], 1
jmp 0x1003b22e
and dword [ebp - 0xa4], 0
cmp dword [ebp - 0xa4], 1
jne 0x1003b243
mov dword [ebp - 0xc4], 1
jmp 0x1003b24a
and dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0x1c], 1
jge 0x1003b265
mov dword [ebp - 0x8c], 1
jmp 0x1003b26c
and dword [ebp - 0x8c], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x1c], eax
mov eax, 0xaa810d21
cmp eax, 0x2d34caa8
ja 0x1003b28d
mov dword [ebp - 0xa0], 1
jmp 0x1003b294
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0xa0]
cmp eax, 0xb189
jl 0x1003b2ae
mov dword [ebp - 0x74], 1
jmp 0x1003b2b2
and dword [ebp - 0x74], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0xd8], eax
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1003b57d
mov dword [ebp - 0x124], 0xfffffff8
mov byte [ebp - 0x20], 0
movzx eax, byte [ebp - 0x20]
test eax, eax
je 0x1003b2e3
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov byte [ebp - 0x22], 0
movzx eax, byte [ebp - 0x22]
test eax, eax
je 0x1003b30e
push 0
push 0
push 0x2070
push 0
push 0x1b10
push 0
push 0x20eb
push 0
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [ebp + 8]
mov dword [ebp - 0xbc], eax
push 4
lea ecx, [ebp - 0x64]
call fcn.10022f94
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 0x7831e42a
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x54], 0
jmp 0x1003b343
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 4
jge 0x1003b35c
push dword [ebp - 0x54]
lea ecx, [ebp - 0x64]
call fcn.10023032
mov dword [eax], 0x5720e83c
jmp 0x1003b33c
mov dword [ebp - 0x10], 3
jmp 0x1003b36c
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1003b4c8
mov dword [ebp - 0x9c], 0xd329b3a0
mov dword [ebp - 0x40], 0xfffffffd
push dword [ebp - 0x10]
lea ecx, [ebp - 0x64]
call fcn.10023032
mov esi, eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x64]
call fcn.10023032
mov ecx, dword [esi]
mov dword [eax], ecx
mov esi, dword [ebp - 0x10]
push dword [ebp - 0x10]
lea ecx, [ebp - 0x64]
call fcn.10023032
sub esi, dword [eax]
mov dword [ebp - 0x9c], esi
mov esi, dword [ebp - 0x9c]
push 3
lea ecx, [ebp - 0x64]
call fcn.10023032
sub esi, dword [eax]
dec esi
cmp esi, 0x18e50348
jl 0x1003b3dd
mov dword [ebp - 0x7c], 1
jmp 0x1003b3e1
and dword [ebp - 0x7c], 0
push dword [ebp - 0x10]
lea ecx, [ebp - 0x64]
call fcn.10023032
mov ecx, dword [ebp - 0x7c]
cmp ecx, dword [eax]
jg 0x1003b3ff
mov dword [ebp - 0xd4], 1
jmp 0x1003b406
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xfc], eax
push dword [ebp - 0x10]
lea ecx, [ebp - 0x64]
call fcn.10023032
mov ecx, dword [ebp - 0x40]
cmp dword [eax], ecx
jge 0x1003b42d
mov dword [ebp - 0x94], 1
jmp 0x1003b434
and dword [ebp - 0x94], 0
cmp dword [ebp - 0x94], 0xe3580d41
je 0x1003b44c
mov dword [ebp - 0x84], 1
jmp 0x1003b453
and dword [ebp - 0x84], 0
cmp dword [ebp - 0x84], 9
jge 0x1003b465
mov dword [ebp - 0x68], 1
jmp 0x1003b469
and dword [ebp - 0x68], 0
cmp dword [ebp - 0x68], 0xd35da2a0
ja 0x1003b47b
mov dword [ebp - 0x6c], 1
jmp 0x1003b47f
and dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x40], 3
jmp 0x1003b495
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x1003b4c3
mov dword [ebp - 0x2c], 0
jmp 0x1003b4ab
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x1003b4c1
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x64]
call fcn.10023032
and dword [eax], 0
jmp 0x1003b4a4
jmp 0x1003b48e
jmp 0x1003b365
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.10023016
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], 0xd
jmp 0x1003b4eb
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x17
jl 0x1003b564
push 3
lea ecx, [ebp - 0xf0]
call fcn.10022f94
mov dword [ebp - 4], 1
mov dword [ebp - 0xc8], 0xf7a73d2
mov dword [ebp - 0x48], 0
jmp 0x1003b51f
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x1003b538
push dword [ebp - 0x48]
lea ecx, [ebp - 0xf0]
call fcn.10023032
and dword [eax], 0
jmp 0x1003b518
mov esi, dword [ebp - 0x30]
push 2
lea ecx, [ebp - 0xf0]
call fcn.10023032
mov dword [eax], esi
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc8], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.10023016
jmp 0x1003b4e4
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x70]
mov dword [ecx], eax
jmp 0x1003b909
mov dword [ebp - 0x14], 0x387fb0b0
mov dword [ebp - 0x50], 0
jmp 0x1003b594
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1003b5aa
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xe4], 0xffffffff
jmp 0x1003b58d
mov dword [ebp - 0x14], 0
jmp 0x1003b5ba
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x1003b5d0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe4], 0x71c1ec2d
jmp 0x1003b5b3
mov dword [ebp - 0x14], 2
jmp 0x1003b5e0
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x1003b695
mov dword [ebp - 0x4c], 0
jmp 0x1003b5fa
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x1003b610
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xac], 0xffffffff
jmp 0x1003b5f3
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xac], 0
jmp 0x1003b63e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xac]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xac], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xac], 2
jg 0x1003b690
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xe4]
mov dword [ebp + ecx*4 - 0xe4], eax
mov byte [ebp - 0x24], 0
movzx eax, byte [ebp - 0x24]
test eax, eax
je 0x1003b68e
push 0
push 0x7b0
push 0
push 0x255a
push 0x2371
push 0
push 0xb43
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
jmp 0x1003b623
jmp 0x1003b5d9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x120], 0xa631
mov byte [ebp - 0x26], 0
movzx eax, byte [ebp - 0x26]
test eax, eax
je 0x1003b6be
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov byte [ebp - 0x1f], 0
movzx eax, byte [ebp - 0x1f]
test eax, eax
je 0x1003b6e7
push 0
push 0x23a3
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x58], 0
jmp 0x1003b707
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x1003b71d
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x10c], 0xb90da115
jmp 0x1003b700
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x10c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x44], 0
jmp 0x1003b73d
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 6
jle 0x1003b75c
mov byte [ebp - 0x23], 0
movzx eax, byte [ebp - 0x23]
test eax, eax
je 0x1003b75a
push 0x957
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1003b736
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], 0x9bf3
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x90], 0x6dd2
mov dword [ebp - 0xb4], 0x7b1b0cad
mov dword [ebp - 0x104], 4
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x18], eax
je 0x1003b7ab
mov dword [ebp - 0xb0], 1
jmp 0x1003b7b2
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
je 0x1003b7cc
mov dword [ebp - 0x78], 1
jmp 0x1003b7d0
and dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x78]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jge 0x1003b7e4
mov dword [ebp - 0x80], 1
jmp 0x1003b7e8
and dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x90]
jl 0x1003b808
mov dword [ebp - 0x88], 1
jmp 0x1003b80f
and dword [ebp - 0x88], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x88], eax
jle 0x1003b826
mov dword [ebp - 0xcc], 1
jmp 0x1003b82d
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x90], 0x5764
jne 0x1003b854
mov eax, 0xd081
test eax, eax
jne 0x1003b854
and dword [ebp - 0x98], 0
jmp 0x1003b85e
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0xb4], eax
mov byte [ebp - 0x21], 0
movzx eax, byte [ebp - 0x21]
test eax, eax
je 0x1003b888
push 0x1fe4
push 0x1709
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xf8], 0xffffffff
mov byte [ebp - 0x1d], 0
movzx eax, byte [ebp - 0x1d]
test eax, eax
je 0x1003b8b2
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
mov byte [ebp - 0x1e], 0
movzx eax, byte [ebp - 0x1e]
test eax, eax
je 0x1003b8d6
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
mov eax, dword [ebp - 0x3c]
mov dword [eax], 0
jmp 0x1003b8ec
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3c]
cmp dword [eax], 1
jge 0x1003b909
mov eax, dword [ebp - 0x3c]
push dword [eax]
mov ecx, dword [ebp - 0xc0]
call fcn.10023032
or dword [eax], 0xffffffff
jmp 0x1003b8e1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret