Function at 0x10008517
Capabilities:
Delete registry key
Get common file path

Disassembly:
mov eax, 0x10021934
call fcn.10016868
sub esp, 0x6d0
lea eax, [ebp - 0x4d4]
push esi
push eax
mov dword [ebp - 0x4d4], 0x114
call dword [0x1002afb8]
lea ecx, [ebp - 0x28]
call fcn.100029df
push 0x64
xor esi, esi
cmp dword [ebp - 0x4c4], 2
pop eax
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], esi
jne 0x1000873f
push ebx
push edi
lea eax, [ebp - 0x6dc]
push 0x104
push eax
call dword [0x1002afbc]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x2f8]
push eax
call dword [0x1002af30]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c0]
push eax
call dword [0x1002af90]
mov ax, word [ebp - 0x6dc]
mov edi, str.:Documents_and_Settings_
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x230]
push edi
push eax
mov word [ebp - 0x22e], si
call fcn.10016283
lea eax, [ebp - 0x230]
push eax
call fcn.10016961
mov ebx, dword [ebp - 0x2f8]
add esp, 0xc
cmp bx, si
je 0x100085fb
lea edx, [ebp - 0x2f8]
lea ecx, [ebp + eax*2 - 0x230]
inc dword [ebp - 0x10]
mov word [ecx], bx
inc ecx
inc ecx
inc edx
inc edx
mov bx, word [edx]
cmp bx, si
jne 0x100085e9
mov ecx, dword [ebp - 0x10]
push str.Recent_
add ecx, eax
lea eax, [ebp - 0x230]
push eax
mov word [ebp + ecx*2 - 0x230], si
call fcn.10016283
push esi
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.100089ad
mov ax, word [ebp - 0x6dc]
push str.:Documents_and_SettingsDefault_UserRecent_
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x230]
push eax
mov word [ebp - 0x22e], si
call fcn.10016283
push esi
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.100089ad
mov ax, word [ebp - 0x6dc]
push edi
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x230]
push eax
xor ebx, ebx
mov word [ebp - 0x22e], si
call fcn.10016283
lea eax, [ebp - 0x230]
push eax
call fcn.10016961
mov edi, dword [ebp - 0x2f8]
add esp, 0x34
cmp di, si
je 0x100086b6
lea edx, [ebp - 0x2f8]
lea ecx, [ebp + eax*2 - 0x230]
mov word [ecx], di
inc ebx
inc ecx
inc ecx
inc edx
inc edx
mov di, word [edx]
cmp di, si
jne 0x100086a6
add ebx, eax
lea eax, [ebp - 0x230]
push 0x10026f14
push eax
mov word [ebp + ebx*2 - 0x230], si
call fcn.10016283
lea eax, [ebp - 0x230]
xor ebx, ebx
push eax
call fcn.10016961
mov edi, dword [ebp - 0x3c0]
add esp, 0xc
cmp di, si
je 0x1000870a
lea edx, [ebp - 0x3c0]
lea ecx, [ebp + eax*2 - 0x230]
mov word [ecx], di
inc ebx
inc ecx
inc ecx
inc edx
inc edx
mov di, word [edx]
cmp di, si
jne 0x100086fa
add ebx, eax
lea eax, [ebp - 0x230]
push str.Recent_
push eax
mov word [ebp + ebx*2 - 0x230], si
call fcn.10016283
push esi
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.100089ad
add esp, 0x14
mov word [ebp - 0x230], si
pop edi
pop ebx
cmp dword [ebp - 0x4c4], 1
jne 0x10008791
lea eax, [ebp - 0x6dc]
push 0x104
push eax
call dword [0x1002afbc]
mov ax, word [ebp - 0x6dc]
push str.:WINDOWSRecent_
mov word [ebp - 0x230], ax
lea eax, [ebp - 0x230]
push eax
mov word [ebp - 0x22e], si
call fcn.10016283
push esi
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.100089ad
add esp, 0x14
push esi
lea eax, [ebp - 0x230]
push 8
push eax
push esi
mov word [ebp - 0x230], si
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100087be
push esi
lea eax, [ebp - 0x230]
push esi
push eax
call fcn.100089ad
add esp, 0xc
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerRecentDocs
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.100029ef
mov ecx, dword [ebp - 0xc]
push 1
pop eax
pop esi
mov dword fs:[0], ecx
leave
ret