Function at 0x1028945
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
and dword [edx], 0
mov ecx, reloc.ADVAPI32.dll_RegOpenKeyExW
cmp eax, ecx
ja 0x1028a07
je 0x10289f0
mov ecx, reloc.ADVAPI32.dll_OpenSCManagerW
cmp eax, ecx
ja 0x1028977
je 0x1028960
mov ecx, eax
sub ecx, 0x20000000
je 0x1028949
dec ecx
je 0x1028942
dec ecx
je 0x102892b
dec ecx
dec ecx
jne 0x1028abd
mov eax, dword [ebp + 0xc]
mov dword [eax], 3
mov eax, dword [ebp + 0x10]
mov dword [eax], 6
jmp 0x1028b18
mov eax, dword [ebp + 0xc]
mov dword [eax], 3
mov eax, dword [ebp + 0x10]
mov dword [eax], 4
jmp 0x1028b18
push 3
jmp 0x1028a7d
mov eax, dword [ebp + 0xc]
mov dword [eax], 3
mov eax, dword [ebp + 0x10]
mov dword [eax], 2
jmp 0x1028b18
mov eax, dword [ebp + 0xc]
mov dword [eax], 9
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x12
jmp 0x1028b18
mov ecx, eax
sub ecx, 0x20000010
je 0x10289d9
sub ecx, 0x10
je 0x10289c2
sub ecx, 0x20
je 0x10289ab
sub ecx, 0x40
jne 0x1028abd
mov eax, dword [ebp + 0xc]
mov dword [eax], reloc.ADVAPI32.dll_RegRestoreKeyW
mov eax, dword [ebp + 0x10]
mov dword [eax], 9
jmp 0x1028b18
mov eax, dword [ebp + 0xc]
mov dword [eax], reloc.ADVAPI32.dll_RegRestoreKeyW
mov eax, dword [ebp + 0x10]
mov dword [eax], 8
jmp 0x1028b18
mov eax, dword [ebp + 0xc]
mov dword [eax], reloc.ADVAPI32.dll_RegRestoreKeyW
mov eax, dword [ebp + 0x10]
mov dword [eax], 7
jmp 0x1028b18
mov eax, dword [ebp + 0xc]
mov dword [eax], 3
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x11
jmp 0x1028b18
mov eax, dword [ebp + 0xc]
mov dword [eax], reloc.ADVAPI32.dll_RegRestoreKeyW
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xa
jmp 0x1028b18
mov ecx, reloc.ADVAPI32.dll_AdjustTokenPrivileges
cmp eax, ecx
ja 0x1028aa1
je 0x1028a8d
cmp eax, reloc.ADVAPI32.dll_RegDeleteValueW
je 0x1028a7b
cmp eax, reloc.ADVAPI32.dll_RegSaveKeyW
je 0x1028a64
cmp eax, reloc.ADVAPI32.dll_ControlService
je 0x1028a4d
cmp eax, reloc.ADVAPI32.dll_QueryServiceStatus
jne 0x1028abd
mov eax, dword [ebp + 0xc]
mov dword [eax], reloc.ADVAPI32.dll_RegRestoreKeyW
mov eax, dword [ebp + 0x10]
mov dword [eax], reloc.ADVAPI32.dll_DuplicateTokenEx
jmp 0x1028b18
mov eax, dword [ebp + 0xc]
mov dword [eax], reloc.ADVAPI32.dll_RegRestoreKeyW
mov eax, dword [ebp + 0x10]
mov dword [eax], reloc.ADVAPI32.dll_EnumDependentServicesW
jmp 0x1028b18
mov eax, dword [ebp + 0xc]
mov dword [eax], reloc.ADVAPI32.dll_RegRestoreKeyW
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
jmp 0x1028b18
push reloc.ADVAPI32.dll_RegRestoreKeyW
mov ecx, dword [ebp + 0xc]
pop eax
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
jmp 0x1028b18
mov eax, dword [ebp + 0xc]
mov dword [eax], reloc.ADVAPI32.dll_RegRestoreKeyW
mov eax, dword [ebp + 0x10]
mov dword [eax], reloc.ADVAPI32.dll_SetThreadToken
jmp 0x1028b18
cmp eax, reloc.ADVAPI32.dll_ImpersonateLoggedOnUser
je 0x1028b06
cmp eax, reloc.ADVAPI32.dll_RegDeleteKeyW
je 0x1028afb
cmp eax, reloc.ADVAPI32.dll_GetSecurityDescriptorOwner
je 0x1028ae7
cmp eax, 0x40000000
je 0x1028ad3
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 3
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov dword [edx], 1
jmp 0x1028b18
mov eax, dword [ebp + 0xc]
mov dword [eax], reloc.msvcrt.dll___p__fmode
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x13
jmp 0x1028b18
mov eax, dword [ebp + 0xc]
mov dword [eax], 3
mov eax, dword [ebp + 0x10]
mov dword [eax], 5
jmp 0x1028b18
mov eax, dword [ebp + 0xc]
mov dword [eax], 8
jmp 0x1028adc
mov eax, dword [ebp + 0xc]
mov dword [eax], reloc.ADVAPI32.dll_RegRestoreKeyW
mov eax, dword [ebp + 0x10]
mov dword [eax], reloc.ADVAPI32.dll_RevertToSelf
xor eax, eax
pop ebp
ret 0x10