Function at 0x10026860
Capabilities:
Delete directory
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004b8e8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x1005d500]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ecx, dword [edi + 8]
sub ecx, dword [edi + 4]
mov dword [ebp - 0x58], eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
xor ebx, ebx
add ecx, edx
mov dword [ebp - 0x54], ebx
test ecx, ecx
jle 0x100269ef
mov dword [ebp - 0x50], ebx
mov esi, dword [edi + 4]
add esi, dword [ebp - 0x50]
push 0xffffffffffffffff
push ebx
push esi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x38], 0xf
mov dword [ebp - 0x3c], ebx
mov byte [ebp - 0x4c], bl
call fcn.10002da0
push 0xffffffffffffffff
mov dword [ebp - 4], ebx
push ebx
add esi, 0x1c
push esi
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
call fcn.10002da0
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x38], 0x10
mov eax, dword [ebp - 0x4c]
jae 0x1002690a
lea eax, [ebp - 0x4c]
mov edx, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x58]
push edx
push eax
push esi
xor eax, eax
call fcn.1000b240
cmp eax, 0xffffffff
je 0x1002698f
push ebx
push str.djbv
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
push ebx
push ebx
push ebx
push ebx
push ebx
push str.dfgd0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
push ebx
push ebx
push ebx
push str.sdfe
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push str.shjt
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push ebx
push ebx
push ebx
push ebx
push str.pigf
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push 0x10054980
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
cmp dword [ebp - 0x1c], 0x10
mov eax, dword [ebp - 0x30]
jae 0x1002697d
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
push ecx
push eax
push esi
xor eax, eax
call fcn.1000b240
cmp eax, 0xffffffff
jne 0x10026a0e
mov esi, 0x10
cmp dword [ebp - 0x1c], esi
jb 0x100269a5
mov edx, dword [ebp - 0x30]
push edx
call fcn.10032f50
add esp, 4
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
cmp dword [ebp - 0x38], esi
jb 0x100269c3
mov eax, dword [ebp - 0x4c]
push eax
call fcn.10032f50
add esp, 4
mov ecx, dword [edi + 8]
sub ecx, dword [edi + 4]
mov esi, dword [ebp - 0x54]
add dword [ebp - 0x50], 0x38
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
inc esi
add ecx, edx
mov dword [ebp - 0x54], esi
cmp esi, ecx
jl 0x100268b9
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10034eea
mov esp, ebp
pop ebp
ret 4
mov esi, 0x10
cmp dword [ebp - 0x1c], esi
jb 0x10026a24
mov edx, dword [ebp - 0x30]
push edx
call fcn.10032f50
add esp, 4
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
cmp dword [ebp - 0x38], esi
jb 0x10026a42
mov eax, dword [ebp - 0x4c]
push eax
call fcn.10032f50
add esp, 4
mov al, 1
jmp 0x100269f1