Function at 0x1007c620
Capabilities:
Check if file exists
Delete file
Delete registry value
Get common file path
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1015e657
mov eax, dword fs:[0]
push eax
sub esp, 0x82c
mov eax, dword [0x101c0618]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
call fcn.1000c0e0
mov ecx, eax
test ecx, ecx
je 0x1007cfd6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x834], eax
lea ecx, [ebp - 0xdc]
mov dword [ebp - 4], 0
call fcn.10077860
mov esi, eax
lea ebx, [edi + 4]
mov byte [ebp - 4], 1
push esi
mov ecx, ebx
call fcn.1000b6e0
lea ecx, [esi + 4]
push ecx
lea ecx, [ebx + 4]
call fcn.1000b6e0
lea eax, [esi + 8]
push eax
lea ecx, [ebx + 8]
call fcn.1000b6e0
lea eax, [esi + 0xc]
push eax
lea ecx, [ebx + 0xc]
call fcn.1000b6e0
lea eax, [esi + 0x10]
push eax
lea ecx, [ebx + 0x10]
call fcn.1000b6e0
lea eax, [esi + 0x14]
push eax
lea ecx, [ebx + 0x14]
call fcn.1000b6e0
lea eax, [esi + 0x18]
push eax
lea ecx, [ebx + 0x18]
call fcn.1000b6e0
mov eax, dword [esi + 0x1c]
lea ecx, [ebx + 0x34]
mov dword [ebx + 0x1c], eax
mov eax, dword [esi + 0x20]
mov dword [ebx + 0x20], eax
mov eax, dword [esi + 0x24]
mov dword [ebx + 0x24], eax
mov eax, dword [esi + 0x28]
mov dword [ebx + 0x28], eax
mov eax, dword [esi + 0x2c]
mov dword [ebx + 0x2c], eax
mov eax, dword [esi + 0x30]
mov dword [ebx + 0x30], eax
lea eax, [esi + 0x34]
push eax
call fcn.1000b6e0
lea eax, [esi + 0x38]
push eax
lea ecx, [ebx + 0x38]
call fcn.100782e0
lea ecx, [ebp - 0xdc]
mov byte [ebp - 4], 0
call fcn.10078160
call fcn.100125c0
mov ecx, eax
call fcn.1000fef0
test eax, eax
jne 0x1007c744
call fcn.100125c0
mov ecx, eax
call fcn.10010100
test eax, eax
je 0x1007c754
push ebx
mov ecx, edi
call fcn.1007f690
push ebx
mov ecx, edi
call fcn.1007f190
mov dword [ebp - method.mf_bind_t_class_CInstaller__class_CInstaller___void_.virtual_0], vtable.mf_bind_t_class_CInstaller__class_CInstaller___void_.0
mov dword [ebp - 0x818], 0x1007b790
mov dword [ebp - 0x814], edi
lea eax, [ebp - 0x81c]
mov byte [ebp - 4], 2
push eax
call fcn.1014b410
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x1007b8f0
mov dword [ebp - 0x818], edi
mov dword [ebp - 0x814], 0
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 3
push eax
call fcn.1014b410
add esp, 8
mov byte [ebp - 4], 0
lea ebx, [edi + 0xd0]
push ebx
call fcn.10073050
mov ecx, eax
call fcn.100731f0
push eax
call fcn.1008a430
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x1007b8f0
mov dword [ebp - 0x818], edi
mov dword [ebp - 0x814], 2
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 4
push eax
call fcn.1014b410
mov esi, dword [ebx]
lea ecx, [ebp - 0x820]
add esp, 0xc
mov byte [ebp - 4], 0
call fcn.1008ab60
push esi
lea ecx, [ebp - 0x820]
mov byte [ebp - 4], 5
call fcn.1008b140
lea ecx, [ebp - 0x820]
call fcn.1008b450
lea ecx, [ebp - 0x820]
call fcn.1008ac70
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x1007b8f0
mov dword [ebp - 0x818], edi
mov dword [ebp - 0x814], 3
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 6
push eax
call fcn.1014b410
add esp, 4
mov byte [ebp - 4], 0
push str.yxhgamebox_uninst
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100ec480
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1007c8f3
push str.removeyxh_gcenter.bat
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x1007c8f3
lea eax, [ebp - 0x218]
push eax
push str.Delete_temp_file:__s
call fcn.1004a190
add esp, 8
push str..tmp
push dword [ebx]
call fcn.10075a90
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x1007b8f0
mov dword [ebp - 0x818], edi
mov dword [ebp - 0x814], 4
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 7
push eax
call fcn.1014b410
push dword [ebx]
mov byte [ebp - 4], 0
push str.remove_all_.tmp_files_in__s
call fcn.1004a190
push str.update
lea eax, [ebp - 0x830]
push ebx
push eax
call fcn.10019d90
push dword [eax]
mov byte [ebp - 4], 8
call fcn.10075420
mov edx, dword [ebp - 0x830]
or esi, 0xffffffff
add esp, 0x24
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1007c987
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.update
lea eax, [ebp - 0x830]
push ebx
push eax
call fcn.10019d90
push dword [eax]
mov byte [ebp - 4], 9
push str.Delete_directory_recursively:__s
call fcn.1004a190
mov edx, dword [ebp - 0x830]
add esp, 0x14
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1007c9cd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x1007b8f0
mov dword [ebp - 0x818], edi
mov dword [ebp - 0x814], 5
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 0xa
push eax
call fcn.1014b410
add esp, 4
mov byte [ebp - 4], 0
mov ecx, edi
call fcn.100797d0
and eax, 1
mov dword [ebp - 0x830], eax
jne 0x1007ca2c
push 0xf
push str.copy_file_fail
lea ecx, [ebp - 0x834]
call fcn.10036ce0
call fcn.1000c0e0
mov ecx, eax
test ecx, ecx
je 0x1007cfe0
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x828], eax
push str.start
lea ecx, [ebp - 0x828]
mov byte [ebp - 4], 0xb
call fcn.1001aad0
test al, al
jne 0x1007ca73
push 5
push str.start
lea ecx, [ebp - 0x828]
call fcn.1000adf0
mov byte [ebp - 4], 0xc
call fcn.1000c0e0
mov ecx, eax
test ecx, ecx
je 0x1007cfea
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x82c], eax
push str.cefhelper
lea ecx, [ebp - 0x82c]
mov byte [ebp - 4], 0xd
call fcn.1001aad0
test al, al
jne 0x1007cabe
push 9
push str.cefhelper
lea ecx, [ebp - 0x82c]
call fcn.1000adf0
sub esp, 0x28
mov eax, esp
mov dword [ebp - 0x838], esp
mov dword [eax + 0x24], 0
push 0
push 0
push 0
lea eax, [ebp - 0x828]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x82c]
push eax
call fcn.1006f2a0
mov ecx, eax
mov byte [ebp - 4], 0xe
call fcn.10070290
mov edx, dword [ebp - 0x82c]
mov eax, esi
mov byte [ebp - 4], 0xc
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1007cb19
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x828]
mov eax, esi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1007cb3a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, edi
call fcn.1007a3f0
test eax, eax
jne 0x1007cb57
push 0x14
push str.inst_cef_files_fail
lea ecx, [ebp - 0x834]
call fcn.10036ce0
mov ecx, edi
call fcn.1007a690
test eax, eax
jne 0x1007cb74
push 0x1f
push str.inst_pepflashplayer_files_fail
lea ecx, [ebp - 0x834]
call fcn.10036ce0
push str.start_call_program
call fcn.1004a190
mov eax, dword [ebx]
add esp, 4
push dword [eax - 0xc]
push eax
call fcn.10073050
mov ecx, eax
call fcn.100731f0
mov ecx, eax
call fcn.10083220
push dword [ebx]
call fcn.1008ba50
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x1007b8f0
mov dword [ebp - 0x818], edi
mov dword [ebp - 0x814], 0x60
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 0x10
push eax
call fcn.1014b410
add esp, 8
mov byte [ebp - 4], 0
mov ecx, edi
call fcn.1007d220
test eax, eax
jne 0x1007cbff
push 0x17
push str.WritePathRegister_fail
lea ecx, [ebp - 0x834]
mov dword [ebp - 0x830], eax
call fcn.10036ce0
call fcn.100125c0
mov ecx, eax
call fcn.1000fed0
test eax, eax
jne 0x1007cc52
push ebx
mov ecx, edi
call fcn.1007db80
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x1007b8f0
mov dword [ebp - 0x818], edi
mov dword [ebp - 0x814], 0x61
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 0x11
push eax
call fcn.1014b410
add esp, 4
mov byte [ebp - 4], 0
mov dword [ebp - 0x82c], 0
call fcn.100125c0
mov ecx, eax
call fcn.1000fef0
test eax, eax
je 0x1007ccd0
call fcn.1000c0e0
mov ecx, eax
test ecx, ecx
je 0x1007cff4
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x828], eax
lea eax, [ebp - 0x82c]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x828]
mov ecx, edi
push eax
lea eax, [edi + 4]
push eax
call fcn.1007edf0
mov edx, dword [ebp - 0x828]
mov eax, esi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1007ccc7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x82c], 0
jne 0x1007ccfc
push 0x1017fce8
push dword [0x101c040c]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
push str.DelayCreateIconFrom
push dword [0x101c040c]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
call fcn.100125c0
mov ecx, eax
call fcn.1000fef0
test eax, eax
je 0x1007cd1e
mov eax, dword [edi + 0x14]
cmp dword [eax - 0xc], 0
je 0x1007cd1e
mov eax, dword [edi + 0x10]
cmp dword [eax - 0xc], 0
jne 0x1007cd48
call fcn.100125c0
mov ecx, eax
call fcn.10010100
test eax, eax
jne 0x1007cd48
call fcn.100125c0
mov ecx, eax
call fcn.1000ff10
test eax, eax
je 0x1007cd48
push ebx
push 0
mov ecx, edi
call fcn.10079b60
push 0x800
lea eax, [ebp - 0x810]
push 0
push eax
call fcn.100ec480
add esp, 0xc
lea eax, [ebp - 0x810]
push 1
push 2
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x828]
push eax
call fcn.100125c0
mov ecx, eax
call fcn.1000f150
push dword [eax]
lea eax, [ebp - 0x810]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov edx, dword [ebp - 0x828]
mov eax, esi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1007cdb1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1007cde2
lea eax, [ebp - 0x810]
push eax
call fcn.10075d40
lea eax, [ebp - 0x810]
push eax
push str.Delete_old_start_menu_directory_:__s
call fcn.1004a190
add esp, 0xc
call fcn.100125c0
mov ecx, eax
call fcn.1000ff30
test eax, eax
je 0x1007cdfa
push ebx
mov ecx, edi
call fcn.100791d0
call fcn.100125c0
mov ecx, eax
call fcn.1000ff20
test eax, eax
je 0x1007ce11
mov ecx, edi
call fcn.1007e8f0
mov ecx, edi
call fcn.1007b910
mov dword [ebp - method.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.virtual_0], vtable.mf_bind_t_1_class_CInstaller__class_CInstaller___void__int_.0
mov dword [ebp - 0x81c], 0x1007b8f0
mov dword [ebp - 0x818], edi
mov dword [ebp - 0x814], 0x62
lea eax, [ebp - 0x820]
mov byte [ebp - 4], 0x13
push eax
call fcn.1014b410
add esp, 4
mov byte [ebp - 4], 0
call fcn.100125c0
mov ecx, eax
call fcn.10010010
test eax, eax
je 0x1007ce75
push str.CInstaller::InstallSvc_no_svc
call fcn.1004a150
add esp, 4
jmp 0x1007cf1c
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.100ec480
add esp, 0xc
lea eax, [ebp - 0x218]
push str.lpiYxhGameSvc.dll
push dword [ebx]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call fcn.1008e9a0
add esp, 4
test eax, eax
jne 0x1007cec1
push str.CInstaller::JkwSvc.dll_failed
call fcn.1004a150
add esp, 4
jmp 0x1007cf1c
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x1007cf1c
push 0x1017ee5c
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x1007cf15
lea eax, [ebp - 0x218]
push eax
push str.InstallJkwSvc::all_dll_func_start_path_s
call fcn.1004a150
add esp, 8
push 0x10172dc0
call ebx
lea eax, [ebp - 0x218]
push eax
push str.InstallJkwSvc::all_dll_func_end_path_s
call fcn.1004a150
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, edi
call fcn.1007d000
mov ecx, edi
call fcn.1007d490
push str.install_end.
call fcn.1004a190
mov eax, dword [ebp - 0x830]
mov esi, dword [ebp - 0x834]
mov dword [ebp - method.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.virtual_0], vtable.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.0
mov dword [ebp - 0x820], 0x1007b770
mov dword [ebp - 0x81c], edi
mov dword [ebp - 0x818], eax
mov dword [ebp - 0x814], esi
lea eax, [ebp - 0x824]
mov byte [ebp - 4], 0x14
push eax
call fcn.1014b410
add esp, 8
mov dword [ebp - method.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.virtual_0], vtable.mf_bind_t_2_class_CInstaller__class_CInstaller___void__int__wchar_t_const__.0
mov dword [ebp - 0x820], 0
add esi, 0xfffffff0
mov dword [ebp - 0x81c], 0
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1007cfb6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100b4568
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.10007270
push 0x80004005
call fcn.10007270
push 0x80004005
call fcn.10007270
push 0x80004005
call fcn.10007270
int3