Function at 0x100d9cb
Capabilities:
Delete file
Query or enumerate registry value
Read .ini file
Set file attributes
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x13f8
call fcn.0100e440
mov eax, dword [0x10140d8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x13cc], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push edi
lea ecx, [ebp - 0x13ac]
mov dword [ebp - 0x13bc], eax
mov dword [ebp - 0x13b4], esi
call fcn.010103d7
mov ebx, 0x20a
push ebx
lea eax, [ebp - 0x1064]
push esi
push eax
mov dword [ebp - 0x13d0], esi
mov dword [ebp - 0x13c0], esi
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x210]
push esi
push eax
call sub.msvcrt.dll_memset
push ebx
lea eax, [ebp - 0x834]
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push 0x208
mov word [ebp - 0xc4c], ax
lea eax, [ebp - 0xc4a]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0x30
mov edi, 0x104
push edi
lea eax, [ebp - 0xc4c]
push eax
push 0xd2
push dword [ebp - 0x13cc]
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [ebp - 0x13bc]
lea eax, [ebp - 0x210]
push edi
push eax
push 0x10017d4
push 0x1002c74
push 0x1002c64
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x100dab4
mov eax, 0x80004005
jmp 0x100dcdd
push dword [ebp - 0x13bc]
call fcn.01007f97
cmp eax, esi
jl 0x100dcc9
jne 0x100db03
push 0x900
push esi
push esi
push 0x1004640
mov ebx, 0x105
push ebx
lea eax, [ebp - 0xe58]
push eax
call fcn.01011b30
mov dword [ebp - 0x13b0], 0x80000001
mov dword [ebp - 0x13d4], 0x10
mov dword [ebp - 0x13c4], esi
jmp 0x100db64
call fcn.010090d1
test eax, eax
jne 0x100db23
push 0x10045e8
push dword [0x10143ec]
call fcn.0100f2af
pop ecx
pop ecx
jmp 0x100dcc9
push 0x900
push esi
push esi
push 0x1003abc
mov ebx, 0x105
push ebx
lea eax, [ebp - 0xe58]
push eax
call fcn.01011b30
xor eax, eax
inc eax
mov dword [ebp - 0x13b0], 0x80000002
mov dword [ebp - 0x13c0], eax
mov dword [ebp - 0x13d4], 0x19
mov dword [ebp - 0x13c4], eax
push dword [ebp - 0x13bc]
lea eax, [ebp - 0x628]
push edi
push eax
push 0x10017d4
push 0x1002c48
push 0x1002c64
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor eax, eax
cmp ax, word [ebp - 0x628]
je 0x100dcc9
lea eax, [ebp - 0x628]
push eax
push 0x1004578
mov edi, 0x900
push edi
push esi
push esi
lea eax, [ebp - 0xa40]
push ebx
push eax
call fcn.01011c3f
add esp, 0x1c
lea eax, [ebp - 0x13d8]
push eax
lea eax, [ebp - 0x13b8]
push eax
mov eax, dword [ebp - 0x13c0]
neg eax
sbb eax, eax
push esi
and eax, 0xfffffffa
add eax, 0x2001f
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xa40]
push eax
push dword [ebp - 0x13b0]
mov dword [ebp - 0x13d8], esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100dcc9
lea eax, [ebp - 0x13c8]
push eax
push 0x20019
push esi
push 0x1001660
push dword [ebp - 0x13b0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100dcbd
lea eax, [ebp - 0x13b0]
push eax
lea eax, [ebp - 0x1270]
push eax
push esi
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x13c8]
mov dword [ebp - 0x13b0], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100e0d7
mov eax, dword [ebp - 0x13b0]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x1270], cx
push ebx
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x1270]
push eax
call fcn.0100d6cd
push dword [ebp - 0x13c8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x13c0], esi
je 0x100dcee
call fcn.0100922e
mov ecx, dword [eax]
lea edx, [ebp - 0x41c]
push edx
push 0x1004558
lea edx, [ebp - 0xa40]
push edx
push dword [ebp - 0x13c0]
push eax
call dword [ecx + 0x28]
test eax, eax
jge 0x100dd25
push dword [ebp - 0x13b8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x13d0]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100e410
leave
ret 0xc
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 0x13b0], eax
lea eax, [ebp - 0x41c]
push eax
push 1
push esi
push 0x1004558
push dword [ebp - 0x13b8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100dcbd
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x1003690
push edi
push esi
push esi
lea eax, [ebp - 0x834]
push ebx
push eax
call fcn.01011c3f
add esp, 0x20
push dword [ebp - 0x13b8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x834]
push eax
push 0x1004544
push edi
push esi
push esi
lea eax, [ebp - 0x1064]
push ebx
push eax
call fcn.01011c3f
add esp, 0x20
test eax, eax
jl 0x100dcc9
xor eax, eax
cmp ax, word [ebp - 0x210]
je 0x100de60
lea ecx, [ebp - 0x13ac]
call fcn.01010437
test eax, eax
je 0x100de09
lea eax, [ebp - 0x13b4]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.01006b30
test eax, eax
je 0x100ddee
lea ecx, [ebp - 0x13ac]
call fcn.01010437
neg eax
sbb eax, eax
inc eax
push eax
push dword [ebp - 0x13b4]
lea eax, [ebp - 0x210]
push eax
call fcn.0100922e
push eax
call fcn.010076d2
push dword [ebp - 0x13b4]
call sub.cmutil.dll_CmFree
cmp dword [ebp - 0x13c4], esi
je 0x100de09
push dword [ebp - 0x13cc]
lea eax, [ebp - 0x41c]
push ebx
push eax
call fcn.01006852
push dword [ebp - 0x13c4]
lea eax, [ebp - 0x13b4]
push eax
lea eax, [ebp - 0x41c]
push eax
call fcn.0100922e
push eax
call fcn.010065f8
test eax, eax
je 0x100de55
lea ecx, [ebp - 0x13ac]
call fcn.01010437
neg eax
sbb eax, eax
inc eax
push eax
push dword [ebp - 0x13b4]
lea eax, [ebp - 0x210]
push eax
call fcn.0100922e
push eax
call fcn.010076d2
push dword [ebp - 0x13b4]
call sub.cmutil.dll_CmFree
lea eax, [ebp - 0x1064]
push eax
push esi
push 0x1002c8c
push 0x1002bf8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 1
jg 0x100de88
push dword [ebp - 0x13bc]
call fcn.01006cdb
push esi
lea eax, [ebp - 0xc4c]
push eax
lea eax, [ebp - 0xe58]
push eax
push dword [ebp - 0x13bc]
call fcn.0100922e
push eax
call fcn.010107fe
xor ecx, ecx
test eax, eax
setge cl
mov dword [ebp - 0x13d0], ecx
lea ecx, [ebp - 0x13ac]
call fcn.01010437
test eax, eax
je 0x100dee2
push dword [ebp - 0x13d4]
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x13cc]
call fcn.01009239
push eax
call fcn.010087f4
xor eax, eax
cmp ax, word [ebp - 0x834]
je 0x100df44
push 0x80
lea eax, [ebp - 0x834]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x100df44
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x13f8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x834]
push 0x14
mov dword [ebp - 0x13f0], eax
pop eax
mov word [ebp - 0x13e8], ax
lea eax, [ebp - 0x13f8]
push eax
mov dword [ebp - 0x13f4], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov edi, 0x900
push 0x10044c0
push dword [0x10143ec]
call fcn.0100f2af
lea eax, [ebp - 0x628]
push eax
push 0x1004494
push dword [0x10143ec]
call fcn.0100f2af
add esp, 0x14
cmp dword [ebp - 0x13c4], esi
je 0x100dfd7
lea ecx, [ebp - 0x13ac]
call fcn.01010437
test eax, eax
je 0x100dfc9
call fcn.0100922e
test eax, eax
je 0x100dfa7
call fcn.0100922e
mov ecx, dword [eax]
lea edx, [ebp - 0x628]
push edx
push eax
call dword [ecx + 0x44]
and eax, 0xffff
jmp 0x100dfb3
lea eax, [ebp - 0x628]
push eax
call fcn.0100831d
cmp eax, esi
jne 0x100dfc9
push 0x1004450
push dword [0x10143ec]
call fcn.0100f2af
pop ecx
pop ecx
lea eax, [ebp - 0x210]
push eax
push 0x1004288
jmp 0x100dfe3
lea eax, [ebp - 0x210]
push eax
push 0x1004218
push 0x10028fc
push edi
push esi
push esi
lea eax, [ebp - 0xa40]
push ebx
push eax
call fcn.01011c3f
add esp, 0x20
mov ebx, 0x80000001
cmp dword [ebp + 0x10], esi
je 0x100e02e
push 1
lea eax, [ebp - 0xa40]
push eax
push ebx
call fcn.0100d787
push 1
push 0x1004288
push ebx
call fcn.0100d787
push 1
push 0x1004218
push ebx
call fcn.0100d787
call fcn.0100922e
test eax, eax
je 0x100e051
call fcn.0100922e
mov ecx, dword [eax]
push esi
push 0x1001660
push 1
push eax
call dword [ecx + 0x30]
mov edi, 0x80000002
jmp 0x100e062
push esi
push 0x1001660
mov edi, 0x80000002
push edi
call fcn.0100d787
push esi
push 0x1001660
push ebx
call fcn.0100d787
call fcn.0100922e
test eax, eax
je 0x100e08b
call fcn.0100922e
mov ecx, dword [eax]
push 0x10043e8
push 1
push eax
call dword [ecx + 0x34]
jmp 0x100e096
push 0x10043e8
push edi
call fcn.01006df9
call fcn.0100922e
test eax, eax
je 0x100e0b6
call fcn.0100922e
mov ecx, dword [eax]
push 1
mov esi, 0x1002ba8
push esi
push 1
push eax
call dword [ecx + 0x30]
jmp 0x100e0c4
push 1
mov esi, 0x1002ba8
push esi
push edi
call fcn.0100d787
push 1
push esi
push ebx
call fcn.0100d787
call fcn.01006f3b
jmp 0x100dcc9
push dword [ebp - 0x13c8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x13b8]
call esi
jmp 0x100dcc9