Function at 0x10043bc0
Capabilities:
Delete registry value
Get common file path
Set registry value

Disassembly:
sub esp, 0x740
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x73c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x74c]
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x25]
mov edi, ecx
mov esi, edx
push ebx
push eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], esi
mov byte [esp + 0x2c], bl
call fcn.10116880
push 0x207
lea ecx, [esp + 0x551]
push ebx
push ecx
mov byte [esp + 0x558], bl
call fcn.10116880
add esp, 0x18
cmp ebp, ebx
je 0x10043d99
mov eax, str.eScan
mov ecx, ebp
call fcn.10031890
test eax, eax
je 0x10043c4a
mov eax, str.MailScan
mov ecx, ebp
call fcn.10031890
test eax, eax
jne 0x10043d99
cmp edi, ebx
je 0x10043c62
mov eax, str.progressover
mov ecx, edi
call fcn.10031890
test eax, eax
je 0x10043d99
cmp dword [0x101936f8], ebx
jne 0x10043e1a
push 0x103
lea edx, [esp + 0x235]
push ebx
push edx
mov byte [esp + 0x23c], bl
call fcn.10116880
push 0x207
lea eax, [esp + 0x349]
push ebx
push eax
mov byte [esp + 0x350], bl
call fcn.10116880
push 0x103
lea ecx, [esp + 0x145]
push ebx
push ecx
mov byte [esp + 0x14c], bl
call fcn.10116880
add esp, 0x24
push 0x208
lea edx, [esp + 0x33c]
push edx
push ebx
mov dword [0x101936f8], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
lea ecx, [esp + 0x234]
lea edx, [esp + 0x33c]
call fcn.10042a50
add esp, 4
test eax, eax
je 0x10043d12
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x33c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x128]
lea edx, [esp + 0x338]
call fcn.10043ff0
lea edx, [esp + 0x128]
push ebx
push edx
call fcn.10044cc0
lea eax, [esp + 0x130]
push eax
push str._sWIN.INI
push 0x10193700
call fcn.1010d6a8
push 1
push ebx
xor edx, edx
mov ecx, 0x10193700
call fcn.10044660
add esp, 0x1c
test eax, eax
jne 0x10043d93
call fcn.10043490
push 0x10193700
lea ecx, [esp + 0x544]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x18]
push ebp
lea esi, [esp + 0x544]
mov ebx, edi
call fcn.10042d90
add esp, 4
jmp 0x10043fc9
mov byte [0x10193700], bl
mov ebx, ebp
call fcn.10043420
xor esi, esi
xor edi, edi
xor ebx, ebx
call fcn.10043420
cmp byte [0x1019e4a0], bl
jne 0x10043e59
push 0x104
push 0x1019e4a0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x104
push 0x1019e5a8
call fcn.10042f40
add esp, 8
mov esi, 0x1019e4a0
call fcn.10049c80
mov esi, 0x1019e5a8
call fcn.10049c80
mov eax, 0x1019e4a0
mov ecx, esi
call fcn.10031890
test eax, eax
je 0x10043e59
mov ecx, esi
mov dword [0x1018cc9c], ebx
call fcn.10049c40
push str.WIN.INI
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
call esi
jmp 0x10043e5f
cmp byte [0x10193700], bl
je 0x10043d99
call fcn.10043490
push 0x10193700
lea edx, [esp + 0x544]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [esp + 0x18]
push ebp
lea esi, [esp + 0x544]
mov ebx, edi
call fcn.10042d90
add esp, 4
jmp 0x10043fc9
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [esp + 0x18]
cmp dword [0x1018cc9c], ebx
jne 0x10043e85
mov ebx, dword [esp + 0x1c]
push ebp
mov esi, 0x1019e5a8
mov eax, edi
call fcn.10042d90
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 4
test ebp, ebp
je 0x10043fc9
call fcn.1004c6e0
test eax, eax
je 0x10043fc9
push str.SoftwareMicroWorld
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x24]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x10043fc9
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10149ea8
lea ecx, [esp + 0x24]
push ecx
call esi
push str.WIN.INI
lea edx, [esp + 0x24]
push edx
call esi
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x24]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x10043fc9
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.100454f0
add esp, 4
push 0x10149ea8
lea eax, [esp + 0x24]
push eax
call esi
push ebp
lea ecx, [esp + 0x24]
push ecx
call esi
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x24]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
test eax, eax
jne 0x10043fc9
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x10043f6d
test edi, edi
jne 0x10043f8d
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esp + 0x20]
mov eax, reloc.OLEAUT32.dll_SysReAllocString
call fcn.10048ba0
jmp 0x10043fc9
test edi, edi
jne 0x10043f8d
push esi
call fcn.100454f0
mov edx, dword [esp + 0x18]
add esp, 4
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x14]
push eax
jmp 0x10043fc3
push esi
call fcn.100454f0
push edi
call fcn.100454f0
add esp, 8
cmp byte [edi], 0
mov eax, edi
je 0x10043fa9
inc eax
cmp byte [eax], 0
jne 0x10043fa3
mov ecx, dword [esp + 0x14]
sub eax, edi
inc eax
push eax
push edi
push 1
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x74c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d699
add esp, 0x740
ret