Function at 0x1006ddbb
Capabilities:
Delete file
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x1008a418]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0x278]
mov dword [ebp - 0x228], edx
stosd dword es:[edi], eax
mov esi, ecx
push 0x208
lea ecx, [ebp - 0x264]
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x26c], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x28c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
xor edi, edi
push eax
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x238], edi
call fcn.100102ed
mov dword [ebp - 0x268], edi
xor eax, eax
lea edi, [ebp - 0x258]
and dword [ebp - 0x22c], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebp - 0x224]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x10089098]
mov ecx, dword [eax + 0x38]
mov edx, dword [eax + 0x3c]
mov eax, ecx
or eax, edx
je 0x1006de79
push 1
push edx
push ecx
push 0x34
pop edx
call fcn.10010290
lea eax, [ebp - 0x224]
push eax
call dword [sym.imp.RPCRT4.dll_UuidCreate]
test eax, eax
je 0x1006de94
mov ebx, 0x8007000e
jmp 0x1006e119
lea eax, [ebp - 0x268]
mov edx, ebx
push eax
call fcn.1006dc5f
mov ebx, eax
test ebx, ebx
js 0x1006e0fe
cmp dword [ebp - 0x268], 0
mov ecx, 0x10003f08
je 0x1006dec0
mov ecx, dword [ebp - 0x264]
lea eax, [ebp - 0x22c]
mov edx, esi
push eax
call fcn.10042870
mov ebx, eax
test ebx, ebx
js 0x1006e0b8
mov ebx, dword [ebp - 0x22c]
mov eax, dword [ebx + 4]
mov eax, dword [eax + 0x10]
mov edi, dword [eax + 0x78]
test edi, edi
jne 0x1006def2
xor ebx, ebx
jmp 0x1006e0b8
test esi, esi
je 0x1006df15
push 0
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
push ecx
lea eax, [edi + 1]
mov edx, 0x1143
push eax
push 0x177a
mov ecx, esi
call fcn.10046de0
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x258]
push eax
mov ecx, ebx
call fcn.1006d38f
mov ebx, eax
test ebx, ebx
js 0x1006e0b8
mov eax, dword [ebp - 0x228]
lea ecx, [ebp - 0x248]
mov edi, esp
push ecx
lea ecx, [ebp - 0x24c]
mov esi, dword [eax]
push ecx
push eax
mov ecx, dword [esi + 0x64]
call dword [0x1008c6d4]
call dword [esi + 0x64]
cmp edi, esp
je 0x1006df63
mov ecx, 4
int 0x29
mov ebx, eax
test ebx, ebx
js 0x1006e0b8
mov esi, dword [ebp - 0x22c]
xor eax, eax
mov edi, dword [ebp - 0x23c]
mov dword [ebp - 0x244], eax
mov eax, dword [eax + 0x10008048]
mov dword [ebp - 0x284], eax
lea eax, [ebp - 0x28c]
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x274], 0xffe0003
push eax
lea eax, [ebp - 0x278]
mov dword [ebp - 0x278], 4
push eax
push 0
push 0
push esi
mov dword [ebp - 0x28c], 0xffe0003
call fcn.10045bf0
mov ebx, eax
test ebx, ebx
js 0x1006e0b8
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x234]
test eax, eax
je 0x1006e057
mov ebx, dword [ebp - 0x230]
mov dword [ebp - 0x228], ebx
jmp 0x1006e005
mov ebx, dword [ebp - 0x228]
call fcn.10047299
test eax, eax
jne 0x1006e182
test edi, edi
lea edx, [ebp - 0x224]
mov ecx, ebx
setne al
push eax
push esi
lea eax, [ebp - 0x258]
push eax
call fcn.1006d9e8
mov ebx, eax
test ebx, ebx
jns 0x1006e039
mov dword [ebp - 0x238], ebx
mov ecx, dword [ebp - 0x240]
add dword [ebp - 0x228], 8
inc ecx
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x240], ecx
cmp ecx, eax
jb 0x1006dfff
push dword [ebp - 0x230]
push eax
push esi
call fcn.10017850
mov eax, dword [ebp - 0x244]
and dword [ebp - 0x230], 0
add eax, 4
and dword [ebp - 0x234], 0
mov dword [ebp - 0x244], eax
cmp eax, 8
jb 0x1006df81
push dword [ebp - 0x26c]
xor eax, eax
mov word [ebp - 0x228], ax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 2
push 2
lea ecx, [ebp - 0x228]
push ecx
push 1
push eax
push 0x10008050
call dword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x1006e0fe
push dword [ebp - 0x230]
push dword [ebp - 0x234]
push eax
call fcn.10017850
mov ecx, dword [ebp - 0x22c]
mov edi, esp
push 1
mov eax, dword [ecx]
mov esi, dword [eax + 0x54]
mov ecx, esi
call dword [0x1008c6d4]
mov ecx, dword [ebp - 0x22c]
call esi
cmp edi, esp
je 0x1006e0fe
mov ecx, 4
int 0x29
cmp dword [ebp - 0x268], 0
je 0x1006e113
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [ebp - 0x23c]
cmp dword [ebp - 0x248], 0
je 0x1006e12d
push dword [ebp - 0x248]
call fcn.10033470
cmp dword [ebp - 0x254], 0
je 0x1006e142
push dword [ebp - 0x254]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x250], 0
je 0x1006e157
push dword [ebp - 0x250]
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x1006e1c2
push 1
push esi
call dword [sym.imp.USER32.dll_EnableWindow]
call fcn.10046e4b
cmp ebx, 0x80040113
je 0x1006e1c2
mov edi, dword [ebp - 0x238]
test ebx, ebx
jns 0x1006e18c
mov edx, 0x1145
jmp 0x1006e19a
mov ebx, 0x80040113
jmp 0x1006e0b8
mov edx, edi
sar edx, 0x1f
and edx, 1
add edx, 0x1146
push 0x40
mov ecx, esi
call fcn.10060325
mov eax, dword [0x10089098]
mov ecx, dword [eax + 0x38]
mov esi, dword [eax + 0x3c]
mov eax, ecx
or eax, esi
je 0x1006e1c8
push 2
push esi
push ecx
push 0x34
pop edx
call fcn.10010290
jmp 0x1006e1c8
mov edi, dword [ebp - 0x238]
test ebx, ebx
js 0x1006e1d5
test edi, edi
jns 0x1006e1d5
mov ebx, 0x40380
and dword [ebp - 0x268], 0
lea ecx, [ebp - 0x264]
call fcn.1000deab
mov ecx, dword [ebp - 8]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10087900
mov esp, ebp
pop ebp
ret 4