Function at 0x10026a91
Capabilities:
Delete registry key
Enumerate gui resources
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x1005d634
call fcn.1005c588
sub esp, 0xec
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x50], edx
mov byte [ebp - 0x3c], cl
je 0x10027046
xor ebx, ebx
test cl, cl
je 0x1002703b
mov dword [ebp - 0x14], 0x4b8f
cmp dword [ebp - 0x14], 0x4df5
jle 0x10026b2f
push ebx
push ebx
call dword [sym.imp.USER32.dll_EnumWindows]
mov edi, ebx
mov esi, 0x10079cf8
mov dword [ebp - 0x1c], edi
mov eax, ebx
mov dword [ebp + 0x18], ebx
mov dword [ebp - 0x18], ebx
mov ecx, eax
mov ebx, edi
mov edi, dword [ebp - 0x18]
shl ebx, cl
mov ecx, edi
mov eax, ebx
shl eax, cl
mov ecx, esi
cdq
push edx
push eax
call fcn.1000dad0
inc edi
cmp edi, 0x487d
jl 0x10026af4
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp - 0x1c]
inc eax
mov dword [ebp + 0x18], eax
push 0
pop ebx
cmp eax, 0x5ff
jl 0x10026ae8
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x5977
jl 0x10026ae3
jmp 0x10026b34
mov esi, 0x10079cf8
mov dword [ebp + 0x18], 0xffffffff
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 0x498f
jge 0x10026b53
mov edx, str.bqdddxgnw_rhxqd_kaas_znjxpxbz_ojjbrwg_bhcbo_ajaysw_gptj_rotjdhrse_kvnfnf_zievuz
mov ecx, esi
call fcn.1001081c
or dword [ebp - 4], 0xffffffff
push 4
lea ecx, [ebp - 0x5c]
call fcn.1000ddb2
lea eax, [ebp - 0x78]
mov dword [ebp - 4], 2
push eax
push 0x53e0
push 0x184
lea ecx, [ebp - 0x5c]
call fcn.100290d8
mov eax, dword [ebp + 0x18]
add esp, 0xc
mov dword [ebp + 0x18], eax
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebp - 0x5c]
mov dword [eax + 0xc], ecx
mov byte [ebp + 0x1b], bl
cmp byte [ebp + 0x1b], 0
je 0x10026ba3
mov edx, 0x70b6
call fcn.10027171
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.1000de35
mov dword [ebp + 0x18], 0xa53d06ce
mov dword [ebp + 0x18], ebx
mov dword [ebp + 0x18], 0xfffffff6
mov dword [ebp + 0x18], 0x2b02
cmp dword [ebp + 0x18], 0x2e71
jle 0x10026c02
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, ebx
mov dword [ebp - 0x18], ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, esi
cdq
push edx
push eax
call fcn.1000dad0
inc ebx
cmp ebx, 0x381b
jl 0x10026bdd
inc edi
push 0
pop ebx
cmp edi, 0x7b91
jl 0x10026bda
mov dword [ebp - 0x18], 0x2830
mov dword [ebp - 4], 3
cmp dword [ebp + 0x18], 0x2a22
jge 0x10026c25
mov edx, str.vop_zdokc_dyusm_vcfkynss_zwm_qovlngc_msanneef_lsypecexn_yffenc_akwkjsto_ysq
mov ecx, esi
call fcn.1001081c
or dword [ebp - 4], 0xffffffff
push 9
mov dword [ebp - 0x38], 0xfffffff7
pop edi
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x18], ebx
jmp 0x10026c98
mov eax, dword [ebp + 0x18]
mov dword [ebp + eax*4 - 0xb8], 0x7b1891f7
inc dword [ebp + 0x18]
cmp dword [ebp + 0x18], 3
jl 0x10026c87
mov dword [ebp + 0x18], ebx
jmp 0x10026cb4
mov eax, dword [ebp + 0x18]
mov dword [ebp + eax*4 - 0xf8], 0x89328a06
inc dword [ebp + 0x18]
cmp dword [ebp + 0x18], 4
jl 0x10026ca3
push 0x72ae
xor eax, eax
push 0x6d7e
push ecx
lea ecx, [ebp - 0x38]
lea edx, [eax + 1]
call fcn.10026924
xor ecx, ecx
mov byte [ebp - 0x1d], bl
inc ecx
lea eax, [ebp - 0x1d]
push ecx
push eax
push 0x4ab6
push 0x4f28
push 0x5393
mov dl, cl
call fcn.10026676
add esp, 0x20
mov byte [ebp - 0x24], bl
mov ecx, ebx
mov word [ebp - 0x23], 0x174
mov byte [ebp - 0x21], 0xec
mov dword [ebp - 0x40], ecx
push 0x7c
pop eax
push 2
mov word [ebp - 0x2c], ax
pop esi
cmp esi, 2
jne 0x10026d1e
push esi
pop ecx
mov dword [ebp - 0x40], ecx
jmp 0x10026d64
movzx edx, byte [ebp + esi - 0x23]
mov eax, esi
sub eax, ecx
push 0x6972
push 0x759f
movzx eax, byte [ebp + eax - 0x26]
movzx eax, word [ebp + eax*2 - 0x2c]
mov ecx, eax
and eax, edx
or ecx, edx
lea edx, [ebp - 0x40]
sub ecx, eax
movzx eax, byte [ebp + esi - 0x24]
push ecx
push ecx
push 0x12ec
mov word [ebp + eax*2 - 0x2c], cx
mov cl, 1
call fcn.10026839
mov ecx, dword [ebp - 0x40]
add esp, 0x14
add esi, 2
cmp esi, 4
jb 0x10026d12
xor eax, eax
mov dword [ebp - 0x7c], 7
mov word [ebp - 0x2a], ax
lea ecx, [ebp - 0x90]
mov word [ebp - 0x90], ax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x80], ebx
call fcn.10024398
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x90]
push eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], 5
call fcn.10026593
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 7
call fcn.1000e73d
mov dword [ebp + 0x18], 0x85c6
lea ecx, [ebp - 0x74]
push 2
call fcn.1000ddb2
push 0xc46
push 0x2fff
push ecx
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 8
push eax
push 1
mov dword [ebp - 0x14], 0xc99220c4
lea ecx, [ebp - 0x74]
sub esp, 0xc
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x18], 0x5e1bfeda
call fcn.100268a1
xor ecx, ecx
add esp, 0x20
inc ecx
cmp dword [ebp + 0x18], ecx
jg 0x10026e4f
cmp dword [ebp + 0x18], ebx
jne 0x10026e1f
mov eax, dword [ebp + 0x18]
mov ecx, ebx
mov eax, dword [ebp - 0x74]
mov dword [eax], ecx
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor eax, eax
inc ecx
cmp ecx, 3
setge al
xor ecx, ecx
inc ecx
add eax, 0x41a80d1c
jne 0x10026e56
mov eax, ebx
cmp dword [ebp - 0x14], ebx
je 0x10026e58
mov eax, ecx
cmp eax, dword [ebp + 0x18]
jne 0x10026e64
mov eax, ecx
cmp dword [ebp - 0x1c], ebx
jne 0x10026e66
mov eax, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xbdbaf9eb
sbb eax, eax
inc eax
cmp dword [ebp + 0x18], eax
jne 0x10026e9b
cmp dword [ebp + 0x18], ebx
je 0x10026e9b
xor eax, eax
inc eax
jmp 0x10026e9d
mov eax, ebx
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 7
call fcn.1000de35
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], 0x1a20
cmp dword [ebp - 0x18], 0x1d83
jle 0x10026f55
mov dword [ebp + 0x18], ebx
mov edi, ebx
mov dword [ebp - 0x14], ebx
mov esi, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [esi + edi]
mov dword [ebp - 0x28], 0x165c
mov edi, dword [ebp + 0x18]
mov esi, eax
mov dword [ebp - 0x38], eax
mov eax, esi
lea ecx, [ebp - 0xe8]
xor eax, edi
cdq
push edx
push eax
call fcn.10001abf
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10026efe
mov eax, dword [eax]
push eax
call fcn.10044453
pop ecx
xor eax, eax
lea ecx, [ebp - 0xe8]
push ebx
inc eax
push eax
call fcn.1000e569
dec esi
dec dword [ebp - 0x28]
jne 0x10026ee2
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x23dc
jl 0x10026ed0
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x1c6
jl 0x10026ecb
mov eax, dword [ebp + 0x18]
inc eax
mov dword [ebp + 0x18], eax
cmp eax, 0x6333
jl 0x10026ec6
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
push 9
pop edi
cmp dword [ebp - 0x18], 0x1827
jge 0x10026f69
push str.mvekhk_gqhdps_fawkrjgd_gxbstupas_pxbpshhfz_uoqtksen_gvia
call fcn.10044453
pop ecx
mov dword [ebp - 4], 7
xor eax, eax
inc eax
mov byte [ebp - 0x34], bl
push 2
mov dword [ebp - 0x33], 0x30302e0
mov byte [ebp - 0x2f], 0x2a
mov byte [ebp - 0x2e], al
mov byte [ebp - 0x2d], 0x2d
mov word [ebp - 0x4c], di
pop esi
movzx eax, byte [ebp + esi - 0x36]
movzx ecx, byte [ebp + esi - 0x33]
movzx edx, word [ebp + eax*2 - 0x4c]
mov eax, edx
and eax, ecx
add eax, eax
sub edx, eax
movzx eax, byte [ebp + esi - 0x34]
add edx, ecx
add esi, 2
mov word [ebp + eax*2 - 0x4c], dx
cmp esi, 8
jb 0x10026f8f
xor eax, eax
mov dword [ebp - 0x98], 7
mov word [ebp - 0x44], ax
lea ecx, [ebp - 0xac]
mov word [ebp - 0xac], ax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x9c], ebx
call fcn.10024398
xor eax, eax
mov byte [ebp - 4], 0xb
lea edi, [ebp - 0x4c]
mov edx, 0x108d
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xac]
push eax
xor eax, eax
inc eax
push eax
lea eax, [ebp - 0x68]
push eax
push ecx
push 0x27a6
call fcn.10026a03
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x68]
add esp, 0x14
push eax
call fcn.10029fd8
xor eax, eax
lea ecx, [ebp - 0xac]
push ebx
inc eax
push eax
call fcn.1000e73d
lea ecx, [ebp - 0x68]
call fcn.1002a506
jmp 0x1002709d
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
jmp 0x1002709d
cmp byte [ebp + 0x14], 0
je 0x10027083
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp - 0xd0]
push eax
call fcn.10029eb5
mov ecx, dword [ebp + 8]
push eax
mov dword [ebp - 4], 0xc
call fcn.10029f68
push 0
push 1
lea ecx, [ebp - 0xd0]
call fcn.1000e73d
jmp 0x1002709d
xor ebx, ebx
push ebx
push 0x1826
push 0x22e1
push 0x1a1c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret