Function at 0x1002122
Capabilities:
Copy file
Delete file
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1648
call fcn.01002a80
mov eax, dword [0x1004024]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [edi], esi
mov dword [eax], esi
mov dword [ebp - 0x1648], eax
lea eax, [ebp - 0x1620]
push eax
mov dword [ebp - 0x1638], edx
mov edx, dword [ebp + 0x1c]
push 0x10014c0
push 0x80000002
mov dword [ebp - 0x1644], ecx
mov dword [ebp - 0x1640], edx
mov dword [ebp - 0x1634], esi
mov dword [ecx], esi
mov dword [ebp - 0x1630], esi
mov dword [ebp - 0x1628], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x100219e
xor eax, eax
jmp 0x10024db
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x1624]
push eax
lea eax, [ebp - 0x1634]
push eax
lea eax, [ebp - 0x162c]
push eax
push esi
push 0x100149c
push dword [ebp - 0x1620]
mov dword [ebp - 0x1624], 4
call ebx
lea eax, [ebp - 0x1624]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x162c]
push eax
push esi
push 0x100129c
push dword [ebp - 0x1620]
mov dword [ebp - 0x1624], 0x208
call ebx
push dword [ebp - 0x1620]
mov dword [ebp - 0x163c], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x163c], esi
jne 0x10024d8
lea eax, [ebp - 0x161c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01001d98
test eax, eax
je 0x10024d8
lea eax, [ebp - 0x1620]
push eax
push 0x1001440
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10024d8
lea eax, [ebp - 0x1624]
push eax
push dword [ebp - 0x1648]
lea eax, [ebp - 0x162c]
push eax
push esi
push 0x100142c
push dword [ebp - 0x1620]
mov dword [ebp - 0x1624], 4
call ebx
lea eax, [ebp - 0x1624]
push eax
push dword [ebp - 0x1644]
lea eax, [ebp - 0x162c]
push eax
push esi
push 0x1001418
push dword [ebp - 0x1620]
call ebx
push dword [ebp - 0x694]
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x1620]
call fcn.0100197f
test eax, eax
jl 0x10023a6
cmp dword [ebp - 0x1634], esi
jne 0x10022eb
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x1628], eax
mov dword [edi], 1
jmp 0x10023a6
lea eax, [ebp - 0x1624]
push eax
lea eax, [ebp - 0x1630]
push eax
lea eax, [ebp - 0x162c]
push eax
push esi
push 0x1001404
push dword [ebp - 0x1620]
mov dword [ebp - 0x1630], esi
call ebx
cmp dword [0x1004034], esi
jne 0x100233a
push 0x40
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0xfffffffffffffffe
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
cmp dword [ebp - 0x694], 1
je 0x1002364
cmp dword [ebp - 0x694], 2
je 0x1002364
cmp dword [ebp - 0x694], 4
jne 0x1002395
lea eax, [ebp - 0x414]
mov dword [ebp - 0x1628], eax
push esi
jmp 0x1002382
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x1628], eax
xor eax, eax
cmp dword [ebp - 0x1630], esi
sete al
push eax
lea eax, [ebp - 0x61c]
push esi
push esi
push esi
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileExW]
mov dword [edi], eax
cmp dword [edi], esi
je 0x10023a6
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [ebp - 0x1620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [edi], esi
je 0x10023c1
push dword [ebp - 0x1628]
call fcn.01001ec8
cmp dword [ebp - 0x1628], esi
je 0x10023dd
push dword [ebp - 0x1628]
push dword [ebp - 0x1640]
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
push dword [ebp - 0x1638]
push dword [ebp - 0x1610]
push dword [ebp - 0x1614]
push dword [ebp - 0x15e4]
push dword [ebp - 0x15e8]
push dword [ebp - 0x15ec]
push dword [ebp - 0x15f0]
push dword [ebp - 0x15f4]
call fcn.01001d0c
cmp dword [edi], esi
je 0x1002447
cmp dword [ebp - 0x694], 1
je 0x1002428
cmp dword [ebp - 0x694], 2
jne 0x1002447
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
call fcn.0100187a
lea eax, [ebp - 0x414]
push eax
call fcn.01001ec8
lea eax, [ebp - 0x1620]
push eax
push 0x10011a0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10024c0
lea eax, [ebp - 0x1624]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x162c]
push eax
push esi
push 0x10013e8
push dword [ebp - 0x1620]
mov dword [ebp - 0x1624], 0x104
call ebx
test eax, eax
jne 0x10024b4
mov eax, dword [ebp - 0x1638]
movzx ecx, word [eax]
push ecx
push dword [eax + 4]
push 1
push esi
push 0x10013c8
push dword [ebp - 0x1620]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 8], esi
je 0x10024d8
push esi
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.010017b6
xor eax, eax
inc eax
jmp 0x10024da
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.010027e1
leave
ret 0x18