Function at 0x40b934
Capabilities:
Delete directory
Delete file
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1234
call fcn.00415c50
and word [ebp - 0x82c], 0
push ebx
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x82a]
and word [ebp - 0x1234], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x1232]
mov esi, dword [sym.imp.MSVCRT.dll__snwprintf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x42b100
push 0x42b0e0
lea eax, [ebp - 0x1234]
mov ebx, 0x103
push 0x3ff
push eax
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], ebx
call esi
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1234]
push 0x42b210
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40baba
xor edx, edx
mov ecx, 0x81
lea edi, [ebp - 0x41a]
mov word [ebp - 0x41c], dx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x41c]
push eax
push edx
push edx
push 0x19
push edx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x40ba48
and word [ebp - 0x214], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x42b1fc
lea eax, [ebp - 0x214]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
push 0x208
lea eax, [ebp - 0x41c]
push edi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
push edi
push edi
push 0x10
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x40baba
mov word [ebp - 0x214], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x82c]
push eax
lea eax, [ebp - 0x41c]
push eax
push 0x42b1fc
lea eax, [ebp - 0x214]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and word [ebp - 0x624], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x622]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 4], 0x422c60
lea eax, [ebp - 0x624]
xor edi, edi
push eax
mov eax, dword [ebp - 4]
push edi
push edi
push dword [eax - 8]
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x40bb8f
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x40bb8f
cmp dword [eax - 4], edi
je 0x40bb4d
mov word [ebp - 0x214], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x212]
push dword [ebp - 4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x624]
push eax
push 0x4225d8
lea eax, [ebp - 0x214]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40bb8d
mov word [ebp - 0x41c], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x41a]
push dword [ebp - 4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x624]
push eax
push 0x4225d8
lea eax, [ebp - 0x41c]
push ebx
push eax
call esi
lea eax, [ebp - 0x41c]
push eax
call fcn.0040ff68
add esp, 0x18
xor edi, edi
add dword [ebp - 4], 0x210
cmp dword [ebp - 4], 0x424b50
jl 0x40bada
lea eax, [ebp - 0x624]
push eax
push edi
push edi
push 2
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov word [ebp - 0xa34], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0xa32]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x624]
push eax
push 0x42b1e4
lea eax, [ebp - 0xa34]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0xa34]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret