Function at 0x102ad13
Capabilities:
Delete file
Delete registry value
Get common file path
Get file attributes
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
push edi
push esi
push esi
push 2
push 5
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x634], esi
mov dword [ebp - 0x638], esi
mov dword [ebp - 0x62c], esi
mov dword [ebp - 0x630], 1
call fcn.01034068
test eax, eax
mov ebx, 0x104
je 0x102af89
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x628], esi
mov dword [ebp - 0x624], esi
call fcn.01034382
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
je 0x102ae81
lea eax, [ebp - 0x20c]
push eax
call fcn.01032458
push 0x1002f14
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
test eax, eax
jl 0x102ae81
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
je 0x102ae81
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01032aa3
test eax, eax
jl 0x102ae81
mov eax, dword [ebp - 0x628]
shr eax, 0x10
cmp ax, 9
jae 0x102ae81
lea eax, [ebp - 0x20c]
push eax
call edi
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x102ae81
lea eax, [ebp - 0x20c]
push eax
call fcn.01032458
push 0x1004a0c
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
test eax, eax
jl 0x102ae81
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
je 0x102ae81
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01032aa3
test eax, eax
jl 0x102ae81
mov eax, dword [ebp - 0x628]
shr eax, 0x10
cmp ax, 9
jae 0x102ae81
lea eax, [ebp - 0x20c]
push eax
call edi
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01034382
test eax, eax
je 0x102af89
lea eax, [ebp - 0x20c]
push eax
call fcn.01032458
push 0x10029d8
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
test eax, eax
jl 0x102af89
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
je 0x102af89
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01032aa3
test eax, eax
jl 0x102af89
mov eax, dword [ebp - 0x628]
shr eax, 0x10
cmp ax, 9
jae 0x102af89
lea eax, [ebp - 0x20c]
push eax
call edi
push ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x102af89
lea eax, [ebp - 0x20c]
push eax
call fcn.01032458
push 0x10049e0
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
test eax, eax
jl 0x102af89
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
je 0x102af89
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.01032aa3
test eax, eax
jl 0x102af89
mov eax, dword [ebp - 0x628]
shr eax, 0x10
cmp ax, 9
jae 0x102af89
lea eax, [ebp - 0x20c]
push eax
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x620]
push eax
push 3
push esi
push 0x1004978
push 0x80000002
call edi
test eax, eax
jne 0x102b09f
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x630]
push eax
push esi
push 0x1004950
push dword [ebp - 0x620]
mov dword [ebp - 0x62c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102b093
cmp dword [ebp - 0x630], 1
jne 0x102b093
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
lea eax, [ebp - 0x414]
mov dword [esp], 0x1004934
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x102b093
push ebx
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x102b093
lea eax, [ebp - 0x414]
push eax
push 0x1004914
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.01028b64
add esp, 0x10
test eax, eax
jl 0x102b093
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
je 0x102b093
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x102b065
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push esi
push 0x1004950
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
push 0x10048b0
push 0x80000000
call edi
test eax, eax
jne 0x102b1e1
lea eax, [ebp - 0x634]
push eax
push 0x20019
push esi
push 0x1004860
push dword [ebp - 0x620]
call edi
test eax, eax
jne 0x102b14a
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x630]
push eax
push esi
push 0x1004844
push dword [ebp - 0x634]
mov dword [ebp - 0x62c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102b11c
cmp dword [ebp - 0x630], 1
je 0x102b126
mov dword [ebp - 0x638], 1
push dword [ebp - 0x634]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x638], esi
je 0x102b14a
push 0x1004860
push dword [ebp - 0x620]
call fcn.01033666
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x624], esi
mov dword [ebp - 0x62c], ebx
push esi
jmp 0x102b1c5
inc dword [ebp - 0x624]
lea eax, [ebp - 0x634]
push eax
push 2
push esi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x620]
mov dword [ebp - 0x62c], ebx
call edi
test eax, eax
jne 0x102b1ad
push esi
push dword [ebp - 0x634]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x634]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x624]
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x102b16b
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
lea eax, [ebp - 0x620]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x1004788
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102b26c
push 0x4e
push 0x1004738
push 1
push esi
push 0x10021cc
push dword [ebp - 0x620]
mov dword [ebp - 0x624], 0x600000
push esi
call fcn.0103376e
push 0x26
push 0x1004710
push 1
push esi
push 0x10046f4
push dword [ebp - 0x620]
push esi
call fcn.0103376e
push 4
lea eax, [ebp - 0x624]
push eax
push 4
push esi
push 0x10046e8
push dword [ebp - 0x620]
push esi
call fcn.0103376e
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
push 0x1004678
push 0x80000002
call edi
test eax, eax
jne 0x102b3a8
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x62c], ebx
mov dword [ebp - 0x628], esi
push esi
jmp 0x102b388
inc dword [ebp - 0x628]
lea eax, [ebp - 0x624]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x620]
mov dword [ebp - 0x624], esi
mov dword [ebp - 0x638], esi
mov dword [ebp - 0x62c], ebx
call edi
test eax, eax
jne 0x102b370
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x630]
push eax
push esi
push 0x1004660
push dword [ebp - 0x624]
mov dword [ebp - 0x63c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102b344
cmp dword [ebp - 0x630], 1
jne 0x102b344
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x638], eax
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x638], esi
je 0x102b370
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x620]
call fcn.01033666
dec dword [ebp - 0x628]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x628]
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x102b2b1
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x620]
push eax
push 0x2001f
push esi
push 0x1004610
push 0x80000002
mov dword [ebp - 0x620], esi
call edi
test eax, eax
jne 0x102b479
lea eax, [ebp - 0x624]
push eax
push 0x20019
push esi
mov ebx, 0x10045d0
push ebx
push dword [ebp - 0x620]
mov dword [ebp - 0x624], esi
call edi
test eax, eax
jne 0x102b418
push dword [ebp - 0x624]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
push 0x10045a4
call fcn.010433d0
push ebx
push dword [ebp - 0x620]
call fcn.01033666
push 0x1004598
push 0x1002f14
push 0x1004588
push 0x100457c
call fcn.0103c333
push 1
push 0x1004564
call fcn.010433d0
push 0x1004544
push dword [ebp - 0x620]
call fcn.01033666
push 0x1004514
push dword [ebp - 0x620]
call fcn.01033666
push 0x10044f0
push dword [ebp - 0x620]
call fcn.01033666
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x620]
push eax
push 2
push esi
push 0x10044e4
push 0x80000000
call edi
test eax, eax
jne 0x102b4b0
push 0x10044c8
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x620]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.0102a788
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret