Function at 0x10296be
Capabilities:
Create directory
Delete directory
Delete file
Get common file path
Move file
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov dword [ebp - 0x424], eax
xor edi, edi
lea eax, [ebp - 0x430]
xor ebx, ebx
inc edi
push eax
mov dword [ebp - 0x430], ebx
mov dword [ebp - 0x42c], edi
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
cmp eax, ebx
mov dword [ebp - 0x434], eax
jl 0x1029ba4
push esi
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x41c], ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x428], ebx
call fcn.010294e2
test eax, eax
mov esi, 0x104
je 0x10298cf
lea eax, [ebp - 0x420]
push eax
push edi
push ebx
push 0x10024d8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10297c3
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x42c]
push eax
push ebx
push 0x1003370
push dword [ebp - 0x420]
mov dword [ebp - 0x428], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10297ab
cmp dword [ebp - 0x42c], edi
jne 0x10297ab
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
je 0x10297ab
mov dword [ebp - 0x41c], edi
mov dword [ebp - 0x424], edi
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x41c], ebx
jne 0x10299fc
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10297fb
push 0x10032e0
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
jne 0x10298be
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x102987e
lea eax, [ebp - 0x20c]
push eax
call fcn.01032458
push esi
lea eax, [ebp - 0x414]
push eax
push 0x9f
push dword [0x1047500]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x102987e
push 0x10032c8
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
push 0x1003270
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
jne 0x10298be
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10298cf
lea eax, [ebp - 0x20c]
push eax
call fcn.01032458
push 0x1003244
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
je 0x10298cf
mov dword [ebp - 0x41c], edi
mov dword [ebp - 0x424], edi
jmp 0x10299fc
lea eax, [ebp - 0x418]
push eax
push 0x802e
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov edi, eax
cmp edi, ebx
jl 0x102990d
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0x7fffbffb
add edi, 0x80004005
cmp dword [ebp - 0x418], ebx
je 0x102992d
mov eax, dword [ebp - 0x430]
push dword [ebp - 0x418]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x418], ebx
cmp edi, 0x80070057
jne 0x10299c0
lea eax, [ebp - 0x420]
push eax
push 1
push ebx
push 0x10031c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10299fc
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x42c]
push eax
push ebx
push 0x1003198
push dword [ebp - 0x420]
mov dword [ebp - 0x428], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10299b4
cmp dword [ebp - 0x42c], 1
jne 0x10299b4
cmp word [ebp - 0x20c], bx
je 0x10299b4
lea eax, [ebp - 0x20c]
push eax
call fcn.01033ed9
test eax, eax
je 0x10299b4
xor edi, edi
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jl 0x10299fc
lea eax, [ebp - 0x20c]
push eax
call fcn.01032458
push 0x1003140
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01028adc
lea eax, [ebp - 0x20c]
push eax
call fcn.010326f3
test eax, eax
je 0x10299fc
mov dword [ebp - 0x41c], 1
lea eax, [ebp - 0x418]
push eax
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
cmp eax, ebx
mov dword [ebp - 0x434], eax
jl 0x1029b77
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1029b6d
lea eax, [ebp - 0x414]
push eax
call fcn.01032458
push 0x1003128
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01028adc
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
lea eax, [ebp - 0x414]
push eax
call edi
push 0x100310c
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01028adc
push ebx
lea eax, [ebp - 0x414]
push eax
call edi
mov edi, 0x10030e4
push edi
push 1
lea eax, [ebp - 0x414]
push eax
call fcn.01027beb
push 0x1003244
push esi
lea eax, [ebp - 0x414]
push eax
call fcn.01028adc
cmp dword [ebp - 0x41c], ebx
je 0x1029b77
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1029b77
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov esi, eax
cmp esi, ebx
jne 0x1029b16
cmp dword [ebp - 0x424], ebx
je 0x1029b16
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1029b16
push 3
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov esi, eax
push edi
push 1
lea eax, [ebp - 0x414]
push eax
call fcn.01027beb
cmp dword [ebp - 0x424], ebx
je 0x1029b77
cmp esi, ebx
je 0x1029b77
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, dword [sym.imp.msvcrt.dll_wcsrchr]
jmp 0x1029b5a
mov word [eax], bx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x1029b77
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call esi
cmp eax, ebx
pop ecx
pop ecx
jne 0x1029b46
jmp 0x1029b77
mov dword [ebp - 0x434], 0x80004005
cmp dword [ebp - 0x418], ebx
pop esi
je 0x1029b98
mov eax, dword [ebp - 0x430]
push dword [ebp - 0x418]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov dword [ebp - 0x418], ebx
mov eax, dword [ebp - 0x430]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x434]
pop edi
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret 4