Function at 0x100c6513
Capabilities:
Delete file
Get common file path
Move file
Query or enumerate registry value

Disassembly:
push 0x228
mov eax, 0x100e7976
call fcn.100c74ca
mov esi, ecx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x220], esi
push 1
mov dword [ebp - 0x234], esi
call fcn.100b42c8
xor edi, edi
lea eax, [esi + 0xb0]
mov dword [ebp - 4], edi
push 2
pop ebx
push ebx
push eax
mov byte [ebp - 4], 1
call sub.MSVCP140.dll__Mtx_init_in_situ
pop ecx
pop ecx
lea eax, [ebp - 0x22c]
mov byte [ebp - 4], bl
push eax
push 1
push edi
push str.SOFTWAREAdobeAcrobat_ReaderDCAVEntitlement
push SysReAllocString
mov dword [ebp - 0x220], 4
mov dword [ebp - 0x228], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100c65bf
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
push eax
push edi
push edi
push str.iNGLLogLevel
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x22c]
test eax, eax
cmove ebx, dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x64
pop eax
push 5
pop ecx
cmp ebx, 0x169d
mov dword [esi + 0xe0], ebx
cmove eax, ecx
mov dword [esi + 0xe4], eax
lea eax, [ebp - 0x21c]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathW]
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
mov ebx, 0xfde9
push eax
push edi
push ebx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov esi, eax
test esi, esi
jle 0x100c6667
push 0x10170850
push esi
call fcn.100b5f48
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x100c6667
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
test eax, eax
jle 0x100c6659
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100c6640
sub ecx, edx
mov esi, 0x10170810
push ecx
push edi
mov ecx, esi
call fcn.100b5f48
jmp 0x100c665e
mov esi, 0x10170810
push edi
call fcn.100c7651
pop ecx
jmp 0x100c666c
mov esi, 0x10170810
mov edi, 0x101707e0
push esi
mov ecx, edi
call fcn.100b5f48
push 0x10
pop ebx
cmp dword [0x1017080c], ebx
mov eax, 0x101707f8
push dword [0x10170808]
cmovae eax, dword [0x101707f8]
mov ecx, edi
push eax
call fcn.100b5f48
cmp dword [0x101707dc], ebx
mov eax, 0x101707c8
push dword [0x101707d8]
cmovae eax, dword [0x101707c8]
mov ecx, esi
push eax
call fcn.100b5f48
push esi
mov byte [ebp - 4], 3
call fcn.100c6921
pop ecx
test al, al
je 0x100c6755
lea eax, [ebp - 0x224]
xorps xmm0, xmm0
push eax
push esi
movlpd qword [ebp - 0x224], xmm0
call fcn.100c687e
pop ecx
pop ecx
test al, al
je 0x100c6755
cmp dword [ebp - 0x220], 0
jl 0x100c6755
jg 0x100c6704
cmp dword [ebp - 0x224], 0x200000
jb 0x100c6755
push edi
call fcn.100c6921
pop ecx
test al, al
je 0x100c6726
cmp dword [0x101707f4], ebx
mov eax, edi
cmovae eax, dword [0x101707e0]
push eax
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
pop ecx
push edi
call fcn.100c6921
pop ecx
test al, al
jne 0x100c6755
cmp dword [0x101707f4], ebx
cmovae edi, dword [0x101707e0]
cmp dword [0x10170824], ebx
push edi
cmovae esi, dword [0x10170810]
push esi
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_rename]
pop ecx
pop ecx
mov eax, dword [ebp - 0x230]
jmp 0x100c6769
call fcn.100c7417
ret