Function at 0x100a1a0
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa20
mov eax, dword [0x1013050]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
cmp dword [esi], 2
push edi
mov dword [ebp - 0xa18], 0
jb 0x100a54d
mov eax, dword [esi + 0x670]
test eax, eax
je 0x100a1ec
push eax
push 0x10034c0
push 2
push 0x10130b0
call fcn.01007a00
add esp, 0x10
test byte [esi + 0x650], 0x40
je 0x100a2b5
lea edi, [esi + 0x236]
push edi
push dword [0x1013020]
lea eax, [esi + 0x65c]
push eax
call fcn.010072e0
test eax, eax
je 0x100a2b5
push 0
push 0x80
push 1
push 0
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [esi + 0x698]
mov dword [esi + 0x64c], eax
cmp eax, 0xffffffff
jne 0x100a458
test ebx, ebx
je 0x100a2b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x100a2b5
push ebx
push 0x1003508
push 2
push 0x10130b0
call fcn.01007a00
mov esi, dword [esi + 0x670]
add esp, 0x10
test esi, esi
je 0x100a2a2
push esi
call dword [sym.imp.MSVCR100.dll__wremove]
add esp, 4
cmp eax, 0xffffffff
jne 0x100a2a2
call dword [sym.imp.MSVCR100.dll__errno]
push dword [eax]
push esi
push 0x10035b8
push 2
push 0x10130b0
call fcn.01007a00
add esp, 0x14
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100f899
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x674], 0
jne 0x100a3d4
mov eax, dword [esi + 0x684]
test eax, eax
jne 0x100a2d8
cmp dword [esi + 0x1148], eax
je 0x100a3d4
push dword [esi + 0x650]
push dword [esi + 0x688]
push eax
call fcn.0100e860
mov dword [ebp - 0xa14], eax
test eax, eax
je 0x100a43b
xor eax, eax
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x684], 0
mov dword [ebp - 0xa20], 0x20a
mov dword [ebp - 0xa1c], 0
mov eax, 0x1003620
jne 0x100a33d
mov eax, 0x100363c
lea ecx, [ebp - 0xa20]
push ecx
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0xa1c]
push ecx
push 0
push eax
push dword [ebp - 0xa14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100a3c8
cmp dword [ebp - 0xa1c], 1
jne 0x100a3c8
lea ebx, [esi + 0x1378]
lea edi, [ebp - 0x210]
mov edx, 0x103
mov ecx, ebx
sub edi, ebx
lea eax, [edx + 0x7ffffefb]
test eax, eax
je 0x100a3a9
movzx eax, word [edi + ecx]
test ax, ax
je 0x100a3a9
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x100a383
sub ecx, 2
mov eax, 0x8007007a
jmp 0x100a3b9
test edx, edx
jne 0x100a3b7
sub ecx, 2
mov eax, 0x8007007a
jmp 0x100a3b9
xor eax, eax
xor edx, edx
mov word [ecx], dx
test eax, eax
jne 0x100a3c8
mov dword [esi + 0x674], ebx
push dword [ebp - 0xa14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
lea edi, [esi + 0x236]
push edi
push dword [0x1013020]
lea eax, [esi + 0x2c]
push dword [esi + 0x674]
push eax
call fcn.010075d0
test eax, eax
je 0x100a41a
push 0
push 0x80
push 1
push 0
push 3
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x64c], eax
cmp eax, 0xffffffff
jne 0x100a458
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xa14], eax
cmp eax, 0x50
jne 0x100a4ce
inc ebx
cmp ebx, 5
jge 0x100a535
jmp 0x100a3dc
or dword [section..data], 0x20000002
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100f899
mov esp, ebp
pop ebp
ret
lea ecx, [esi + 0x440]
mov dword [ebp - 0xa18], 1
mov edx, 0x104
sub edi, ecx
nop
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x100a4ab
movzx eax, word [edi + ecx]
test ax, ax
je 0x100a4ab
mov word [ecx], ax
add ecx, 2
dec edx
jne 0x100a470
sub ecx, 2
pop edi
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, dword [ebp - 0xa18]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100f899
mov esp, ebp
pop ebp
ret
test edx, edx
jne 0x100a4b2
sub ecx, 2
pop edi
xor eax, eax
pop esi
mov word [ecx], ax
mov eax, dword [ebp - 0xa18]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0100f899
mov esp, ebp
pop ebp
ret
push 0
push 0x400
lea ecx, [ebp - 0xa10]
push ecx
push 0x400
push eax
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
je 0x100a517
lea eax, [ebp - 0xa10]
push eax
push dword [ebp - 0xa14]
push edi
push 0x1003660
push 1
push 0x10130b0
call fcn.01007a00
add esp, 0x18
jmp 0x100a532
push dword [ebp - 0xa14]
push edi
push 0x10036b0
push 1
push 0x10130b0
call fcn.01007a00
add esp, 0x14
cmp ebx, 5
jne 0x100a54d
push 5
push 0x1003708
push 1
push 0x10130b0
call fcn.01007a00
add esp, 0x10
mov ecx, dword [ebp - 4]
or dword [section..data], 0x20000002
mov eax, dword [ebp - 0xa18]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100f899
mov esp, ebp
pop ebp
ret