Function at 0x100100f4
Capabilities:
Check if file exists
Delete registry key
Get common file path
Get file attributes
Get session user name
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x100213b0
call fcn.1001fbd0
sub esp, 0x404
push ebx
push esi
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push eax
push 0x28
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10010155
lea eax, [ebp - 0x2c]
push eax
push str.SeRestorePrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
lea eax, [ebp - 0x30]
push ebx
push eax
push ebx
push dword [ebp - 0x1c]
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x24], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov esi, 0x94
lea eax, [ebp - 0x104]
push esi
push ebx
push eax
xor edi, edi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x104]
mov dword [ebp - 0x104], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1001024e
cmp dword [ebp - 0xf4], 2
jne 0x1001024e
lea eax, [ebp - 0x18]
push eax
push 1
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001024e
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x104
push eax
lea eax, [ebp - 0x208]
push eax
push ebx
push ebx
push str.AppData
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10010235
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_strlen
dec eax
pop ecx
mov dword [ebp - 0x14], eax
cmp byte [ebp + eax - 0x208], 0x5c
mov eax, 0x1002c18c
je 0x100101ff
mov eax, 0x1002a528
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x30c]
push str._s_sDMCache
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1001023b
push 1
pop edi
jmp 0x1001023b
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x10010325
jmp 0x10010254
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x208]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x10010400
lea eax, [ebp - 0x208]
push eax
call sub.MSVCRT.dll_strlen
dec eax
pop ecx
mov dword [ebp - 0x14], eax
cmp byte [ebp + eax - 0x208], 0x5c
mov eax, 0x1002c18c
je 0x10010293
mov eax, 0x1002a528
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x30c]
push str._s_sDMCache
push eax
call esi
add esp, 0x10
cmp dword [ebp - 0xf4], 2
jne 0x1001030f
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x40
push eax
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x100102db
lea eax, [ebp - 0x70]
push str.default_user
push eax
call esi
pop ecx
pop ecx
mov eax, dword [ebp - 0x14]
cmp byte [ebp + eax - 0x208], 0x5c
mov eax, 0x1002c18c
je 0x100102f2
mov eax, 0x1002a528
lea ecx, [ebp - 0x70]
push ecx
push eax
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x30c]
push str._s_sDMCache_s
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10010400
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x410]
push str._s_settings.bak
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10010400
cmp dword [ebp - 0xf4], 2
jne 0x10010372
lea eax, [ebp - 0x410]
push ebx
push eax
push dword [0x1002c458]
call dword [sym.imp.ADVAPI32.dll_RegRestoreKeyA]
jmp 0x100103cd
lea eax, [ebp - 0x410]
mov edi, str.idmtmp
push eax
mov esi, SysStringLen
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyA]
test eax, eax
jne 0x100103c5
push str.shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x100103c3
push str.SHCopyKeyA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100103bc
push 0
push dword [0x1002c458]
push edi
push esi
call eax
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor ebx, ebx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.C:Program_FilesSpyhunter
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
push 0x10000
push str.Intenet_Download_Manager
je 0x100103f4
push str.Internet_Download_Manager_detected_that_its_registry_keys_had_been_damaged_since_the_last_run._Its_possible_that_you_run_a_flaky_spyware_remover_program_like_Spyhunter_which_corrupted_system_registry._Internet_Download_Manager_will_try_to_restore_all_damaged_data__but_some_data_may_remain_corrupted.
jmp 0x100103f9
push str.Internet_Download_Manager_detected_that_its_registry_keys_had_been_damaged_since_the_last_run._Its_possible_that_you_run_a_flaky_spyware_remover_program_which_corrupted_system_registry._Internet_Download_Manager_will_try_to_restore_all_damaged_data__but_some_data_may_remain_corrupted.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret