Function at 0x100559e
Capabilities:
Query or enumerate registry value

Disassembly:
lea eax, [ebp - 0x210]
mov dword [ebp - 0x7cc], eax
jmp 0x10055fa
cmp dword [ebp - 0x7cc], esi
je 0x10055bc
jmp 0x10055fa
and dword [ebx + 0xa0], 0
jmp 0x10056e2
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7e4
mov eax, dword [0x1038008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
and dword [ebp - 0x7cc], 0
and dword [ebp - 0x7d4], 0
mov dword [ebp - 0x7e0], eax
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
test dword [ebx + 0x24], 0x800
mov dword [ebp - 0x7d8], eax
mov eax, dword [0x1038048]
mov dword [ebx + 0xf0], eax
mov eax, dword [0x103803c]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebx + 0x18], eax
mov eax, dword [0x1038038]
mov dword [ebp - 0x7e4], edi
mov dword [ebx + 0x1c], eax
jne 0x1010071
push 0
lea eax, [ebp - 0x210]
push eax
push 0x20a
push 0
push dword [ebp - 0x7d8]
push dword [ebp - 0x7e0]
call dword [sym.imp.ntdll.dll_RtlDosSearchPath_U]
dec eax
cmp eax, 0x208
jbe 0x100543c
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x7cc], eax
test eax, eax
je 0x100564b
and dword [ebp - 0x7d0], 0
and dword [ebp - 0x7dc], 0
push 1
lea eax, [ebp - 0x7d0]
push eax
lea eax, [ebp - 0x7dc]
push eax
push dword [ebp - 0x7d4]
push dword [ebp - 0x7cc]
call dword [sym.imp.USER32.dll_PrivateExtractIconExW]
mov eax, dword [ebp - 0x7dc]
test eax, eax
je 0x100564b
mov ecx, dword [ebp - 0x7d0]
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], ecx
mov dword [0x10382bc], eax
mov dword [0x10382c0], ecx
push dword [ebx + 0xf0]
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x1010188
test dword [ebx + 0x24], 0x800
jne 0x100578f
push 0x31
pop ecx
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp - 0x7e4]
mov esi, 0x10380e0
lea edi, [ebp - 0x2d4]
rep movsd dword es:[edi], dword [esi]
call fcn.010057a5
mov eax, dword [ebx + 0x24]
test al, 0x10
jne 0x10056a0
mov cx, word [ebp - 0x266]
mov word [ebx + 0x28], cx
mov cx, word [ebp - 0x262]
mov word [ebx + 0x2a], cx
test al, 8
jne 0x10056b8
mov ecx, dword [ebp - 0x2d4]
mov dword [ebx + 0x30], ecx
test al, 2
jne 0x10056c5
mov ecx, dword [ebp - 0x2d0]
mov dword [ebx + 0x34], ecx
test al, 4
jne 0x100545e
mov ecx, dword [ebp - 0x2cc]
mov dword [ebx + 0x38], ecx
mov ecx, dword [ebp - 0x26c]
mov dword [ebx + 0xa0], ecx
test al, 0x20
jne 0x1010198
mov eax, dword [ebp - 0x278]
mov dword [ebx + 0x94], eax
mov eax, dword [ebp - 0x2c4]
mov esi, dword [sym.imp.msvcrt.dll_memmove]
mov dword [ebx + 0x48], eax
mov eax, dword [ebp - 0x2c0]
mov dword [ebx + 0x4c], eax
mov eax, dword [ebp - 0x2c8]
mov dword [ebx + 0x44], eax
push 0x40
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebx + 0x50]
push eax
call esi
mov eax, dword [ebp - 0x274]
mov dword [ebx + 0x98], eax
mov eax, dword [ebp - 0x270]
mov dword [ebx + 0x9c], eax
mov eax, dword [ebp - 0x27c]
mov dword [ebx + 0x90], eax
mov eax, dword [ebp - 0x260]
mov dword [ebx + 0xa4], eax
mov eax, dword [ebp - 0x25c]
mov dword [ebx + 0xa8], eax
mov eax, dword [ebp - 0x258]
mov dword [ebx + 0xac], eax
push 0x40
lea eax, [ebp - 0x254]
push eax
lea eax, [ebx + 0xb0]
push eax
call esi
mov eax, dword [ebp - 0x214]
add esp, 0x18
mov dword [ebx + 0xf0], eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010015a8
leave
ret 0x14
mov eax, dword fs:[0x18]
mov edx, dword [esi]
mov ecx, dword [0x1038030]
mov eax, dword [eax + 0x30]
lea edx, [edx + edx + 2]
push edx
add ecx, 0x100000
push ecx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [0x10382b4], eax
test eax, eax
je 0x10100ac
mov ecx, dword [esi]
inc ecx
push edi
inc ecx
push ecx
push eax
call fcn.010034fc
lea eax, [ebp - 0x7c8]
push eax
push edi
call fcn.0101b511
mov dword [ebp - 0x7d0], eax
test eax, eax
jne 0x10100cf
and dword [ebx + 0x24], 0xfffff7ff
jmp 0x10055bc
lea eax, [ebp - 0x7c8]
push eax
push dword [esi]
push edi
call fcn.010034fc
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10100e3
sub eax, edx
sar eax, 1
add eax, eax
mov dword [esi], eax
xor esi, esi
cmp word [ebp - 0x5c0], si
je 0x101011b
lea eax, [ebp - 0x5c0]
mov dword [ebp - 0x7cc], eax
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x7d4], eax
mov dword [ebx + 0x14], esi
cmp dword [ebp - 0x7d0], 1
mov eax, dword [ebp - 0x3b0]
mov dword [ebx + 0x20], eax
mov ax, word [ebp - 0x3b4]
mov word [ebx + 0x2c], ax
jne 0x1010144
and dword [ebx + 0x24], 0xfffff7ff
jmp 0x100544d
mov ax, word [ebp - 0x3a4]
mov word [ebx + 0x28], ax
mov ax, word [ebp - 0x3a2]
mov word [ebx + 0x2a], ax
push 0xc0
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebx + 0x30]
push eax
call dword [sym.imp.msvcrt.dll_memmove]
mov eax, dword [ebp - 0x2d8]
add esp, 0xc
and dword [ebx + 0x24], 0xfffffff5
mov dword [ebx + 0xf0], eax
jmp 0x100544d
mov eax, dword [0x1038048]
mov dword [ebx + 0xf0], eax
jmp 0x100565f
mov dword [ebx + 0x94], 1
jmp 0x10056f6