Function at 0x1005e453
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
mov eax, 0x100dbb44
call fcn.100ac440
sub esp, 0x224
mov eax, dword [0x1011c710]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor eax, ebp
xor ebx, ebx
push str.DisplayIcon
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x220], ebx
call fcn.1000223a
push 0x41
pop ecx
xor eax, eax
mov byte [ebp - 0x118], bl
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x224]
push ecx
inc eax
push eax
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallPPStream
mov edi, 0x104
push 0x80000002
mov dword [ebp - 4], ebx
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x224], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
jne 0x1005e581
cmp dword [ebp - 0x224], 0
je 0x1005e575
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x230]
push eax
push 0
push dword [ebp - 0x228]
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1005e575
lea eax, [ebp - 0x118]
push eax
call fcn.100ab7d0
test eax, eax
pop ecx
jbe 0x1005e575
lea eax, [ebp - 0x118]
push 0x5c
push eax
call fcn.100ac7cd
mov byte [eax + 1], 0
lea eax, [ebp - 0x118]
push eax
push str._sppsap.exe
push esi
call fcn.10001d75
add esp, 0x14
push dword [esi]
call ebx
test eax, eax
je 0x1005e575
push dword [ebp - 0x224]
mov dword [ebp - 0x220], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1005e6cd
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x105
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.100ab720
add esp, 0xc
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x118]
push eax
push 0
call edi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
push str.ppstream.exe
push eax
call fcn.100ac4d5
pop ecx
test eax, eax
pop ecx
lea eax, [ebp - 0x118]
je 0x1005e5f3
push 0x5c
push eax
call fcn.100ac7cd
mov byte [eax + 1], 0
lea eax, [ebp - 0x118]
push eax
push str._sppsap.exe
push esi
call fcn.10001d75
add esp, 0x14
jmp 0x1005e6bb
push 0x105
push 0
push eax
call fcn.100ab720
add esp, 0xc
push 0x104
lea eax, [ebp - 0x118]
push eax
push 0x100e7c8c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
lea eax, [ebp - 0x118]
push 0x5c
push eax
call fcn.100ac7cd
mov byte [eax + 1], 0
lea eax, [ebp - 0x118]
push eax
push str._sppsap.exe
push esi
call fcn.10001d75
add esp, 0x14
push dword [esi]
call ebx
test eax, eax
jne 0x1005e6c3
push 0x40
mov byte [ebp - 0x21c], al
pop ecx
lea edi, [ebp - 0x21b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x104
stosb byte es:[edi], al
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.100ab720
lea eax, [ebp - 0x118]
push eax
call fcn.100ab7d0
dec eax
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.100ab860
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call fcn.100ac7cd
mov byte [eax + 1], 0
lea eax, [ebp - 0x21c]
push eax
push str._sppsap.exe
push esi
call fcn.10001d75
add esp, 0x30
push dword [esi]
call ebx
test eax, eax
je 0x1005e6cd
mov dword [ebp - 0x220], 1
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x220]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.100ac33f
leave
ret 4