Function at 0x23414
Capabilities:
Get file size
Query or enumerate registry value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
call fcn.00014684
xor eax, eax
push ebp
push 0x23965
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x2d], 0
mov eax, 0x6f710
call fcn.00014084
mov byte [ebp - 0x35], 0
mov byte [ebp - 0x36], 0
mov byte [ebp - 0x3d], 0
mov byte [ebp - 0x45], 0
xor edx, edx
push ebp
push 0x2391e
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x2c]
call fcn.000142c4
test eax, eax
jne 0x23639
mov eax, 7
call fcn.00022f80
cmp dword [0x6f700], 0
je 0x2357e
mov byte [ebp - 0x2d], 1
mov byte [0x6f6fc], 1
mov edx, 0x72818
mov eax, dword [0x6f700]
mov ecx, 0x138
call fcn.000127f8
lea eax, [ebp - 0x35]
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, 0x23980
mov edx, 0x23998
mov eax, 0x239ac
call fcn.00022bf8
mov edx, dword [ebp - 0x4c]
mov eax, 0x6f6e4
call fcn.00013aa8
lea eax, [ebp - 0x36]
push eax
lea eax, [ebp - 0x50]
push eax
mov ecx, 0x239b8
mov edx, 0x239d0
mov eax, 0x239ac
call fcn.00022bf8
mov edx, dword [ebp - 0x50]
mov eax, 0x6f708
call fcn.00013aa8
lea eax, [ebp - 0x3d]
push eax
lea eax, [ebp - 0x54]
push eax
mov ecx, 0x239e4
mov edx, 0x239f0
mov eax, 0x239ac
call fcn.00022bf8
mov edx, dword [ebp - 0x54]
mov eax, 0x6f6ec
call fcn.00013aa8
lea eax, [ebp - 0x45]
push eax
lea eax, [ebp - 0x58]
push eax
mov ecx, 0x23a04
mov edx, 0x23a28
mov eax, 0x239ac
call fcn.00022bf8
mov edx, dword [ebp - 0x58]
mov eax, 0x6f70c
call fcn.00013aa8
mov al, byte [ebp - 0x35]
and al, byte [ebp - 0x36]
je 0x2357e
cmp byte [ebp - 0x3d], 0
je 0x2357e
cmp byte [ebp - 0x45], 0
cmp dword [0x6f700], 0
je 0x235a3
cmp byte [ebp - 0x35], 0
je 0x235a3
cmp byte [ebp - 0x36], 0
je 0x235a3
cmp byte [ebp - 0x3d], 0
je 0x235a3
cmp byte [ebp - 0x45], 0
jne 0x23646
xor eax, eax
mov dword [ebp - 0x34], eax
mov eax, 0x400
call fcn.000126e0
mov ebx, eax
mov edx, 0x400
mov eax, ebx
call fcn.000175a4
lea eax, [ebp - 0x34]
push eax
mov eax, dword [0x70348]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
push 0x23a34
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x2361c
mov dword [ebp - 0x44], 0x3ff
lea eax, [ebp - 0x44]
push eax
push ebx
lea eax, [ebp - 0x3c]
push eax
push 0
push 0x23a74
mov eax, dword [ebp - 0x34]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x2361c
cmp dword [ebp - 0x3c], 1
jne 0x2361c
mov eax, 0x6f710
mov edx, ebx
call fcn.000141dc
mov eax, ebx
call fcn.000126f8
cmp dword [ebp - 0x34], 0
je 0x23632
mov eax, dword [ebp - 0x34]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x23646
mov eax, 0x6f710
mov edx, dword [ebp - 0x2c]
call fcn.000140c0
xor eax, eax
mov dword [ebp - 0x34], eax
mov eax, 0x400
call fcn.000126e0
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
mov eax, dword [0x70348]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
push 0x23a34
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x2371b
mov edx, 0x400
mov eax, ebx
call fcn.000175a4
mov dword [ebp - 0x44], 0x3ff
lea eax, [ebp - 0x44]
push eax
push ebx
lea eax, [ebp - 0x3c]
push eax
push 0
push 0x23a90
mov eax, dword [ebp - 0x34]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x236ce
cmp dword [ebp - 0x3c], 1
jne 0x236ce
lea eax, [ebp - 0x5c]
mov edx, ebx
call fcn.000141dc
mov edx, dword [ebp - 0x5c]
mov eax, 0x6f6f4
call fcn.00013c9c
mov edx, 0x400
mov eax, ebx
call fcn.000175a4
mov dword [ebp - 0x44], 0x3ff
lea eax, [ebp - 0x44]
push eax
push ebx
lea eax, [ebp - 0x3c]
push eax
push 0
push 0x23aa8
mov eax, dword [ebp - 0x34]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x2371b
cmp dword [ebp - 0x3c], 1
jne 0x2371b
lea eax, [ebp - 0x60]
mov edx, ebx
call fcn.000141dc
mov edx, dword [ebp - 0x60]
mov eax, 0x6f704
call fcn.00013c9c
mov eax, ebx
call fcn.000126f8
cmp dword [ebp - 0x34], 0
je 0x23731
mov eax, dword [ebp - 0x34]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x34], eax
cmp dword [0x6f700], 0
je 0x2375b
cmp byte [ebp - 0x35], 0
je 0x2375b
cmp byte [ebp - 0x36], 0
je 0x2375b
cmp byte [ebp - 0x3d], 0
je 0x2375b
cmp byte [ebp - 0x45], 0
jne 0x23914
mov eax, dword [0x6f710]
call fcn.000142c4
test eax, eax
jle 0x23914
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [0x6f710]
call fcn.000142b4
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
je 0x23914
push 0
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_GetFileSize_1
sub eax, 0x138
mov dword [0x6f714], eax
xor eax, eax
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 4]
push eax
push 0x138
push 0x72818
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_ReadFile_1
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 4], 0x138
jne 0x2390b
mov eax, dword [0x72940]
cmp eax, 7
jne 0x2390b
call fcn.00022d40
cmp dword [0x6f700], 0
jne 0x23819
mov eax, dword [0x72944]
add eax, 0x1079bc
add eax, 0x400
call fcn.000126e0
mov dword [0x6f700], eax
cmp dword [0x6f700], 0
je 0x2390b
push ebp
call fcn.000232d8
pop ecx
test al, al
je 0x2390b
mov byte [ebp - 0x2d], 1
mov byte [0x6f6f0], 1
mov edx, dword [0x6f700]
mov eax, 0x72818
mov ecx, 0x138
call fcn.000127f8
lea eax, [ebp - 0x35]
push eax
lea eax, [ebp - 0x64]
push eax
mov ecx, 0x23980
mov edx, 0x23998
mov eax, 0x239ac
call fcn.00022bf8
mov edx, dword [ebp - 0x64]
mov eax, 0x6f6e4
call fcn.00013aa8
lea eax, [ebp - 0x36]
push eax
lea eax, [ebp - 0x68]
push eax
mov ecx, 0x239b8
mov edx, 0x239d0
mov eax, 0x239ac
call fcn.00022bf8
mov edx, dword [ebp - 0x68]
mov eax, 0x6f708
call fcn.00013aa8
lea eax, [ebp - 0x3d]
push eax
lea eax, [ebp - 0x6c]
push eax
mov ecx, 0x239e4
mov edx, 0x239f0
mov eax, 0x239ac
call fcn.00022bf8
mov edx, dword [ebp - 0x6c]
mov eax, 0x6f6ec
call fcn.00013aa8
lea eax, [ebp - 0x45]
push eax
lea eax, [ebp - 0x70]
push eax
mov ecx, 0x23a04
mov edx, 0x23a28
mov eax, 0x239ac
call fcn.00022bf8
mov edx, dword [ebp - 0x70]
mov eax, 0x6f70c
call fcn.00013aa8
mov al, byte [ebp - 0x35]
and al, byte [ebp - 0x36]
je 0x2390b
cmp byte [ebp - 0x3d], 0
je 0x2390b
cmp byte [ebp - 0x45], 0
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x23928
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x2396c
lea eax, [ebp - 0x70]
mov edx, 4
call fcn.00013a78
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.0001409c
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00013a78
lea eax, [ebp - 0x2c]
call fcn.00014084
ret