Function at 0x1005993
Capabilities:
Accept command line arguments
Check if file exists
Get file attributes
Hide graphical window
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x1009004]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [0x10095ac]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x210], edi
mov dword [0x10095a0], ecx
cmp eax, edi
je 0x10059d5
push eax
push 0xfffffffffffffff2
push ecx
call dword [sym.imp.USER32.dll_SetClassLongW]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
push 0x400
push dword [0x10095a0]
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x640000
push edi
push 0x401
mov ebx, 0x3f0
push ebx
push dword [0x10095a0]
call esi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
call edi
push 0x20
push 0x104
push 0x10095b4
call fcn.01005682
push 0x104
push 0x10099c4
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push 0
push 0
push 0x402
push ebx
push dword [0x10095a0]
call esi
push eax
call edi
lea eax, [ebp - 0x218]
push eax
push 0x20019
xor edi, edi
push edi
xor ebx, ebx
push 0x100149c
inc ebx
push 0x80000001
mov dword [0x1009be8], ebx
mov dword [0x1009be4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1005b34
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push 0x1001490
push dword [ebp - 0x218]
mov dword [ebp - 0x214], 4
call esi
test eax, eax
jne 0x1005acd
mov eax, dword [ebp - 0x228]
mov ecx, eax
and ecx, ebx
and eax, 2
mov dword [0x1009be8], ecx
mov dword [0x1009be4], eax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push 0x1001480
push dword [ebp - 0x218]
mov dword [ebp - 0x214], 0x208
call esi
test eax, eax
jne 0x1005b28
cmp dword [ebp - 0x21c], ebx
jne 0x1005b28
lea eax, [ebp - 0x20c]
push eax
push 0x104
push 0x10095b4
call fcn.0100170e
test eax, eax
jge 0x1005b28
xor eax, eax
mov word [0x10095b4], ax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x64
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01005682
push 0x10014f4
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010057e1
test eax, eax
jl 0x1005ca1
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call fcn.01002900
mov edi, eax
test edi, edi
je 0x1005ca1
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x20c]
push eax
call esi
lea edi, [edi + eax*2]
test edi, edi
je 0x1005ca1
cmp word [edi], 0
je 0x1005ca1
push edi
call esi
mov esi, eax
inc esi
lea eax, [esi + esi]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x220], eax
test eax, eax
je 0x1005ca1
push edi
push esi
push eax
call fcn.0100170e
test eax, eax
jl 0x1005c7c
mov edi, dword [ebp - 0x220]
mov ebx, dword [sym.imp.msvcrt.dll_iswctype]
jmp 0x1005bf8
movzx eax, word [edi]
push 8
push eax
call ebx
pop ecx
pop ecx
test eax, eax
je 0x1005bfe
inc edi
inc edi
cmp word [edi], 0
jne 0x1005be8
movzx eax, word [edi]
test ax, ax
je 0x1005c79
cmp ax, 0x22
jne 0x1005c2d
inc edi
inc edi
movzx eax, word [edi]
mov esi, edi
test ax, ax
je 0x1005c45
movzx eax, ax
cmp ax, 0x22
je 0x1005c45
inc esi
inc esi
movzx eax, word [esi]
test ax, ax
jne 0x1005c1b
jmp 0x1005c45
mov esi, edi
movzx eax, word [esi]
push 8
push eax
call ebx
pop ecx
pop ecx
test eax, eax
je 0x1005c45
inc esi
inc esi
cmp word [esi], 0
jne 0x1005c2f
xor eax, eax
push edi
mov word [esi], ax
push 0x104
mov esi, 0x10097bc
push esi
call fcn.0100170e
test eax, eax
jl 0x1005c6f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1005c6f
test al, 0x10
jne 0x1005c79
mov dword [ebp - 0x210], 0x10b
xor ebx, ebx
inc ebx
push dword [ebp - 0x220]
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x210], 0
je 0x1005ca1
push 0x6e
call fcn.010056fb
push 0x70
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01005682
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea eax, [ebp - 0x20c]
push eax
call esi
push eax
call fcn.01002900
test eax, eax
je 0x1005cd3
mov dword [0x1009bf8], ebx
push 0x63
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01005682
lea eax, [ebp - 0x20c]
push eax
call esi
push eax
call fcn.01002900
test eax, eax
je 0x1005d1d
push 0
push 0x3ee
push 0x111
push dword [ebp - 0x224]
mov dword [0x1009bec], ebx
mov dword [0x1009be8], ebx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [ebp - 0x210]
test eax, eax
jne 0x1005d2b
mov eax, ebx
jmp 0x1005d32
mov dword [0x1009bfc], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01007194
leave
ret 4