Function at 0x10005cea
Capabilities:
Enumerate files on windows
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x27e4]
mov eax, 0x27e4
call fcn.1003b5f0
push 0xffffffffffffffff
push 0x1004ff34
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x10068510]
xor eax, ebp
mov dword [ebp + 0x27e0], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov byte [ecx + 0x1a0], 1
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0xd], bl
cmp dword [0x1006a458], ebx
je 0x10005e89
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0x14], ebx
xor esi, esi
inc esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x14]
push eax
push 0x10056838
push 4
push ebx
push 0x10056858
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jne 0x10005e6e
cmp dword [ebp - 0x14], ebx
je 0x10005e6e
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
lea edx, [ebp - 0x50]
push edx
push eax
call dword [ecx + 0x44]
cmp eax, ebx
jne 0x10005e6e
mov eax, 0x2008
cmp word [ebp - 0x50], ax
jne 0x10005e6e
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0x24]
push ecx
push esi
push eax
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x20], eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
lea eax, [ebp - 0x2c]
push eax
push esi
push dword [ebp - 0x20]
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
jmp 0x10005e5c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayPutElement]
cmp dword [ebp - 0x1c], ebx
je 0x10005e56
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push ebx
push 0xfde9
call esi
mov edi, eax
cmp edi, ebx
jle 0x10005e4d
lea eax, [edi + 1]
push eax
call fcn.10037b36
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x10005e4d
push ebx
push ebx
push edi
push eax
push 0xffffffffffffffff
push dword [ebp - 0x1c]
push ebx
push 0xfde9
call esi
test eax, eax
je 0x10005e44
push dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
call fcn.10005af0
push dword [ebp - 0x28]
call fcn.10037990
pop ecx
push dword [ebp - 0x1c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x24]
jle 0x10005dd7
push dword [ebp - 0x20]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
call dword [sym.imp.ole32.dll_CoUninitialize]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.1001e586
cmp byte [ebp - 0xd], bl
jne 0x100061b8
cmp dword [0x10069bc4], ebx
jne 0x10005ea2
call fcn.1001ded4
cmp dword [0x10069bc4], ebx
je 0x100061b8
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x40]
push eax
push ebx
push ebx
push str.LanguageID
push dword [0x10069bc4]
mov dword [ebp - 0x38], 4
call esi
test eax, eax
jne 0x100061b8
movzx eax, word [ebp - 0x40]
push 9
mov dword [ebp - 0x24], eax
pop eax
cmp ax, word [ebp - 0x40]
je 0x100061b8
lea eax, [ebp + 0x140]
push eax
mov dword [ebp + 0x140], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp + 0x25dc]
push eax
push ebx
push ebx
push 0x10055cd4
push dword [0x10069bc4]
mov dword [ebp - 0x38], 0x104
call esi
test eax, eax
jne 0x100061b8
lea eax, [ebp + 0x22d4]
push eax
lea eax, [ebp + 0x21d4]
push eax
lea eax, [ebp + 0x26e0]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 0x25dc]
push eax
call fcn.1003b5a1
lea eax, [ebp + 0x26e0]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 0x23d4]
push str._s_sLanguagesidm_.lng
push eax
call fcn.1003b332
add esp, 0x24
lea eax, [ebp]
push eax
lea eax, [ebp + 0x23d4]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x100061b8
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x26e0]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 0x24d8]
push str._s_sLanguages_s
push eax
call fcn.1003b332
lea eax, [ebp + 0x24d8]
push 0x10055ca4
push eax
call fcn.1003b31b
add esp, 0x1c
mov dword [ebp - 0x18], eax
cmp eax, ebx
je 0x1000619a
push eax
lea eax, [ebp + 0x1d4]
push 0x2000
push eax
call fcn.1003b10f
add esp, 0xc
test eax, eax
je 0x10006191
xor esi, esi
cmp byte [ebp + 0x1d4], 0xef
mov dword [ebp - 0x20], ebx
jne 0x10006009
cmp byte [ebp + 0x1d5], 0xbb
jne 0x10006009
cmp byte [ebp + 0x1d6], 0xbf
jne 0x10006009
push 3
pop esi
mov dword [ebp - 0x20], 1
push 4
lea eax, [ebp + esi + 0x1d4]
push str.lang
push eax
call fcn.1003958c
add esp, 0xc
test eax, eax
jne 0x10006191
lea eax, [ebp + esi + 0x1d8]
push 0x3d
push eax
call fcn.100379b0
pop ecx
pop ecx
cmp eax, ebx
je 0x10006191
lea ecx, [ebp - 0x34]
push ecx
inc eax
push 0x10055c98
push eax
call fcn.1003affa
add esp, 0xc
cmp eax, 1
jne 0x10006191
movzx edx, word [ebp - 0x24]
cmp edx, dword [ebp - 0x34]
jne 0x10006191
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x20], ebx
jne 0x100060af
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x5c]
mov dword [ebp - 0x60], ebx
rep stosd dword es:[edi], eax
mov eax, 0x400
cmp word [ebp - 0x24], ax
ja 0x1000608c
add edx, eax
push 0x1000
lea eax, [ebp - 0x60]
push eax
push edx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
test eax, eax
je 0x10006172
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x14], eax
jmp 0x10006172
mov dword [ebp - 0x14], 0xfde9
jmp 0x10006172
lea eax, [ebp + 0x1d4]
cmp dword [ebp - 0x20], ebx
jne 0x10006169
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push ebx
push ebx
push 0xffffffffffffffff
push eax
push ebx
push dword [ebp - 0x14]
call edi
mov dword [ebp - 0x2c], eax
cmp eax, ebx
je 0x10006172
push eax
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
cmp esi, ebx
je 0x10006172
push dword [ebp - 0x2c]
lea eax, [ebp + 0x1d4]
push esi
push 0xffffffffffffffff
push eax
push ebx
push dword [ebp - 0x14]
call edi
test eax, eax
je 0x10006160
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
cmp edi, ebx
jle 0x10006160
lea eax, [edi + 1]
push eax
call fcn.10037b36
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, ebx
je 0x10006160
push ebx
push ebx
push edi
push eax
push 0xffffffffffffffff
push esi
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x10006157
push dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
call fcn.10005af0
push dword [ebp - 0x28]
call fcn.10037990
pop ecx
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x10006172
mov ecx, dword [ebp - 0x30]
push eax
call fcn.10005af0
push dword [ebp - 0x18]
lea eax, [ebp + 0x1d4]
push 0x2000
push eax
call fcn.1003b10f
add esp, 0xc
test eax, eax
jne 0x100060bb
push dword [ebp - 0x18]
call fcn.1003b093
pop ecx
lea eax, [ebp]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10005f83
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x27e0]
xor ecx, ebp
call fcn.10037f27
add ebp, 0x27e4
leave
ret