Function at 0x712940
Capabilities:
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x83e264]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x208
mov dword [ebp - 0x618], eax
lea eax, [ebp - 0x20c]
push 0
push eax
mov dword [ebp - 0x610], 0
call fcn.00520480
add esp, 0xc
lea eax, [ebp - 0x610]
push eax
push 0x20019
push 0
push 0x7496e8
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
jne 0x712a0a
lea eax, [ebp - 0x614]
mov dword [ebp - 0x614], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.Application_Path
push dword [ebp - 0x610]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x712a03
call esi
push eax
push str.CVerifyFileSignV2::WriteDigitalSignInvalidLog
push str._s___Failed_to_get_registry_key__REG_APP_PATH_KEY_NAME__Windows_error_code:__x
push 0x3cf
push str.C:_actions_runner_work_app_xbc_win_agent_app_xbc_win_agent_srcServerlibFileIOMultiPleSignCheck.cpp
push 0x49
call fcn.0050ff70
add esp, 0x18
jmp 0x712a8e
push str.Misc
jmp 0x712a85
lea eax, [ebp - 0x610]
push eax
push 0x20019
push 0
push str.SOFTWARETrendMicroOfficeScan_serviceInformation
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x712a9a
lea eax, [ebp - 0x614]
mov dword [ebp - 0x614], 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.Local_Path
push dword [ebp - 0x610]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x712a80
call esi
push eax
push str.CVerifyFileSignV2::WriteDigitalSignInvalidLog
push str._s___Failed_to_get_registry_key__REG_SERVICE_INFORMATION_SECTION__Windows_error_code:__x
push 0x3dd
push str.C:_actions_runner_work_app_xbc_win_agent_app_xbc_win_agent_srcServerlibFileIOMultiPleSignCheck.cpp
push 0x49
call fcn.0050ff70
add esp, 0x18
jmp 0x712a8e
push str.TEMP
lea eax, [ebp - 0x20c]
push eax
call edi
push dword [ebp - 0x610]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x712aa3
sub ecx, edx
sar ecx, 1
je 0x712ba4
push str.DSInvalidLogLastInfo.log
lea eax, [ebp - 0x20c]
push eax
call edi
push 0
push 0
push 4
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x712b7c
push 0x400
lea eax, [ebp - 0x60c]
push 0
push eax
call fcn.00520480
push dword [ebp + 0xc]
lea eax, [ebp - 0x60c]
push dword [ebp - 0x618]
push str._s_t_d
push 0x200
push eax
call fcn.004c08c0
lea ecx, [ebp - 0x60c]
mov dword [ebp - 0x618], 0
add esp, 0x20
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x712b35
sub ecx, edx
lea eax, [ebp - 0x618]
push 0
sar ecx, 1
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x60c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0051deb6
mov esp, ebp
pop ebp
ret 8
call esi
push eax
lea eax, [ebp - 0x20c]
push eax
push str.CVerifyFileSignV2::WriteDigitalSignInvalidLog
push str._s___Failed_to_open_file:__s__Windows_error_code:__x
push 0x3f7
push str.C:_actions_runner_work_app_xbc_win_agent_app_xbc_win_agent_srcServerlibFileIOMultiPleSignCheck.cpp
push 0x57
call fcn.0050ff70
add esp, 0x1c
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0051deb6
mov esp, ebp
pop ebp
ret 8