Function at 0x1013931
Capabilities:
Query or enumerate registry value
Read file on windows

Disassembly:
push 0x560
mov eax, 0x101c59a
call fcn.01019f0c
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x528]
mov dword [ebp - 0x550], edi
call sub.MFC42u.dll_CString::CString
and dword [ebp - 4], 0
lea ecx, [ebp - 0x544]
call sub.MFC42u.dll_CString::CString
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 1
call sub.MFC42u.dll_CString::CString
mov ecx, edi
mov byte [ebp - 4], 2
call sub.MFC42u.dll_CString::Empty
push esi
lea ecx, [ebp - 0x538]
call fcn.01019486
push dword [0x1024374]
lea ecx, [ebp - 0x52c]
call sub.MFC42u.dll_CString::CString_1
mov esi, eax
push 1
lea eax, [ebp - 0x530]
push eax
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 3
call sub.MFC42u.dll_CString::Right
push dword [esi]
mov ecx, eax
call fcn.01008914
test eax, eax
lea ecx, [ebp - 0x530]
setne bl
call fcn.010194aa
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 2
call fcn.010194aa
test bl, bl
je 0x1013a13
push dword [0x1024374]
lea ecx, [ebp - 0x52c]
call sub.MFC42u.dll_CString::CString_1
push eax
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 4
call sub.MFC42u.dll_CString::operator
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 2
call fcn.010194aa
push 0x66
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::LoadStringW
push 0x1007214
lea ecx, [ebp - 0x530]
call sub.MFC42u.dll_CString::CString_3
lea ecx, [ebp - 0x528]
push ecx
push eax
lea eax, [ebp - 0x52c]
push eax
mov byte [ebp - 4], 5
call sub.MFC42u.dll_operator
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 6
call fcn.01019486
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 5
call fcn.010194aa
lea ecx, [ebp - 0x530]
mov byte [ebp - 4], 2
call fcn.010194aa
push 0x4b5
lea ecx, [ebp - 0x544]
call sub.MFC42u.dll_CString::LoadStringW
lea eax, [ebp - 0x54c]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp - 0x544]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1013b07
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x530]
push eax
push esi
push dword [0x1024370]
mov dword [ebp - 0x52c], 0x104
push dword [ebp - 0x54c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1013afb
cmp dword [ebp - 0x530], 1
jne 0x1013afb
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x528]
call fcn.010197fe
push dword [ebp - 0x54c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x534]
call sub.MFC42u.dll_CString::CString
push 0xa
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 7
call sub.MFC42u.dll_CStringList::CStringList
mov byte [ebp - 4], 8
jmp 0x1013c5b
push 0x7c
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Find
cmp eax, 0xffffffff
jne 0x1013b52
lea eax, [ebp - 0x528]
push eax
lea ecx, [ebp - 0x534]
call fcn.01019486
jmp 0x1013b91
push 0x7c
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Find
push eax
lea eax, [ebp - 0x52c]
push eax
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Left
push eax
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 9
call fcn.01019486
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 8
call fcn.010194aa
lea ecx, [ebp - 0x56c]
call sub.MFC42u.dll_CStringList::RemoveAll
lea eax, [ebp - 0x56c]
push eax
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x534]
push eax
call fcn.01013175
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x530], eax
cmp eax, esi
jne 0x1013cbe
mov eax, dword [ebp - 0x528]
mov eax, dword [eax - 8]
mov ecx, dword [ebp - 0x534]
sub eax, dword [ecx - 8]
lea ecx, [ebp - 0x528]
push eax
lea eax, [ebp - 0x548]
push eax
call sub.MFC42u.dll_CString::Right
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xa
call fcn.01019486
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 8
call fcn.010194aa
push 0x7c
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Find
test eax, eax
jne 0x1013c5b
mov eax, dword [ebp - 0x528]
mov eax, dword [eax - 8]
dec eax
push eax
lea eax, [ebp - 0x540]
push eax
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Right
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xb
call fcn.01019486
lea ecx, [ebp - 0x540]
mov byte [ebp - 4], 8
call fcn.010194aa
mov eax, dword [ebp - 0x528]
cmp dword [eax - 8], esi
jne 0x1013b2c
push 0x1007208
lea ecx, [ebp - 0x528]
call fcn.0101947a
mov eax, dword [ebp - 0x528]
cmp dword [eax - 8], esi
je 0x1013cdb
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7c
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Find
cmp eax, 0xffffffff
jne 0x1013d30
lea eax, [ebp - 0x528]
push eax
lea ecx, [ebp - 0x534]
call fcn.01019486
jmp 0x1013d6f
lea eax, [ebp - 0x530]
push eax
lea ecx, [ebp - 0x56c]
call fcn.0100cbbf
push eax
mov ecx, edi
call fcn.01019486
xor esi, esi
inc esi
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 7
call fcn.0101985e
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 2
call fcn.010194aa
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 1
call fcn.010194aa
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 0
call fcn.010194aa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x528]
call fcn.010194aa
mov eax, esi
call fcn.01019f9e
ret 8
push 0x7c
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Find
push eax
lea eax, [ebp - 0x540]
push eax
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Left
push eax
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 0xc
call fcn.01019486
lea ecx, [ebp - 0x540]
mov byte [ebp - 4], 8
call fcn.010194aa
lea ecx, [ebp - 0x56c]
call sub.MFC42u.dll_CStringList::RemoveAll
lea eax, [ebp - 0x56c]
push eax
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x534]
push eax
call fcn.01013175
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x530], eax
test eax, eax
je 0x1013eeb
lea eax, [ebp - 0x530]
push eax
lea ecx, [ebp - 0x56c]
call fcn.0100cbbf
mov esi, dword [ebp - 0x550]
push eax
mov ecx, esi
call fcn.01019486
mov eax, dword [esi]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1013ede
push 0
lea eax, [ebp - 0x53c]
push eax
push 1
lea eax, [ebp - 0x420]
push eax
push esi
call ebx
test eax, eax
je 0x1013f8e
cmp word [ebp - 0x420], 0x3c
jne 0x1013e66
push 0
lea eax, [ebp - 0x53c]
push eax
push 0x12
lea eax, [ebp - 0x420]
push eax
push esi
call ebx
test eax, eax
je 0x1013f8e
lea eax, [ebp - 0x420]
push 0x10071f4
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1013f98
push 1
push 0
push 0xfffffffffffffff0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x53c], 0x12
je 0x1013e15
jmp 0x1013edb
push 0
lea eax, [ebp - 0x53c]
push eax
push 1
lea eax, [ebp - 0x218]
push eax
push esi
call ebx
test eax, eax
je 0x1013f8e
push 0
lea eax, [ebp - 0x53c]
push eax
push 0x12
lea eax, [ebp - 0x218]
push eax
push esi
call ebx
test eax, eax
je 0x1013f8e
xor eax, eax
mov word [ebp - 0x1f4], ax
lea eax, [ebp - 0x218]
push 0x10071f4
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1013f98
push 1
push 0
push 0xfffffffffffffff0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x53c], 0x12
je 0x1013e83
push esi
call edi
cmp dword [ebp - 0x530], 0
jne 0x1013da8
mov eax, dword [ebp - 0x528]
mov eax, dword [eax - 8]
mov ecx, dword [ebp - 0x534]
sub eax, dword [ecx - 8]
lea ecx, [ebp - 0x528]
push eax
lea eax, [ebp - 0x548]
push eax
call sub.MFC42u.dll_CString::Right
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xd
call fcn.01019486
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 8
call fcn.010194aa
push 0x7c
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Find
test eax, eax
jne 0x1013f7c
mov eax, dword [ebp - 0x528]
mov eax, dword [eax - 8]
dec eax
push eax
lea eax, [ebp - 0x52c]
push eax
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Right
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xe
call fcn.01019486
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 8
call fcn.010194aa
mov eax, dword [ebp - 0x528]
cmp dword [eax - 8], 0
jne 0x1013c91
jmp 0x1013f91
push esi
call edi
xor esi, esi
jmp 0x1013cdb
push esi
call edi
jmp 0x1013cd8