Function at 0x1005b65
Capabilities:
Query or enumerate registry value
Read .ini file
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x944
mov eax, dword [0x100e088]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push 0x101
push 0x40
mov dword [ebp - 0x940], edi
mov dword [ebp - 0x928], eax
mov dword [ebp - 0x930], esi
mov dword [ebp - 0x93c], esi
mov dword [ebp - 0x938], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, esi
mov dword [ebp - 0x92c], eax
jne 0x1005bc6
mov dword [ebp - 0x924], 8
jmp 0x1005eb2
push ebx
push 0x1001c10
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, esi
jne 0x1005be9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x924], eax
jmp 0x1005ea5
push 0x1001c00
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x1005bd8
push 0x100
push dword [ebp - 0x92c]
lea ecx, [ebp - 0x944]
push ecx
mov dword [ebp - 0x944], esi
call eax
cmp eax, esi
mov dword [ebp - 0x924], eax
jne 0x1005ea5
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x92c]
push 0x1001ba0
call fcn.010038d5
cmp word [edi], si
pop ecx
pop ecx
mov ebx, 0x1010368
jne 0x1005c54
push 0x1001b38
call fcn.010038d5
pop ecx
jmp 0x1005dec
mov eax, dword [ebp - 0x928]
mov dword [0x100f944], eax
lea eax, [ebp - 0x930]
push eax
push 0x1001b00
push 0x80000002
mov dword [0x100f93c], esi
mov dword [0x100f940], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, esi
mov dword [ebp - 0x924], eax
jne 0x1005ea5
xor eax, eax
mov ecx, 0x14d
lea edi, [ebp - 0x920]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x938]
push eax
lea eax, [ebp - 0x920]
push eax
lea eax, [ebp - 0x93c]
push eax
push esi
push 0x1001aec
push dword [ebp - 0x930]
mov dword [ebp - 0x93c], 3
mov dword [ebp - 0x938], 0x534
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x930]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x7d
pop ecx
push ebx
xor eax, eax
push 0x1f4
lea edi, [ebp - 0x3ec]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3ec]
push eax
push 0x100128c
push 0x1001ac4
push 0x10015f8
mov dword [ebp - 0x930], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, 0x7ffd
mov dword [ebp - 0x934], esi
push ebx
push esi
push dword [ebp - 0x928]
lea eax, [ebp - 0x920]
push dword [ebp - 0x940]
push eax
push dword [ebp - 0x92c]
call fcn.010038e3
add esp, 0x18
inc dword [ebp - 0x934]
cmp dword [ebp - 0x934], 3
mov ecx, eax
mov dword [ebp - 0x924], ecx
jge 0x1005d6d
push ecx
call fcn.0100550b
add esp, 4
test eax, eax
jne 0x1005d26
cmp ecx, edi
je 0x1005dec
cmp dword [0x100f94c], esi
je 0x1005dbd
cmp ecx, 0x258
jl 0x1005d89
cmp ecx, 0x325
jle 0x1005d93
mov dword [ebp - 0x924], 0x7ffc
push esi
push dword [ebp - 0x928]
lea eax, [ebp - 0x920]
push dword [ebp - 0x92c]
push dword [ebp - 0x924]
push eax
call fcn.0100498c
add esp, 0x14
cmp eax, edi
je 0x1005d20
lea eax, [ebp - 0x3ec]
push eax
push esi
push dword [ebp - 0x928]
call fcn.01004b37
add esp, 0xc
cmp eax, edi
mov dword [ebp - 0x924], eax
je 0x1005d20
cmp eax, 0x7fff
je 0x1005ea5
cmp dword [0x100f94c], esi
jne 0x1005df9
call fcn.0100546a
push dword [ebp - 0x92c]
push ebx
call fcn.01005968
cmp eax, 0x7e
pop ecx
pop ecx
je 0x1005e13
cmp eax, 0x485
jne 0x1005e1e
push 0x1001a48
call fcn.010038d5
pop ecx
cmp dword [0x100f710], esi
push esi
je 0x1005e54
push 0x10053b8
push esi
push 0x71
push dword [ebp - 0x928]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 0x3f4
je 0x1005ea0
cmp eax, 0x7e7
jne 0x1005ea5
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1005ea5
push 0x10052f4
push esi
push 0x6e
push dword [ebp - 0x928]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 0x3f4
je 0x1005ea0
cmp eax, 0x7e7
jne 0x1005ea5
push ebx
push 0xff
mov esi, 0x100f720
push esi
push 0x100128c
push 0x1001a24
push 0x10015f8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
call fcn.01005a3e
pop ecx
jmp 0x1005ea5
call fcn.0100546a
push dword [ebp - 0x92c]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x924]
pop edi
pop esi
call fcn.01006345
leave
ret