Function at 0x1006005
Capabilities:
Query or enumerate registry value
Read .ini file
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x944
mov eax, dword [0x100e058]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push 0x101
push 0x40
mov dword [ebp - 0x940], edi
mov dword [ebp - 0x928], eax
mov dword [ebp - 0x930], esi
mov dword [ebp - 0x93c], esi
mov dword [ebp - 0x938], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp eax, esi
mov dword [ebp - 0x92c], eax
jne 0x1006066
mov dword [ebp - 0x924], 8
jmp 0x1006352
push ebx
push 0x1001c50
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, esi
jne 0x1006089
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x924], eax
jmp 0x1006345
push 0x1001c40
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x1006078
push 0x100
push dword [ebp - 0x92c]
lea ecx, [ebp - 0x944]
push ecx
mov dword [ebp - 0x944], esi
call eax
cmp eax, esi
mov dword [ebp - 0x924], eax
jne 0x1006345
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push dword [ebp - 0x92c]
push 0x1001be0
call fcn.01003d75
cmp word [edi], si
pop ecx
pop ecx
mov ebx, 0x1010328
jne 0x10060f4
push 0x1001b78
call fcn.01003d75
pop ecx
jmp 0x100628c
mov eax, dword [ebp - 0x928]
mov dword [0x100f904], eax
lea eax, [ebp - 0x930]
push eax
push 0x1001b40
push 0x80000002
mov dword [0x100f8fc], esi
mov dword [0x100f900], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, esi
mov dword [ebp - 0x924], eax
jne 0x1006345
xor eax, eax
mov ecx, 0x14d
lea edi, [ebp - 0x920]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x938]
push eax
lea eax, [ebp - 0x920]
push eax
lea eax, [ebp - 0x93c]
push eax
push esi
push 0x1001b2c
push dword [ebp - 0x930]
mov dword [ebp - 0x93c], 3
mov dword [ebp - 0x938], 0x534
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x930]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x7d
pop ecx
push ebx
xor eax, eax
push 0x1f4
lea edi, [ebp - 0x3ec]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x3ec]
push eax
push 0x10012cc
push 0x1001b04
push 0x1001638
mov dword [ebp - 0x930], esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, 0x7ffd
mov dword [ebp - 0x934], esi
push ebx
push esi
push dword [ebp - 0x928]
lea eax, [ebp - 0x920]
push dword [ebp - 0x940]
push eax
push dword [ebp - 0x92c]
call fcn.01003d83
add esp, 0x18
inc dword [ebp - 0x934]
cmp dword [ebp - 0x934], 3
mov ecx, eax
mov dword [ebp - 0x924], ecx
jge 0x100620d
push ecx
call fcn.010059ab
add esp, 4
test eax, eax
jne 0x10061c6
cmp ecx, edi
je 0x100628c
cmp dword [0x100f90c], esi
je 0x100625d
cmp ecx, 0x258
jl 0x1006229
cmp ecx, 0x325
jle 0x1006233
mov dword [ebp - 0x924], 0x7ffc
push esi
push dword [ebp - 0x928]
lea eax, [ebp - 0x920]
push dword [ebp - 0x92c]
push dword [ebp - 0x924]
push eax
call fcn.01004e2c
add esp, 0x14
cmp eax, edi
je 0x10061c0
lea eax, [ebp - 0x3ec]
push eax
push esi
push dword [ebp - 0x928]
call fcn.01004fd7
add esp, 0xc
cmp eax, edi
mov dword [ebp - 0x924], eax
je 0x10061c0
cmp eax, 0x7fff
je 0x1006345
cmp dword [0x100f90c], esi
jne 0x1006299
call fcn.0100590a
push dword [ebp - 0x92c]
push ebx
call fcn.01005e08
cmp eax, 0x7e
pop ecx
pop ecx
je 0x10062b3
cmp eax, 0x485
jne 0x10062be
push 0x1001a88
call fcn.01003d75
pop ecx
cmp dword [0x100f6d0], esi
push esi
je 0x10062f4
push 0x1005858
push esi
push 0x71
push dword [ebp - 0x928]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 0x3f4
je 0x1006340
cmp eax, 0x7e7
jne 0x1006345
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x1006345
push 0x1005794
push esi
push 0x6e
push dword [ebp - 0x928]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp eax, 0x3f4
je 0x1006340
cmp eax, 0x7e7
jne 0x1006345
push ebx
push 0xff
mov esi, 0x100f6e0
push esi
push 0x10012cc
push 0x1001a64
push 0x1001638
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
call fcn.01005ede
pop ecx
jmp 0x1006345
call fcn.0100590a
push dword [ebp - 0x92c]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x924]
pop edi
pop esi
call fcn.010067e5
leave
ret