Function at 0x10006480
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x630
mov eax, dword [0x1000e004]
xor eax, esp
mov dword [esp + 0x62c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x63c]
lea ebx, [esp + 0x14]
push esi
push edi
mov dword [esp + 0x10], 0x105
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
movzx eax, ax
mov ecx, 0x411
cmp ax, cx
jne 0x100064c5
mov eax, str.EUDC932
jmp 0x10006529
mov ecx, 0x804
cmp ax, cx
je 0x10006524
mov ecx, 0x1004
cmp ax, cx
je 0x10006524
mov ecx, 0xc04
cmp ax, cx
je 0x1000651d
mov ecx, 0x404
cmp ax, cx
je 0x1000651d
mov ecx, 0x1404
cmp ax, cx
je 0x1000651d
mov ecx, 0x412
cmp ax, cx
jne 0x10006508
mov eax, str.EUDC949
jmp 0x10006529
mov ecx, 0x409
cmp ax, cx
jne 0x10006777
mov eax, str.EUDC1252
jmp 0x10006529
mov eax, str.EUDC950
jmp 0x10006529
mov eax, str.EUDC936
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
push eax
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10006777
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.SystemDefaultEUDCFont
push dword [esp + 0x28]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
shr eax, 1
mov dword [esp + 0x10], eax
test esi, esi
jne 0x10006777
cmp dword [esp + 0x18], 1
jne 0x10006777
cmp eax, 0x104
ja 0x10006777
xor ecx, ecx
mov word [esp + eax*2 + 0x1c], cx
lea eax, [esp + 0x1c]
push str._SystemRoot_
push eax
call sub.VCRUNTIME140.dll_wcsstr
lea ecx, [esp + 0x24]
add esp, 8
cmp eax, ecx
jne 0x1000668c
push str.SystemRoot
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10006777
mov edx, ecx
lea esi, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x100065e0
mov eax, dword [esp + 0x10]
sub edx, esi
sar edx, 1
add eax, 0xfffffff4
add eax, edx
cmp eax, 0x104
ja 0x10006777
lea edx, [esp + 0x228]
sub edx, ecx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x10006610
lea edx, [esp + 0x34]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10006626
lea edi, [esp + 0x228]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10006640
mov ecx, edx
lea ebx, [esp + 0x228]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006666
mov eax, dword [ebp]
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov dword [esp + 0x18], ecx
mov eax, dword [eax + 0x28c]
push ebp
call eax
jmp 0x10006779
mov ecx, str.EUDC.TTE
lea eax, [esp + 0x1c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100066bb
test dx, dx
je 0x100066b7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100066bb
add eax, 4
add ecx, 4
test dx, dx
jne 0x10006695
xor eax, eax
jmp 0x100066c0
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10006763
push 0x104
lea eax, [esp + 0x438]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10006777
add eax, 0x10
cmp eax, 0x104
ja 0x10006777
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
movzx eax, word [esp + ecx + 0x434]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x1a], ax
test ax, ax
jne 0x10006700
lea edi, [esp + 0x1c]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10006720
mov ecx, 8
mov esi, str.FONTSEUDC.TTE
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x1c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006740
mov eax, dword [ebp]
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov dword [esp + 0x18], ecx
mov eax, dword [eax + 0x28c]
push ebp
call eax
jmp 0x10006779
mov ecx, dword [esp + 0x10]
mov eax, dword [ebp]
push ecx
push ebx
push ebp
mov eax, dword [eax + 0x28c]
call eax
jmp 0x10006779
xor eax, eax
mov ecx, dword [esp + 0x63c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100072d8
add esp, 0x630
ret 8