Function at 0x10005ab0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x314
push ebx
push esi
push edi
mov edi, dword [esp + 0x32c]
mov al, byte [edi]
cmp al, 0x20
je 0x10005ad6
cmp al, 9
je 0x10005ad6
cmp al, 0xa
je 0x10005ad6
cmp al, 0xd
je 0x10005ad6
cmp al, 0x22
jne 0x10005ad9
inc edi
jmp 0x10005ac0
lea esi, [esp + 0x118]
cmp byte [edi], 0
je 0x10005b1a
mov ebx, dword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
mov al, byte [edi]
cmp al, 0x20
je 0x10005b1a
cmp al, 9
je 0x10005b1a
cmp al, 0xa
je 0x10005b1a
cmp al, 0xd
je 0x10005b1a
cmp al, 0x22
je 0x10005b1a
mov byte [esi], al
mov al, byte [edi]
push eax
call ebx
test eax, eax
je 0x10005b13
mov al, byte [edi + 1]
inc esi
inc edi
mov byte [esi], al
inc esi
inc edi
cmp byte [edi], 0
jne 0x10005aeb
lea eax, [esp + 0xc]
lea ecx, [esp + 0x118]
push eax
mov byte [esi], 0
push 0x20019
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x10005cac
lea eax, [esp + 0x10]
lea ecx, [esp + 0x21c]
mov edx, dword [esp + 0xc]
push eax
mov dword [esp + 0x14], 0x104
push ecx
push 0
push 0
push str.devicedesc
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10005cac
mov al, byte [edi]
cmp al, 0x20
je 0x10005b9a
cmp al, 9
je 0x10005b9a
cmp al, 0xa
je 0x10005b9a
cmp al, 0xd
je 0x10005b9a
cmp al, 0x22
jne 0x10005b9d
inc edi
jmp 0x10005b84
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x14]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [esp + 0x14], 0
lea eax, [esp + 0x14]
je 0x10005bd7
mov esi, dword [sym.imp.USER32.dll_CharNextA]
push eax
call esi
cmp byte [eax], 0
jne 0x10005bcf
push eax
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
mov al, byte [eax]
cmp al, 0x2f
je 0x10005c1f
cmp al, 0x5c
je 0x10005c1f
mov edi, 0x1000a0a4
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.setup.exe
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [esp + 0x14]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x1c]
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x10005cac
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [esp + 0x21c]
lea ecx, [esp + 0x118]
push eax
push str._I__P
push str._s__s_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x128]
lea eax, [esp + 0x24]
add esp, 0x10
push ecx
push eax
call fcn.10001bc0
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x314
ret 0x10