Function at 0x247e4
Capabilities:
Get file size
Query or enumerate registry value
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x5c], edx
mov dword [ebp - 0x58], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x2c], eax
xor eax, eax
push ebp
push 0x24ded
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x2d], 0
mov eax, 0x16a884
call fcn.000143f0
mov byte [ebp - 0x3f], 0
mov byte [ebp - 0x3d], 0
mov byte [ebp - 0x35], 0
mov byte [ebp - 0x3e], 0
xor edx, edx
push ebp
push 0x24da9
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x2c]
call fcn.00014630
test eax, eax
jne 0x24a44
mov eax, 7
call fcn.00024424
cmp dword [0x16a878], 0
je 0x24946
mov byte [ebp - 0x2d], 1
mov byte [0x16a864], 1
mov edx, 0x253818
mov eax, dword [0x16a878]
mov ecx, 0x138
call fcn.0001291c
lea eax, [ebp - 0x3f]
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, 0x24e08
mov edx, 0x24e20
mov eax, 0x24e34
call fcn.00023d30
mov edx, dword [ebp - 0x4c]
mov eax, 0x16a874
call fcn.00013d6c
lea eax, [ebp - 0x3d]
push eax
lea eax, [ebp - 0x50]
push eax
mov ecx, 0x24e40
mov edx, 0x24e58
mov eax, 0x24e34
call fcn.00023d30
mov edx, dword [ebp - 0x50]
mov eax, 0x16a870
call fcn.00013d6c
lea eax, [ebp - 0x35]
push eax
lea eax, [ebp - 0x54]
push eax
mov ecx, 0x24e6c
mov edx, 0x24e78
mov eax, 0x24e34
call fcn.00023d30
mov edx, dword [ebp - 0x54]
mov eax, 0x16a868
call fcn.00013d6c
lea eax, [ebp - 0x3e]
push eax
lea eax, [ebp - 0x58]
push eax
mov ecx, 0x24e8c
mov edx, 0x24eb0
mov eax, 0x24e34
call fcn.00023d30
mov edx, dword [ebp - 0x58]
mov eax, 0x16a87c
call fcn.00013d6c
mov al, byte [ebp - 0x3f]
and al, byte [ebp - 0x3d]
je 0x24946
cmp byte [ebp - 0x35], 0
je 0x24946
cmp byte [ebp - 0x3e], 0
cmp dword [0x16a878], 0
je 0x2496b
cmp byte [ebp - 0x3f], 0
je 0x2496b
cmp byte [ebp - 0x3d], 0
je 0x2496b
cmp byte [ebp - 0x35], 0
je 0x2496b
cmp byte [ebp - 0x3e], 0
jne 0x24a51
xor eax, eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x44]
mov edx, 0x400
call fcn.000271f0
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
push 0x24ebc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x249e1
cmp dword [ebp - 0x3c], 0
je 0x249b7
mov eax, dword [ebp - 0x3c]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
push 0x24ed0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x24a21
mov dword [ebp - 0x34], 0x3ff
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0x24f10
mov eax, dword [ebp - 0x3c]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x24a21
cmp dword [ebp - 0x48], 1
jne 0x24a21
mov eax, 0x16a884
mov edx, dword [ebp - 0x44]
call fcn.00014548
lea eax, [ebp - 0x44]
mov edx, 0x400
call fcn.00027218
cmp dword [ebp - 0x3c], 0
je 0x24a3d
mov eax, dword [ebp - 0x3c]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x3c], eax
jmp 0x24a51
mov eax, 0x16a884
mov edx, dword [ebp - 0x2c]
call fcn.0001442c
xor eax, eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x44]
mov edx, 0x400
call fcn.000271f0
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
push 0x24ebc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x24ac7
cmp dword [ebp - 0x3c], 0
je 0x24a9d
mov eax, dword [ebp - 0x3c]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
push 0x24ed0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x24b75
mov edx, 0x400
mov eax, dword [ebp - 0x44]
call fcn.00018100
mov dword [ebp - 0x34], 0x3ff
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0x24f2c
mov eax, dword [ebp - 0x3c]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x24b23
cmp dword [ebp - 0x48], 1
jne 0x24b23
lea eax, [ebp - 0x5c]
mov edx, dword [ebp - 0x44]
call fcn.00014548
mov edx, dword [ebp - 0x5c]
mov eax, 0x16a85c
call fcn.00013f70
mov edx, 0x400
mov eax, dword [ebp - 0x44]
call fcn.00018100
mov dword [ebp - 0x34], 0x3ff
lea eax, [ebp - 0x34]
push eax
mov eax, dword [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0x24f44
mov eax, dword [ebp - 0x3c]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x24b75
cmp dword [ebp - 0x48], 1
jne 0x24b75
lea eax, [ebp - 0x60]
mov edx, dword [ebp - 0x44]
call fcn.00014548
mov edx, dword [ebp - 0x60]
mov eax, 0x16a86c
call fcn.00013f70
lea eax, [ebp - 0x44]
mov edx, 0x400
call fcn.00027218
cmp dword [ebp - 0x3c], 0
je 0x24b91
mov eax, dword [ebp - 0x3c]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x3c], eax
cmp dword [0x16a878], 0
je 0x24bbb
cmp byte [ebp - 0x3f], 0
je 0x24bbb
cmp byte [ebp - 0x3d], 0
je 0x24bbb
cmp byte [ebp - 0x35], 0
je 0x24bbb
cmp byte [ebp - 0x3e], 0
jne 0x24d9f
mov eax, dword [0x16a884]
call fcn.00014630
test eax, eax
jle 0x24d9f
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [0x16a884]
call fcn.00014620
push eax
call sub.kernel32.dll_CreateFileW
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
je 0x24d9f
push 0
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_GetFileSize_1
mov dword [ebp - 0x28], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x28], 0x138
jl 0x24d96
cmp dword [ebp - 0x28], 0x1400000
jg 0x24d96
mov eax, dword [ebp - 0x28]
sub eax, 0x138
mov dword [0x16a888], eax
xor eax, eax
mov dword [ebp - 8], eax
push 0
lea eax, [ebp - 8]
push eax
push 0x138
push 0x253818
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_ReadFile_1
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x24], eax
cmp dword [ebp - 8], 0x138
jne 0x24d96
mov eax, dword [0x253940]
cmp eax, 7
jne 0x24d96
call fcn.000241e4
cmp dword [0x16a878], 0
jne 0x24ca4
mov edx, dword [0x253944]
add edx, 0x1079bc
add edx, 0x400
mov eax, 0x16a878
call fcn.000271f0
cmp dword [0x16a878], 0
je 0x24d96
push ebp
call fcn.000246a8
pop ecx
test al, al
je 0x24d96
mov byte [ebp - 0x2d], 1
mov byte [0x16a860], 1
mov edx, dword [0x16a878]
mov eax, 0x253818
mov ecx, 0x138
call fcn.0001291c
lea eax, [ebp - 0x3f]
push eax
lea eax, [ebp - 0x64]
push eax
mov ecx, 0x24e08
mov edx, 0x24e20
mov eax, 0x24e34
call fcn.00023d30
mov edx, dword [ebp - 0x64]
mov eax, 0x16a874
call fcn.00013d6c
lea eax, [ebp - 0x3d]
push eax
lea eax, [ebp - 0x68]
push eax
mov ecx, 0x24e40
mov edx, 0x24e58
mov eax, 0x24e34
call fcn.00023d30
mov edx, dword [ebp - 0x68]
mov eax, 0x16a870
call fcn.00013d6c
lea eax, [ebp - 0x35]
push eax
lea eax, [ebp - 0x6c]
push eax
mov ecx, 0x24e6c
mov edx, 0x24e78
mov eax, 0x24e34
call fcn.00023d30
mov edx, dword [ebp - 0x6c]
mov eax, 0x16a868
call fcn.00013d6c
lea eax, [ebp - 0x3e]
push eax
lea eax, [ebp - 0x70]
push eax
mov ecx, 0x24e8c
mov edx, 0x24eb0
mov eax, 0x24e34
call fcn.00023d30
mov edx, dword [ebp - 0x70]
mov eax, 0x16a87c
call fcn.00013d6c
mov al, byte [ebp - 0x3f]
and al, byte [ebp - 0x3d]
je 0x24d96
cmp byte [ebp - 0x35], 0
je 0x24d96
cmp byte [ebp - 0x3e], 0
mov eax, dword [ebp - 0x20]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x24db3
call fcn.00029a4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x24df4
lea eax, [ebp - 0x70]
mov edx, 4
call fcn.00013d3c
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00013d3c
ret