Function at 0x10081180
Capabilities:
Check if file exists
Extract resource via kernel32 functions
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x694
mov eax, dword [0x101170e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 2
imul ecx, eax, 0
mov dword [ebp - 0x678], ecx
cmp dword [ebp - 0x678], 0x208
jae 0x100811af
jmp 0x100811b4
call fcn.10085c49
xor edx, edx
mov eax, dword [ebp - 0x678]
mov word [ebp + eax - 0x220], dx
push str.shell32.dll
mov ecx, dword [ebp + 8]
call fcn.1000b540
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x1008130f
mov dword [ebp - 0x64c], 0
lea ecx, [ebp - 0x64c]
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Icons
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1008130f
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], edx
mov eax, dword [ebp + 0xc]
push eax
push 0x100f6068
lea ecx, [ebp - 0x18]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov edx, 2
imul eax, edx, 0
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0x208
jae 0x10081253
jmp 0x10081258
call fcn.10085c49
xor ecx, ecx
mov edx, dword [ebp - 0x67c]
mov word [ebp + edx - 0x428], cx
mov dword [ebp - 0x638], 1
mov dword [ebp - 0x634], 0x208
lea eax, [ebp - 0x634]
push eax
lea ecx, [ebp - 0x428]
push ecx
lea edx, [ebp - 0x638]
push edx
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x64c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10081302
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.SHLWAPI.dll_PathParseIconLocationW]
mov dword [ebp - 0x688], eax
push 0x104
lea eax, [ebp - 0x630]
push eax
lea ecx, [ebp - 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea edx, [ebp - 0x630]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10081302
lea eax, [ebp - 0x630]
push eax
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 0x688]
mov dword [ebp + 0xc], edx
mov eax, dword [ebp - 0x64c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x220]
test eax, eax
jne 0x1008133e
push 0x104
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000b540
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x640], 0
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x664], eax
cmp dword [ebp - 0x664], 0
je 0x100813be
push str.PrivateExtractIconsW
mov edx, dword [ebp - 0x664]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x680], eax
cmp dword [ebp - 0x680], 0
je 0x100813b1
push 0xb0
push 1
lea eax, [ebp - 0x63c]
push eax
lea ecx, [ebp - 0x640]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x220]
push edx
call dword [ebp - 0x680]
mov eax, dword [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x640], 0
jne 0x10081670
push 0xa
push 0
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x658], eax
cmp dword [ebp - 0x658], 0
je 0x10081670
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x684], edx
cmp dword [ebp - 0x684], 0
jl 0x10081566
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x650], 0
lea ecx, [ebp - 0x654]
push ecx
push 0x10080f50
push 0xe
mov edx, dword [ebp - 0x658]
push edx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
cmp dword [ebp - 0x650], 0
je 0x10081538
push 0xe
mov eax, dword [ebp - 0x650]
push eax
mov ecx, dword [ebp - 0x658]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x65c], eax
cmp dword [ebp - 0x65c], 0
je 0x10081538
mov edx, dword [ebp - 0x65c]
push edx
mov eax, dword [ebp - 0x658]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x668], eax
mov ecx, dword [ebp - 0x668]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x66c], eax
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp - 0x66c]
push ecx
call dword [sym.imp.USER32.dll_LookupIconIdFromDirectoryEx]
mov dword [ebp - 0x68c], eax
push 3
movzx edx, word [ebp - 0x68c]
push edx
mov eax, dword [ebp - 0x658]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x65c], eax
mov ecx, dword [ebp - 0x65c]
push ecx
mov edx, dword [ebp - 0x658]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x668], eax
mov eax, dword [ebp - 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x66c], eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0x30000
push 1
mov eax, dword [ebp - 0x65c]
push eax
mov ecx, dword [ebp - 0x658]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov edx, dword [ebp - 0x66c]
push edx
call dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x650], 0x10000
jl 0x10081561
mov eax, dword [ebp - 0x650]
mov dword [ebp - 0x690], eax
push 2
mov ecx, dword [ebp - 0x690]
push ecx
call fcn.10084de4
add esp, 8
jmp 0x10081663
push 0xe
mov edx, dword [ebp - 0x684]
neg edx
movzx eax, dx
push eax
mov ecx, dword [ebp - 0x658]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x660], eax
cmp dword [ebp - 0x660], 0
je 0x10081663
mov edx, dword [ebp - 0x660]
push edx
mov eax, dword [ebp - 0x658]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x670], eax
mov ecx, dword [ebp - 0x670]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x674], eax
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0x10]
push eax
push 1
mov ecx, dword [ebp - 0x674]
push ecx
call dword [sym.imp.USER32.dll_LookupIconIdFromDirectoryEx]
mov dword [ebp - 0x694], eax
push 3
movzx edx, word [ebp - 0x694]
push edx
mov eax, dword [ebp - 0x658]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x660], eax
mov ecx, dword [ebp - 0x660]
push ecx
mov edx, dword [ebp - 0x658]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x674], eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 0x30000
push 1
mov eax, dword [ebp - 0x660]
push eax
mov ecx, dword [ebp - 0x658]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
mov edx, dword [ebp - 0x674]
push edx
call dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov dword [ebp - 0x640], eax
mov eax, dword [ebp - 0x658]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x640], 0
jne 0x1008175a
push 0x10
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0x10]
push edx
push 1
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebp - 0x640], eax
cmp dword [ebp - 0x640], 0
jne 0x1008175a
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x644], 0
push 1
lea ecx, [ebp - 0x644]
push ecx
lea edx, [ebp - 0x648]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
cmp dword [ebp + 0x10], 0x20
jb 0x10081721
cmp dword [ebp - 0x648], 0
je 0x10081713
mov edx, dword [ebp - 0x648]
mov dword [ebp - 0x640], edx
cmp dword [ebp - 0x644], 0
je 0x10081711
mov eax, dword [ebp - 0x644]
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x1008171f
mov ecx, dword [ebp - 0x644]
mov dword [ebp - 0x640], ecx
jmp 0x1008175a
cmp dword [ebp - 0x644], 0
je 0x1008174e
mov edx, dword [ebp - 0x644]
mov dword [ebp - 0x640], edx
cmp dword [ebp - 0x648], 0
je 0x1008174c
mov eax, dword [ebp - 0x648]
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x1008175a
mov ecx, dword [ebp - 0x648]
mov dword [ebp - 0x640], ecx
mov eax, dword [ebp - 0x640]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1008511a
mov esp, ebp
pop ebp
ret