Function at 0x10002349
Capabilities:
Get file system object information
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10031442
mov eax, dword fs:[0]
push eax
mov eax, 0x1128
call fcn.100310c0
mov eax, dword [0x1005f070]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor edi, edi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10f4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x110c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1118], eax
mov eax, 0x208
mov dword [ebp - 0x10e0], esi
mov dword [ebp - 0x1108], edi
mov dword [ebp - 0x1114], edi
mov dword [ebp - 0x1134], 0xc8
mov dword [ebp - 0x1120], 0x20a
mov dword [ebp - 0x1124], eax
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x1128], 0x4e
mov dword [ebp - 0x10e4], 1
mov dword [ebp - 0x1104], edi
mov dword [ebp - 0x10f8], edi
mov dword [ebp - 0x1100], edi
mov dword [ebp - 0x10fc], edi
mov dword [ebp - 0x10e8], edi
mov dword [esi + 0x1060], edi
mov dword [esi + 0x105c], edi
cmp dword [esi + 0x1274], edi
je 0x100024a5
mov ecx, dword [esi + 0x1270]
lea ebx, [esi + 0x1064]
test ecx, ecx
mov dword [ebp - 0x10ec], ecx
mov edx, 0x100348e8
mov dword [ebp - 0x1114], ebx
mov eax, str..mht
push edi
cmove eax, edx
push ebx
mov dword [ebp - 0x10f0], eax
call fcn.10026806
mov dword [ebp - 0x10dc], eax
mov esi, str.Param
xor eax, eax
mov dword [ebp - 0x10d0], ebx
mov word [ebp - 0x10cc], ax
mov edx, 0x851
lea eax, [ebp - 0x10d8]
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
push eax
push str.CIconHandler::GetIconLocation__ENTER_:_m_wzProgID_
push ecx
push 0x64
pop ebx
push ebx
mov ecx, 0x170a85c
mov dword [ebp - 0x10d4], esi
call fcn.10026806
mov eax, dword [ebp - 0x10dc]
jmp 0x100025bd
lea ebx, [esi + 0xc]
mov ecx, ebx
call fcn.1000d787
lea esi, [esi + eax*2]
add esi, 0xc
mov dword [ebp - 0x10f0], esi
cmp esi, ebx
jbe 0x100024d2
cmp word [esi], 0x2e
je 0x100024cc
sub esi, 2
cmp esi, ebx
ja 0x100024bf
mov dword [ebp - 0x10f0], esi
mov edx, str..mht
mov ecx, esi
call fcn.1000d8bb
test eax, eax
jne 0x100024f8
mov edx, 0x100358f4
mov ecx, esi
call fcn.1000d8bb
mov dword [ebp - 0x10ec], edi
test eax, eax
je 0x10002502
mov dword [ebp - 0x10ec], 1
xor eax, eax
mov dword [ebp - 0x10d0], ebx
mov word [ebp - 0x10cc], ax
mov esi, str.Param
lea eax, [ebp - 0x10d8]
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
push eax
push str.CIconHandler::GetIconLocation__ENTER_:_m_wzFileName_
push ecx
push 0x64
pop ebx
push ebx
mov edx, 0x851
mov dword [ebp - 0x10d4], esi
mov ecx, 0x170a85e
call fcn.10026806
mov ecx, dword [ebp - 0x10e0]
add ecx, 0xc
call fcn.10026806
test eax, eax
je 0x10002578
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_No_app_icon_because_remote_file
push ecx
mov ecx, 0x170a85f
jmp 0x10002a38
mov ecx, dword [ebp - 0x10e0]
push 1
lea eax, [ecx + 0xc]
push eax
call fcn.10026806
mov dword [ebp - 0x1108], eax
test eax, eax
jne 0x100025b1
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_No_app_icon_because_PHevCreateFileInfo_fail
push ecx
mov ecx, 0x170a860
jmp 0x10002a38
push eax
call fcn.10026806
mov dword [ebp - 0x10dc], eax
cmp eax, 8
ja 0x10002621
mov ecx, dword [0x10060d44]
test ecx, ecx
je 0x10002621
mov edx, dword [ebp - 0x10ec]
lea eax, [edx + eax*2]
imul edx, eax, 0x210
add edx, ecx
cmp dword [edx + 0x20c], edi
je 0x10002621
push 0x106
lea ecx, [ebp - 0x564]
call fcn.10026806
lea eax, [ebp - 0x564]
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_App_icon_found_in_cache_
push ecx
mov ecx, 0x170a862
jmp 0x1000297f
mov eax, dword [ebp - 0x10e0]
cmp dword [eax + 0x1274], edi
jne 0x10002685
mov eax, dword [ebp - 0x1108]
mov edx, 0x851
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov dword [ebp - 0x10d4], esi
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_wzProgID_
push ecx
push ebx
mov ecx, 0x170a863
call fcn.10026806
mov ecx, dword [ebp - 0x1108]
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x1114], eax
jmp 0x1000268b
mov eax, dword [ebp - 0x1114]
test eax, eax
jne 0x100026ad
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_No_app_icon_because_wzProgID_NULL
push ecx
mov ecx, 0x170a880
jmp 0x10002a38
push 0x104
mov edx, eax
lea ecx, [ebp - 0x984]
call fcn.10026806
push 0x10c
mov edx, 0x10034c44
lea ecx, [ebp - 0x984]
call fcn.10026806
lea eax, [ebp - 0x1104]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x984]
mov ecx, 0x80000000
call fcn.10026806
test eax, eax
jne 0x1000279c
movzx eax, byte [ebp - 0x150]
xor ecx, ecx
cmp dword [ebp - 0x10e4], 1
cmove eax, ecx
mov byte [ebp - 0x150], al
lea eax, [ebp - 0x1134]
push eax
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x10e4]
push eax
push edi
push edi
push dword [ebp - 0x1104]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000279c
push 0x77
mov edx, str.HTML_HandlerIcon
lea ecx, [ebp - 0x150]
call fcn.10026806
lea eax, [ebp - 0x10f8]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x150]
mov ecx, 0x80000000
call fcn.10026806
test eax, eax
je 0x1000280d
lea eax, [ebp - 0x150]
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_No_app_icon_because_reg_fail_2_
push ecx
mov ecx, 0x170a882
jmp 0x10002a3e
mov edx, dword [ebp - 0x1114]
lea ecx, [ebp - 0x150]
push ebx
call fcn.10026806
push 0x77
mov edx, str.HTML_HandlerIcon
lea ecx, [ebp - 0x150]
call fcn.10026806
lea eax, [ebp - 0x10f8]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0x150]
mov ecx, 0x80000000
call fcn.10026806
test eax, eax
je 0x1000280d
lea eax, [ebp - 0x984]
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_No_app_icon_because_reg_fail_1_
push ecx
mov ecx, 0x170a881
jmp 0x10002a3e
mov edx, dword [ebp - 0x10f0]
lea eax, [ebp - 0x1120]
push eax
lea eax, [ebp - 0x562]
push eax
lea eax, [ebp - 0x10e4]
push eax
push ecx
mov ecx, dword [ebp - 0x10f8]
call fcn.10026806
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov edx, 0x851
mov dword [ebp - 0x10d4], esi
test eax, eax
je 0x10002879
mov eax, dword [ebp - 0x10f0]
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_No_app_icon_because_reg_fail_3_
push ecx
mov ecx, 0x170a883
jmp 0x10002a53
push 0x2a
pop eax
mov word [ebp - 0x564], ax
lea eax, [ebp - 0x564]
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_wzIconExt_
push ecx
push ebx
mov ecx, 0x170a884
call fcn.10026806
mov ecx, dword [0x10060d44]
test ecx, ecx
jne 0x10002912
mov ecx, 0x2940
call fcn.100033c7
mov ecx, eax
mov dword [0x10060d44], ecx
test ecx, ecx
jne 0x100028fc
lea eax, [ebp - 0x564]
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_App_icon_found_but_cache_alloc_failed_
push ecx
mov ecx, 0x170a885
jmp 0x1000297f
push 0x14
lea eax, [ecx + 0x20c]
pop edx
mov dword [eax], edi
lea eax, [eax + 0x210]
sub edx, 1
jne 0x10002905
mov eax, dword [ebp - 0x10dc]
cmp eax, 8
ja 0x1000299a
mov edx, dword [ebp - 0x10ec]
lea eax, [edx + eax*2]
imul eax, eax, 0x210
add eax, ecx
mov dword [ebp - 0x10dc], eax
je 0x1000294e
push 0x106
lea edx, [ebp - 0x564]
mov ecx, eax
call fcn.10026806
mov eax, dword [ebp - 0x10dc]
mov dword [eax + 0x20c], 1
lea eax, [ebp - 0x564]
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_App_icon_added_to_cache_
push ecx
mov ecx, 0x170a886
push ebx
mov edx, 0x851
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov dword [ebp - 0x10d4], esi
call fcn.10026806
push 0x4011
push 0x2b4
lea eax, [ebp - 0x10c8]
push eax
push 0x80
lea eax, [ebp - 0x564]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [ebp - 0x10e0]
mov dword [ecx + 0x105c], eax
test eax, eax
jne 0x100029e8
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_No_app_icon_because_SHGetFileInfo_fail__small_
push ecx
mov ecx, 0x170a887
jmp 0x10002a38
push 0x4010
push 0x2b4
lea eax, [ebp - 0x10c8]
push eax
push 0x80
lea eax, [ebp - 0x564]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov ecx, dword [ebp - 0x10e0]
mov dword [ecx + 0x1060], eax
test eax, eax
jne 0x10003162
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_No_app_icon_because_SHGetFileInfo_fail__large_
push ecx
mov ecx, 0x170a888
mov dword [ebp - 0x10d0], edi
mov edx, 0x851
mov dword [ebp - 0x10d4], esi
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
push ebx
call fcn.10026806
mov edx, dword [ebp - 0x10f0]
lea eax, [ebp - 0x1100]
push eax
push 0x20019
push ecx
mov ecx, 0x80000000
call fcn.10026806
test eax, eax
jne 0x100030c9
movzx eax, byte [ebp - 0x76c]
xor ecx, ecx
cmp dword [ebp - 0x10e4], 1
cmove eax, ecx
mov byte [ebp - 0x76c], al
lea eax, [ebp - 0x1124]
push eax
lea eax, [ebp - 0x76c]
push eax
lea eax, [ebp - 0x10e4]
push eax
push edi
push edi
push dword [ebp - 0x1100]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x100030c9
push 0x13b
mov edx, str.CLSID42042206_2D85_11D3_8CFF_005004838597Old_Icon_
lea ecx, [ebp - 0xbfc]
call fcn.10026806
push 0x13b
lea edx, [ebp - 0x76c]
lea ecx, [ebp - 0xbfc]
call fcn.10026806
lea eax, [ebp - 0x10fc]
push eax
push 0x20019
push ecx
lea edx, [ebp - 0xbfc]
mov ecx, 0x80000000
call fcn.10026806
test eax, eax
je 0x10002b3a
lea eax, [ebp - 0xbfc]
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_No_old_icon_because_reg_fail_B2_
push ecx
mov ecx, 0x170a88a
jmp 0x100030f0
cmp dword [0x10060d48], edi
je 0x10002b83
xor eax, eax
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [ebp - 0x10cc], ax
mov edx, 0x851
lea eax, [ebp - 0x10d8]
mov dword [ebp - 0x10d4], esi
push eax
push str.CIconHandler::GetIconLocation:_vfInsideGetIconLocation
push ecx
push ebx
mov ecx, 0x170a88b
mov dword [ebp - 0x10d0], edi
call fcn.10026806
jmp 0x10002d7e
lea eax, [ebp - 0x10e8]
mov edx, str.ShellExIconHandler
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x10fc]
call fcn.10026806
test eax, eax
jne 0x10002d7e
movzx eax, byte [ebp - 0x60]
xor ecx, ecx
cmp dword [ebp - 0x10e4], 1
cmove eax, ecx
mov byte [ebp - 0x60], al
lea eax, [ebp - 0x1128]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x10e4]
push eax
push edi
push edi
push dword [ebp - 0x10e8]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x10002d7e
lea edx, [ebp - 0xe14]
lea ecx, [ebp - 0x60]
call fcn.10026806
test eax, eax
je 0x10002d7e
lea eax, [ebp - 0x60]
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov dword [ebp - 0x10d0], eax
mov edx, 0x851
xor eax, eax
mov dword [ebp - 0x10d4], esi
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_wzIconHandler_
push ecx
push ebx
mov ecx, 0x170a88c
call fcn.10026806
call fcn.10001aae
test eax, eax
je 0x10002d7e
lea eax, [ebp - 0x1110]
push eax
push 0x100343d0
push ecx
lea ecx, [ebp - 0xe14]
call fcn.10026806
mov esi, eax
mov dword [ebp - method.Mso::Logging::StructuredObject_unsigned_int__1_.virtual_0], vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
xor eax, eax
mov dword [ebp - 0x10d4], str.Param
mov word [ebp - 0x10cc], ax
mov edx, 0x851
lea eax, [ebp - 0x10d8]
mov dword [ebp - 0x10d0], esi
push eax
push str.CIconHandler::GetIconLocation:_CoCreateInstance_
push ecx
push ebx
mov ecx, 0x170a88d
call fcn.10026806
test esi, esi
js 0x10002d7e
mov ecx, dword [ebp - 0x1110]
lea edx, [ebp - 0x112c]
push edx
push 0x10034420
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
js 0x10002d72
mov edx, dword [ebp - 0x112c]
push edi
mov eax, dword [edx]
mov ecx, dword [eax + 0x14]
mov eax, dword [ebp - 0x10e0]
add eax, 0xc
push eax
push edx
call ecx
test eax, eax
js 0x10002d72
push dword [ebp - 0x1118]
mov ecx, dword [ebp - 0x1110]
push dword [ebp - 0x110c]
mov dword [0x10060d48], 1
push dword [ebp + 0x14]
mov eax, dword [ecx]
push dword [ebp - 0x10f4]
push dword [ebp + 0xc]
push ecx
call dword [eax + 0xc]
mov esi, eax
mov dword [0x10060d48], edi
xor eax, eax
mov dword [ebp - method.Mso::Logging::StructuredObject_unsigned_int__1_.virtual_0], vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov word [ebp - 0x10cc], ax
mov edx, 0x851
lea eax, [ebp - 0x10d8]
mov dword [ebp - 0x10d4], str.Param
push eax
push str.CIconHandler::GetIconLocation:_GetIconLocation_
push ecx
push ebx
mov ecx, 0x170a88e
mov dword [ebp - 0x10d0], esi
call fcn.10026806
test esi, esi
js 0x10002d72
mov eax, dword [ebp - 0x1110]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x100031ad
mov eax, dword [ebp - 0x1110]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x10e8]
mov edx, 0x100353fc
push eax
push 0x20019
push ecx
mov ecx, dword [ebp - 0x10fc]
call fcn.10026806
test eax, eax
jne 0x1000309b
movzx eax, byte [ebp - 0x358]
xor ecx, ecx
cmp dword [ebp - 0x111c], 1
cmove eax, ecx
mov byte [ebp - 0x358], al
lea eax, [ebp - 0x1130]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x111c]
push eax
push edi
push edi
push dword [ebp - 0x10e8]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000309b
mov eax, dword [ebp - 0x111c]
cmp eax, 1
je 0x10002e71
cmp eax, 2
je 0x10002e3d
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_No_old_icon_because_path_value_is_unknown_type:
push ecx
mov ecx, 0x170a890
mov esi, str.Param
mov dword [ebp - method.Mso::Logging::StructuredObject_unsigned_int__1_.virtual_0], vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov edx, 0x851
mov dword [ebp - 0x10d4], esi
push ebx
call fcn.10026806
jmp 0x1000310b
mov esi, 0x104
lea eax, [ebp - 0xe04]
push esi
push eax
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x10002ed1
cmp eax, esi
ja 0x10002ed1
push esi
lea edx, [ebp - 0xe04]
lea ecx, [ebp - 0x358]
call fcn.10026806
lea eax, [ebp - 0x358]
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov dword [ebp - 0x10d0], eax
mov esi, str.Param
xor eax, eax
mov dword [ebp - 0x10d4], esi
mov word [ebp - 0x10cc], ax
mov edx, 0x851
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_wzDefaultIcon_
push ecx
push ebx
mov ecx, 0x170a893
call fcn.10026806
lea ecx, [ebp - 0x358]
call fcn.1000d787
lea ecx, [ebp - 0x358]
push 0x2c
pop edx
lea eax, [ecx + eax*2]
jmp 0x10002eff
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_No_old_icon_because_path_value_expands_too_large:
push ecx
mov ecx, 0x170a892
jmp 0x10002e18
cmp word [eax], dx
je 0x10002f3c
sub eax, 2
lea ecx, [ebp - 0x358]
mov dword [ebp - 0x10dc], eax
cmp eax, ecx
ja 0x10002ef7
cmp word [eax], dx
je 0x10002f3c
mov eax, ecx
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_No_old_icon_because_no_comma_
push ecx
mov ecx, 0x170a895
jmp 0x100030f0
xor ecx, ecx
mov word [eax], cx
cmp dword [ebp - 0x10f4], ecx
je 0x10003015
lea eax, [ebp - 0x358]
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov dword [ebp - 0x10d0], eax
mov edx, 0x851
xor eax, eax
mov dword [ebp - 0x10d4], esi
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_wzIconFile_
push ecx
push ebx
mov ecx, 0x170a896
call fcn.10026806
mov eax, dword [ebp - 0x10e0]
cmp dword [eax + 0x1058], edi
jne 0x10002fb3
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x10f4]
lea edx, [ebp - 0x358]
call fcn.10026806
jmp 0x1000300f
lea ecx, [ebp - 0x358]
call fcn.1000df3f
mov dword [ebp - 0x10ec], eax
test eax, eax
jne 0x10002ff4
lea eax, [ebp - 0x358]
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_Memory_alloc_fail_
push ecx
mov ecx, 0x170a897
jmp 0x100030f0
push dword [ebp + 0x14]
mov ecx, dword [ebp - 0x10f4]
mov edx, eax
call fcn.10026806
mov ecx, dword [ebp - 0x10ec]
call fcn.100033fc
mov eax, dword [ebp - 0x10dc]
cmp dword [ebp - 0x110c], edi
je 0x10003150
lea ecx, [eax + 2]
call fcn.1000dcc9
mov ecx, dword [ebp - 0x110c]
mov edx, 0x851
mov dword [ebp - method.Mso::Logging::StructuredObject_unsigned_int__1_.virtual_0], vtable.Mso::Logging::StructuredObject_unsigned_int__1_.0
mov dword [ebp - 0x10d4], esi
mov dword [ecx], eax
test eax, eax
jns 0x1000306f
neg eax
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_piIndex___
push ecx
mov ecx, 0x170a898
jmp 0x10003090
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_piIndex_
push ecx
mov ecx, 0x170a899
push ebx
call fcn.10026806
jmp 0x10003150
lea eax, [ebp - 0x358]
mov esi, str.Param
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_No_old_icon_because_reg_fail_B3_
push ecx
mov ecx, 0x170a88f
jmp 0x100030f0
lea eax, [ebp - 0x76c]
mov dword [ebp - 0x10d0], eax
xor eax, eax
mov word [ebp - 0x10cc], ax
lea eax, [ebp - 0x10d8]
push eax
push str.CIconHandler::GetIconLocation:_No_old_icon_because_reg_fail_B1_
push ecx
mov ecx, 0x170a889
push ebx
mov edx, 0x851
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov dword [ebp - 0x10d4], esi
call fcn.10026806
xor eax, eax
mov dword [ebp - method.Mso::Logging::StructuredObject_wchar_t_const___1_.virtual_0], vtable.Mso::Logging::StructuredObject_wchar_t_const___1_.0
mov word [ebp - 0x10cc], ax
mov edx, 0x851
lea eax, [ebp - 0x10d8]
mov dword [ebp - 0x10d4], esi
push eax
push str.CIconHandler::GetIconLocation:_Fail
push ecx
push ebx
mov ecx, 0x170a89a
mov dword [ebp - 0x10d0], 0x10034820
call fcn.10026806
mov edi, 0x80004005
mov eax, dword [ebp - 0x1118]
test eax, eax
je 0x100031ad
mov dword [eax], 2
jmp 0x100031ad
mov eax, dword [ebp - 0x10f4]
test eax, eax
je 0x1000318f
cmp dword [ecx + 0x1058], edi
mov ecx, eax
push dword [ebp + 0x14]
jne 0x10003185
mov edx, 0x100348e4
call fcn.10026806
jmp 0x1000318f
mov edx, 0x100358f0
call fcn.10026806
mov ecx, dword [ebp - 0x110c]
mov eax, dword [ebp - 0x10c4]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1118]
test eax, eax
je 0x100031ad
mov dword [eax], 8
mov eax, dword [ebp - 0x1108]
test eax, eax
je 0x100031bd
push eax
call fcn.10026806
cmp dword [ebp - 0x1104], 0
mov esi, dword [sym.imp.advapi32.dll_RegCloseKey]
je 0x100031d4
push dword [ebp - 0x1104]
call esi
cmp dword [ebp - 0x10f8], 0
je 0x100031e5
push dword [ebp - 0x10f8]
call esi
cmp dword [ebp - 0x1100], 0
je 0x100031f6
push dword [ebp - 0x1100]
call esi
cmp dword [ebp - 0x10fc], 0
je 0x10003207
push dword [ebp - 0x10fc]
call esi
cmp dword [ebp - 0x10e8], 0
je 0x10003218
push dword [ebp - 0x10e8]
call esi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002f764
leave
ret 0x18