Function at 0x10007047
Capabilities:
Check if file exists
Check if process is running under wine
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x10027911
call fcn.10011854
sub esp, 0x238
push ebx
mov ebx, ecx
xor eax, eax
push esi
mov dword [ebx + 0x38], eax
push edi
mov dword [ebp - 0x3c], ebx
mov dword [ebx + 4], eax
lea edi, [ebx + 0x10]
mov esi, 0x1002c788
mov dword [ebx + 0x34], 0xfefefefe
lea ecx, [ebx + 0x3c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x20]
mov esi, 0x1002c768
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov word [ebx + 0x30], 1
mov word [ebx + 0x32], 1
call fcn.1000181b
lea ecx, [ebx + 0x60]
mov byte [ebp - 4], 1
call fcn.100025d2
xor edi, edi
lea ecx, [ebx + 0x6c]
push edi
push 1
mov byte [ebp - 4], 2
call fcn.1000c7de
lea ecx, [ebx + 0x140]
mov byte [ebp - 4], 3
call fcn.1000bff3
mov eax, dword [0x10034f94]
mov dword [ebx + 0x210], eax
mov eax, dword [0x10034f94]
mov dword [ebx + 0x214], eax
mov eax, dword [0x10034f94]
mov dword [ebx + 0x218], eax
mov eax, dword [0x10034f94]
mov dword [ebx + 0x21c], eax
lea eax, [ebx + 0x220]
mov dword [eax], 0x1002a9a0
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov dword [eax + 8], edi
mov dword [eax + 4], edi
mov dword [eax + 0x14], edi
mov dword [eax + 0x18], 0xa
mov eax, dword [0x10034f94]
mov dword [ebx + 0x23c], eax
mov eax, dword [0x10034f94]
mov dword [ebx + 0x240], eax
mov eax, dword [0x10034f94]
mov dword [ebx + 0x244], eax
mov eax, dword [0x10034f94]
mov dword [ebx + 0x248], eax
mov eax, dword [0x10034f94]
mov dword [ebx + 0x24c], eax
mov eax, dword [0x10034f94]
mov dword [ebx + 0x250], eax
lea ecx, [ebx + 0x254]
mov byte [ebp - 4], 0xf
call fcn.1000eea1
lea ecx, [ebx + 0x298]
mov byte [ebp - 4], 0x10
call fcn.1001d4c8
mov esi, 0x100387a8
lea ecx, [ebx + 0x240]
push esi
mov byte [ebp - 4], 0x11
mov dword [ebx + 0x274], edi
mov dword [ebx + 0x278], edi
mov dword [ebx + 0x27c], edi
mov dword [ebx + 0x280], edi
mov dword [ebx + 0x284], edi
mov dword [ebx + 0x28c], edi
mov dword [ebx + 0x288], edi
call fcn.1001df13
push esi
lea ecx, [ebx + 0x244]
call fcn.1001df13
push esi
lea ecx, [ebx + 0x248]
call fcn.1001df13
push esi
lea ecx, [ebx + 0x24c]
call fcn.1001df13
push esi
lea ecx, [ebx + 0x250]
call fcn.1001df13
push 4
mov esi, str.SOFTWAREWinExpand_s2uzg
pop eax
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x18], edi
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x28]
push eax
push str.MAINCNT
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x10007226
mov dword [ebp - 0x30], edi
xor eax, eax
jmp 0x10007229
mov eax, dword [ebp - 0x38]
cmp eax, edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
jle 0x10007533
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x14], 1
mov eax, dword [0x10034f94]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 0x12
push str.MAIN_R_d
push eax
call fcn.1001d2f1
and byte [ebp - 0x244], 0
add esp, 0xc
xor eax, eax
lea edi, [ebp - 0x243]
push 0x40
and byte [ebp - 0x140], 0
pop ecx
mov dword [ebp - 0x20], 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x13f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20]
mov edi, SysReAllocString
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 1
push dword [ebp - 0x10]
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x100072d6
push 0x104
lea eax, [ebp - 0x244]
push 0
push eax
call fcn.10011a00
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
call fcn.10011400
test eax, eax
pop ecx
jbe 0x10007300
mov eax, dword [ebx + 0x2a0]
lea ecx, [ebx + 0x298]
lea edx, [ebp - 0x244]
push edx
push eax
call fcn.1001d6a4
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push 0x100335c0
push eax
call fcn.1001d2f1
add esp, 0xc
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x104
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x10]
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
je 0x1000734f
push 0x104
lea eax, [ebp - 0x140]
push 0
push eax
call fcn.10011a00
add esp, 0xc
lea eax, [ebp - 0x140]
mov dword [ebp - 0x1c], 1
push eax
call fcn.10011400
test eax, eax
pop ecx
jne 0x100073b2
and dword [ebp - 0x1c], eax
push ecx
lea eax, [ebp - 0x244]
mov ecx, esp
mov dword [ebp - 0x34], esp
push eax
call fcn.1001ddf8
lea eax, [ebp - 0x2c]
push eax
call fcn.100029f4
push str.ERROR
push dword [ebp - 0x2c]
call fcn.100124b4
add esp, 0x10
test eax, eax
je 0x100073aa
push dword [ebp - 0x2c]
lea eax, [ebp - 0x140]
push eax
call fcn.10011a60
pop ecx
pop ecx
lea ecx, [ebp - 0x2c]
call fcn.1001dd8a
lea eax, [ebp - 0x140]
push eax
call fcn.10011400
test eax, eax
pop ecx
jbe 0x100074b7
lea eax, [ebp - 0x140]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x100073e0
push dword [ebp - 0x14]
jmp 0x100074c2
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x24]
je 0x10007515
cmp dword [ebp - 0x1c], 0
je 0x10007434
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x24]
add ecx, eax
lea eax, [ebp - 0x10]
push ecx
push 0x100335c0
push eax
call fcn.1001d2f1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x140]
push eax
call fcn.10011400
add esp, 0x10
inc eax
push eax
lea eax, [ebp - 0x140]
push eax
push 1
push dword [ebp - 0x1c]
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push str.MAIN_R_d
push eax
call fcn.1001d2f1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x244]
push eax
call fcn.10011400
add esp, 0x10
inc eax
push eax
lea eax, [ebp - 0x244]
push eax
push 1
push dword [ebp - 0x1c]
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push 0x100335c0
push eax
call fcn.1001d2f1
add esp, 0xc
push dword [ebp - 0x10]
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push str.MAIN_R_d
push eax
call fcn.1001d2f1
add esp, 0xc
push dword [ebp - 0x10]
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
jmp 0x10007515
mov eax, dword [ebp - 0x14]
lea ecx, [eax - 1]
test ecx, ecx
jl 0x10007515
push eax
lea eax, [ebp - 0x10]
push 0x100335c0
push eax
call fcn.1001d2f1
add esp, 0xc
push dword [ebp - 0x10]
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push str.MAIN_R_d
push eax
call fcn.1001d2f1
add esp, 0xc
push dword [ebp - 0x10]
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
dec dword [ebp - 0x18]
lea eax, [ebp - 0x18]
push 4
push eax
push 4
push str.MAINCNT
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0x11
call fcn.1001dd8a
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
dec eax
cmp eax, dword [ebp - 0x24]
jl 0x10007241
xor edi, edi
cmp dword [ebp - 0x30], edi
jne 0x1000753d
cmp dword [ebp - 0x18], edi
jne 0x10007546
push esi
lea ecx, [ebx + 0x60]
call fcn.10002661
push 0x70
call fcn.1001e2ee
pop ecx
mov dword [ebp - 0x34], eax
cmp eax, edi
mov byte [ebp - 4], 0x13
je 0x10007565
push 1
push ebx
mov ecx, eax
call fcn.100033ef
jmp 0x10007567
xor eax, eax
push 0x70
mov byte [ebp - 4], 0x11
mov dword [ebx + 0x290], eax
call fcn.1001e2ee
pop ecx
mov dword [ebp - 0x34], eax
cmp eax, edi
mov byte [ebp - 4], 0x14
je 0x1000758f
push edi
push ebx
mov ecx, eax
call fcn.100033ef
jmp 0x10007591
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword [ebx + 0x294], eax
pop edi
mov eax, ebx
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret