Function at 0x100005a28
Capabilities:
Check if file exists
Get file attributes
Manipulate boot configuration
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x468
mov rax, qword [0x100017110]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov r12, qword [rsp + 0x4d8]
mov rbp, rcx
mov rsi, r8
mov rbx, rdx
lea rcx, [rsp + 0x54]
xor r14d, r14d
mov r8d, 0x1fa
xor edx, edx
mov r13, r9
mov dword [rsp + 0x50], r14d
call sub.msvcrt.dll_memset
or rax, 0xffffffffffffffff
lea rcx, [rsp + 0x254]
xor edx, edx
mov r8d, 0x1f8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x250], r14d
call sub.msvcrt.dll_memset
lea r15d, [r14 + 1]
xor eax, eax
lea rdi, [rsp + 0x50]
mov ecx, 0x1fe
lea rdx, [0x1000014a8]
rep stosb byte [rdi], al
xor r9d, r9d
mov r8d, r15d
mov rcx, rbp
mov dword [rsp + 0x30], 0xfe
mov dword [rsp + 0x34], r14d
mov dword [r12], r15d
call fcn.10000fa28
cmp eax, r14d
je 0x100005be4
cmp rbx, r14
je 0x100005b0b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, r14d
je 0x100005b0b
mov rcx, rbx
call fcn.100010700
movsxd rcx, eax
shr rcx, 1
jmp 0x100005b10
mov ecx, 0x100
mov eax, dword [rsp + 0x4d0]
mov r8d, ecx
mov r9, rsi
mov dword [rsp + 0x28], eax
mov rdx, rbx
mov rcx, rbp
mov dword [rsp + 0x20], 0xfe
call fcn.100012560
mov ebx, eax
cmp eax, r14d
jne 0x100005b60
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20001
lea rcx, [rax + 0x60]
call fcn.10000e424
mov rdi, rsi
xor eax, eax
mov ecx, 0xfe
rep stosb byte [rdi], al
jmp 0x100005e89
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4c3
je 0x100005b76
cmp eax, 0x50010001
jne 0x100005b8e
jmp 0x100005b8a
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20004
lea rcx, [rax + 0x60]
call fcn.10000e424
mov dword [r12], r14d
xor eax, eax
mov rdi, rsi
mov ecx, 0xfe
rep stosb byte [rdi], al
mov rcx, rbp
call fcn.10000dc5c
cmp eax, r15d
jne 0x100005baf
mov ebx, r14d
jmp 0x100005e89
mov rcx, rbp
lea r8, [rsp + 0x38]
mov rdx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
cmp eax, r14d
je 0x100005bf5
call fcn.10000e274
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20001
lea rcx, [rax + 0x60]
call fcn.10000e424
jmp 0x100005ba7
mov rcx, rbp
call fcn.10000dc5c
cmp eax, r15d
je 0x100005ba7
xor ecx, ecx
jmp 0x100005bb2
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea rdx, [0x100001720]
mov r9d, r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
je 0x100005c26
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x100005bc9
mov ecx, dword [rsp + 0x30]
add ecx, ecx
call fcn.100010558
mov rsi, rax
mov qword [rsp + 0x48], rax
cmp rax, r14
jne 0x100005c56
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.10000e274
mov ebx, r14d
jmp 0x100005e7a
mov rcx, rax
call fcn.100010700
mov rdi, rsi
lea r9, [rsp + 0x34]
movsxd rcx, eax
xor eax, eax
lea rdx, [0x100001780]
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [entry0]
cmp eax, 0xea
jne 0x100005cba
lea rcx, [rsp + 0x48]
call fcn.10001047c
mov ecx, dword [rsp + 0x30]
add ecx, ecx
call fcn.100010558
mov rsi, rax
mov qword [rsp + 0x48], rax
cmp rax, r14
je 0x100005c3e
mov rcx, rsi
call fcn.100010700
mov rdi, rsi
lea r9, [rsp + 0x34]
movsxd rcx, eax
xor eax, eax
lea rdx, [0x100001780]
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [entry0]
cmp eax, r14d
je 0x100005d2b
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.10000e274
mov ecx, 0x8a
call fcn.10000e684
mov rdi, rax
call qword [sym.imp.msvcrt.dll___iob_func]
mov rdx, rdi
lea rcx, [rax + 0x60]
call fcn.10000fab8
jmp 0x100005c4e
mov eax, dword [rsp + 0x30]
lea rcx, [rsp + 0x250]
mov r8d, 0xfe
dec eax
mov rdx, rsi
mov word [rsi + rax*2], r14w
call fcn.10000f884
lea rcx, [rsp + 0x250]
call qword [sym.imp.USER32.dll_CharUpperW]
lea rdx, [0x1000014a8]
xor r9d, r9d
mov r8d, r15d
mov rcx, rbp
call fcn.10000fa28
mov edx, 0xff
lea rcx, [rsp + 0x50]
cmp eax, r14d
je 0x100005da2
mov eax, 0x24
lea r8, [0x100001790]
mov r9, rbp
mov word [rsi + 2], ax
mov word [rsi + 4], r14w
mov qword [rsp + 0x20], rsi
call fcn.100001db8
jmp 0x100005db1
lea r8, [0x1000017b8]
mov r9, rsi
call fcn.100001db8
lea rdx, [0x1000017d0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wfopen]
cmp rax, r14
je 0x100005d07
mov rcx, rax
call qword [sym.imp.msvcrt.dll_fclose]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [0x100017838], eax
cmp eax, 0xffffffff
jne 0x100005e09
call fcn.10000e274
call qword [sym.imp.msvcrt.dll___iob_func]
mov edx, 0x20001
lea rcx, [rax + 0x60]
call fcn.10000e424
jmp 0x100005c4e
lea rcx, [rsp + 0x50]
mov edx, 0x180
call qword [sym.imp.msvcrt.dll__wchmod]
cmp eax, 0xffffffff
jne 0x100005e55
mov ecx, 0x8b
call fcn.10000e684
mov rdi, rax
call qword [sym.imp.msvcrt.dll___iob_func]
lea rcx, [rsp + 0x250]
mov qword [rsp + 0x20], rcx
lea rcx, [rax + 0x60]
mov r9, rdi
mov r8d, r15d
mov edx, r15d
call fcn.10000fdf8
jmp 0x100005c4e
cmp eax, r14d
je 0x100005e64
mov ecx, 0x8b
jmp 0x100005d0c
lea rdx, [rsp + 0x50]
mov r8d, 0xfe
mov rcx, r13
call fcn.10000f884
mov ebx, r15d
cmp rsi, r14
je 0x100005e89
lea rcx, [rsp + 0x48]
call fcn.10001047c
mov rcx, qword [rsp + 0x40]
cmp rcx, 0xffffffffffffffff
je 0x100005e9a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
cmp rcx, 0xffffffffffffffff
je 0x100005eab
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.100014d50
add rsp, 0x468
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret