Function at 0x10017ac0
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], 0
call sym.Comn.dll_GetObjectSys
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
and eax, 0xff
mov dword [ebp - 4], eax
push 0x12
call fcn.10017930
add esp, 4
push 0x11
call fcn.10017930
add esp, 4
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 0x1c]
call eax
test eax, eax
je 0x10017d2a
call sym.Comn.dll_GetObjectVol
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx + 0x54]
call eax
mov byte [ebp - 0x31], al
movsx ecx, byte [ebp - 0x31]
push ecx
call dword [sym.imp.ntdll.dll_isalpha]
add esp, 4
test eax, eax
jne 0x10017b51
mov eax, dword [ebp - 4]
jmp 0x10017d2d
mov byte [ebp - 0x160], 0
push 0x103
push 0
lea edx, [ebp - 0x15f]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
movsx eax, byte [ebp - 0x31]
push eax
push str._C:WindowsSystem32ConfigSoftware
lea ecx, [ebp - 0x160]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x160]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10017bce
movsx eax, byte [ebp - 0x31]
push eax
push str._C:WinntSystem32ConfigSoftware
lea ecx, [ebp - 0x160]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x160]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10017bce
mov eax, dword [ebp - 4]
jmp 0x10017d2d
mov byte [ebp - 0x54], 0
xor eax, eax
mov dword [ebp - 0x53], eax
mov dword [ebp - 0x4f], eax
mov dword [ebp - 0x4b], eax
mov dword [ebp - 0x47], eax
mov dword [ebp - 0x43], eax
mov dword [ebp - 0x3f], eax
mov dword [ebp - 0x3b], eax
mov byte [ebp - 0x37], al
mov byte [ebp - 0x270], 0
push 0x103
push 0
lea ecx, [ebp - 0x26f]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x10038df0
lea edx, [ebp - 0x54]
push edx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push str._sMicrosoftWindows_NTCurrentVersion
lea ecx, [ebp - 0x270]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0x160]
push edx
lea eax, [ebp - 0x54]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x10017c62
mov eax, dword [ebp - 4]
jmp 0x10017d2d
lea ecx, [ebp - 0x10]
push ecx
push 1
push 0
lea edx, [ebp - 0x270]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x10017c9c
lea eax, [ebp - 0x54]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyA]
mov eax, dword [ebp - 4]
jmp 0x10017d2d
mov dword [ebp - 0x164], 0x14
mov byte [ebp - 0x2c], 0
xor ecx, ecx
mov dword [ebp - 0x2b], ecx
mov dword [ebp - 0x27], ecx
mov dword [ebp - 0x23], ecx
mov dword [ebp - 0x1f], ecx
mov word [ebp - 0x1b], cx
mov byte [ebp - 0x19], cl
lea edx, [ebp - 0x164]
push edx
lea eax, [ebp - 0x2c]
push eax
push 0
push 0
push str.CurrentVersion
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x54]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyA]
cmp dword [ebp - 0x30], 0
je 0x10017d04
mov eax, dword [ebp - 4]
jmp 0x10017d2d
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 4]
push edx
push str._d._d
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.ntdll.dll_sscanf]
add esp, 0x10
mov eax, dword [ebp - 4]
jmp 0x10017d2d
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret