Function at 0x1005a14
Capabilities:
Get file size
Query or enumerate registry value
Read file on windows

Disassembly:
sub esp, 0x328
push ebx
push ebp
push esi
push edi
push 0x1002494
lea eax, [esp + 0x30]
xor ebx, ebx
push eax
mov esi, ecx
xor edi, edi
mov dword [esp + 0x1c], ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1002480
push dword [esi + 0xc]
call fcn.010076a1
mov eax, dword [esi + 0x114]
cmp eax, 3
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
pop ecx
pop ecx
je 0x1005a74
cmp eax, 2
je 0x1005a74
cmp eax, 4
je 0x1005a74
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push 0x1002454
jmp 0x1005a84
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
lea eax, [esp + 0x38]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1005aec
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x20]
push eax
push ebx
mov ebx, 0x1002448
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1005ae0
push dword [esp + 0x14]
push 8
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1005ae0
lea eax, [esp + 0x14]
push eax
push edi
lea eax, [esp + 0x20]
push eax
push 0
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp dword [esp + 0x14], ebx
je 0x1005b0e
mov ecx, dword [esi + 0xc]
push edi
call fcn.01007670
push edi
push 0x1002054
push dword [esi + 0xc]
call fcn.010076a1
add esp, 0xc
jmp 0x1005b5e
mov eax, dword [esi + 0x114]
cmp eax, 3
jne 0x1005b20
push 0x100242c
jmp 0x1005b54
cmp eax, 4
jne 0x1005b2c
push 0x100240c
jmp 0x1005b54
cmp eax, ebx
jne 0x1005b37
push 0x10023f0
jmp 0x1005b54
cmp eax, 1
jne 0x1005b43
push 0x10023d4
jmp 0x1005b54
cmp eax, 2
jne 0x1005b4f
push 0x10023b8
jmp 0x1005b54
push 0x10023ac
push dword [esi + 0xc]
call fcn.010076a1
pop ecx
pop ecx
cmp edi, ebx
je 0x1005b6e
push edi
push 8
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esi + 0x114]
cmp eax, 3
je 0x1005b82
cmp eax, 2
jne 0x1005ca6
push 0x100239c
push dword [esi + 0xc]
call fcn.010076a1
pop ecx
pop ecx
push 0x100236c
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
lea eax, [esp + 0x38]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1005c97
lea eax, [esp + 0x14]
push eax
push ebx
lea eax, [esp + 0x20]
push eax
push ebx
mov ebx, 0x1002360
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1005bf5
push dword [esp + 0x14]
push 8
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1005c17
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1002350
push dword [esi + 0xc]
call fcn.010076a1
xor ebx, ebx
jmp 0x1005ca4
lea eax, [esp + 0x14]
push eax
push edi
lea eax, [esp + 0x20]
push eax
push 0
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [esp + 0x14], 0
je 0x1005c6e
lea eax, [esp + 0x14]
push eax
push edi
lea eax, [esp + 0x20]
push eax
push 0
push ebx
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1005c7d
mov ecx, dword [esi + 0xc]
push edi
call fcn.01007670
push edi
push 0x1002054
push dword [esi + 0xc]
call fcn.010076a1
add esp, 0xc
jmp 0x1005c7d
push 0x1002350
push dword [esi + 0xc]
call fcn.010076a1
pop ecx
pop ecx
push edi
push 8
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
jmp 0x1005ca6
push 0x1002350
push dword [esi + 0xc]
call fcn.010076a1
pop ecx
pop ecx
push 0x1002340
push dword [esi + 0xc]
call fcn.010076a1
pop ecx
pop ecx
lea eax, [esi + 0x10]
push eax
lea eax, [esp + 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1002328
lea eax, [esp + 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x80000000
lea eax, [esp + 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x24], edi
je 0x1005e72
push 0x10023ac
push dword [esi + 0xc]
call fcn.010076a1
pop ecx
pop ecx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
push edi
push 8
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebx
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x1005d44
push 0x10023ac
push dword [esi + 0xc]
call fcn.010076a1
pop ecx
pop ecx
push 0
lea eax, [esp + 0x2c]
push eax
push edi
push dword [esp + 0x28]
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1005e43
push 0x100231c
push dword [esp + 0x20]
call fcn.01009490
pop ecx
pop ecx
push edi
push 8
mov dword [esp + 0x28], eax
call ebp
push eax
call ebx
cmp dword [esp + 0x20], 0
mov edi, eax
je 0x1005e22
test edi, edi
je 0x1005e22
push 0x1002318
push dword [esp + 0x24]
call fcn.01009490
test eax, eax
pop ecx
pop ecx
je 0x1005e22
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [edi], 0x23
xor eax, eax
cmp byte [edi], 0x22
je 0x1005dc0
inc eax
cmp byte [eax + edi], 0x22
jne 0x1005db9
and byte [eax + edi], 0
mov eax, edi
xor ecx, ecx
lea edx, [eax + 1]
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x1005dcb
sub eax, edx
mov dword [esp + 0x20], eax
je 0x1005df8
mov al, byte [edi + ecx + 1]
mov byte [esp + ecx + 0x234], al
mov eax, edi
inc ecx
lea edx, [eax + 1]
mov bl, byte [eax]
inc eax
test bl, bl
jne 0x1005deb
sub eax, edx
cmp ecx, eax
jb 0x1005dda
mov ecx, dword [esi + 0xc]
lea eax, [esp + 0x234]
push eax
call fcn.01007670
lea eax, [esp + 0x234]
push eax
push 0x1002054
push dword [esi + 0xc]
call fcn.010076a1
add esp, 0xc
jmp 0x1005e31
push 0x10023ac
push dword [esi + 0xc]
call fcn.010076a1
pop ecx
pop ecx
test edi, edi
je 0x1005e52
push edi
push 8
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1005e52
push 0x10023ac
push dword [esi + 0xc]
call fcn.010076a1
pop ecx
pop ecx
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x1c], 0
je 0x1005e72
push dword [esp + 0x1c]
push 8
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebx, 0x94
push ebx
push 8
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x1005e9a
push 0x1002278
push dword [esi + 0xc]
call fcn.010076a1
pop ecx
pop ecx
jmp 0x1005eda
push edi
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0xc]
lea ebx, [edi + 0x14]
push ebx
call fcn.01007670
movzx eax, word [edi + 0xc]
push ebx
push dword [edi + 0x10]
push eax
push dword [edi + 8]
push dword [edi + 4]
push 0x10021f0
push dword [esi + 0xc]
call fcn.010076a1
add esp, 0x1c
push edi
push 8
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x328
ret