Function at 0x10006220
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x630
mov eax, dword [0x1000d004]
xor eax, esp
mov dword [esp + 0x62c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x63c]
lea ebx, [esp + 0x14]
push esi
push edi
mov dword [esp + 0x10], 0x105
call dword [sym.imp.kernel32.dll_GetSystemDefaultLangID]
movzx eax, ax
mov ecx, 0x411
cmp ax, cx
jne 0x10006265
mov eax, str.EUDC932
jmp 0x100062c9
mov ecx, 0x804
cmp ax, cx
je 0x100062c4
mov ecx, 0x1004
cmp ax, cx
je 0x100062c4
mov ecx, 0xc04
cmp ax, cx
je 0x100062bd
mov ecx, 0x404
cmp ax, cx
je 0x100062bd
mov ecx, 0x1404
cmp ax, cx
je 0x100062bd
mov ecx, 0x412
cmp ax, cx
jne 0x100062a8
mov eax, str.EUDC949
jmp 0x100062c9
mov ecx, 0x409
cmp ax, cx
jne 0x10006517
mov eax, str.EUDC1252
jmp 0x100062c9
mov eax, str.EUDC950
jmp 0x100062c9
mov eax, str.EUDC936
lea ecx, [esp + 0x14]
push ecx
push 0x20019
push 0
push eax
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10006517
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x20]
push eax
push 0
push str.SystemDefaultEUDCFont
push dword [esp + 0x28]
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
push dword [esp + 0x14]
mov esi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
shr eax, 1
mov dword [esp + 0x10], eax
test esi, esi
jne 0x10006517
cmp dword [esp + 0x18], 1
jne 0x10006517
cmp eax, 0x104
ja 0x10006517
xor ecx, ecx
mov word [esp + eax*2 + 0x1c], cx
lea eax, [esp + 0x1c]
push str._SystemRoot_
push eax
call sub.VCRUNTIME140.dll_wcsstr
lea ecx, [esp + 0x24]
add esp, 8
cmp eax, ecx
jne 0x1000642c
push str.SystemRoot
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x10006517
mov edx, ecx
lea esi, [edx + 2]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10006380
mov eax, dword [esp + 0x10]
sub edx, esi
sar edx, 1
add eax, 0xfffffff4
add eax, edx
cmp eax, 0x104
ja 0x10006517
lea edx, [esp + 0x228]
sub edx, ecx
nop dword [eax]
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x100063b0
lea edx, [esp + 0x34]
mov esi, edx
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x100063c6
lea edi, [esp + 0x228]
sub edx, esi
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100063e0
mov ecx, edx
lea ebx, [esp + 0x228]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006406
mov eax, dword [ebp]
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov dword [esp + 0x18], ecx
mov eax, dword [eax + 0x28c]
push ebp
call eax
jmp 0x10006519
mov ecx, str.EUDC.TTE
lea eax, [esp + 0x1c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000645b
test dx, dx
je 0x10006457
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000645b
add eax, 4
add ecx, 4
test dx, dx
jne 0x10006435
xor eax, eax
jmp 0x10006460
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10006503
push 0x104
lea eax, [esp + 0x438]
push eax
call dword [sym.imp.kernel32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x10006517
add eax, 0x10
cmp eax, 0x104
ja 0x10006517
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
movzx eax, word [esp + ecx + 0x434]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x1a], ax
test ax, ax
jne 0x100064a0
lea edi, [esp + 0x1c]
add edi, 0xfffffffe
nop dword [eax]
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x100064c0
mov ecx, 8
mov esi, str.FONTSEUDC.TTE
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x1c]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100064e0
mov eax, dword [ebp]
sub ecx, edx
sar ecx, 1
push ecx
push ebx
mov dword [esp + 0x18], ecx
mov eax, dword [eax + 0x28c]
push ebp
call eax
jmp 0x10006519
mov ecx, dword [esp + 0x10]
mov eax, dword [ebp]
push ecx
push ebx
push ebp
mov eax, dword [eax + 0x28c]
call eax
jmp 0x10006519
xor eax, eax
mov ecx, dword [esp + 0x63c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10007003
add esp, 0x630
ret 8