Function at 0x100029e3
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
lea eax, [ebp - 0x234]
mov dword [ebp - 0x18], eax
push 0x1002cd84
lea ecx, [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x5c
lea edx, [ebp - 0x234]
push edx
call fcn.10003280
add esp, 8
mov dword [ebp - 0x1c], eax
push 0x1002d0b8
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x14], ecx
push 0x5c
mov edx, dword [ebp - 0x14]
push edx
call fcn.100032a0
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x10002a64
push 0x1002d0bc
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x10002a71
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], 0
push str.HKEY_CLASSES_ROOT
mov eax, dword [ebp - 0x18]
push eax
call fcn.10003250
add esp, 8
test eax, eax
jne 0x10002a8f
mov dword [ebp - 4], 0x80000000
jmp 0x10002ad2
push str.HKEY_CURRENT_USER
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.10003250
add esp, 8
test eax, eax
jne 0x10002aad
mov dword [ebp - 4], 0x80000001
jmp 0x10002ad2
push str.HKEY_USERS
mov edx, dword [ebp - 0x18]
push edx
call fcn.10003250
add esp, 8
test eax, eax
jne 0x10002acb
mov dword [ebp - 4], 0x80000003
jmp 0x10002ad2
mov dword [ebp - 4], 0x80000002
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 8], 0
jne 0x10002b0a
push 0x105
push 0
push 0x1002cfac
call fcn.1000e030
add esp, 0xc
jmp 0x10002d4a
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x238], 0x105
lea eax, [ebp - 0x238]
push eax
push 0x1002cfac
lea ecx, [ebp - 0x10]
push ecx
push 0
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10002d2c
push 0x1002cfac
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x10002d2c
push 0x1002cfac
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 0xf0
jg 0x10002d2c
push 0x1002cfac
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x10002d2c
push 0x1002cfac
call dword [sym.imp.KERNEL32.dll_lstrlenA]
movsx ecx, byte [eax + 0x1002cfab]
cmp ecx, 0x5c
jne 0x10002ba9
push 0x1002cfac
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov byte [eax + 0x1002cfab], 0
mov edx, dword [ebp + 8]
and edx, 0xff
cmp edx, 1
jne 0x10002c4f
cmp dword [0x1002c530], 1
jne 0x10002c08
push 0x100253bc
push str.EpsStmApi3
push 0x1002cfac
push 0x100253d0
push 0x1002cb64
call fcn.1000e682
add esp, 0x14
push 0x100253d8
push str.EpsStmApi3_BAK
push 0x1002cfac
push 0x100253f0
push 0x1002ca5c
call fcn.1000e682
add esp, 0x14
jmp 0x10002c4a
push 0x100253f8
push 0x10025400
push 0x1002cfac
push 0x1002540c
push 0x1002cb64
call fcn.1000e682
add esp, 0x14
push 0x10025414
push str.EpsStmApi_BAK
push 0x1002cfac
push 0x1002542c
push 0x1002ca5c
call fcn.1000e682
add esp, 0x14
jmp 0x10002d20
cmp dword [0x1002c530], 1
jne 0x10002cbd
push 0x10025434
push 0x1002543c
push 0x1002cfac
push 0x10025448
push 0x1002cb64
call fcn.1000e682
add esp, 0x14
push 0x10025450
push str.EpsStmMon3_BAK
push 0x1002cfac
push 0x10025468
push 0x1002ca5c
call fcn.1000e682
add esp, 0x14
push 0x10025470
push str.EpsStmMon3
push 0x1002cfac
push 0x10025484
push 0x1002c954
call fcn.1000e682
add esp, 0x14
jmp 0x10002d20
push 0x1002548c
push 0x10025494
push 0x1002cfac
push 0x100254a0
push 0x1002cb64
call fcn.1000e682
add esp, 0x14
push str..log
push str.EpsStmMon_BAK
push 0x1002cfac
push 0x100254c0
push 0x1002ca5c
call fcn.1000e682
add esp, 0x14
push str..bin
push str.EpsStmMon
push 0x1002cfac
push str._s_s_s
push 0x1002c954
call fcn.1000e682
add esp, 0x14
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10002d4a
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x105
push 0
push 0x1002cfac
call fcn.1000e030
add esp, 0xc
mov esp, ebp
pop ebp
ret