Function at 0x10027ca4
Capabilities:
Enumerate files on windows
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x894
mov eax, dword [0x1003b164]
and dword [ebp - 0x874], 0
push ebx
push esi
push edi
push dword [0x1003c100]
mov edi, dword [sym.imp.msvcrt.dll_wcscpy]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
push eax
call edi
push dword [0x1003c100]
call dword [sym.imp.msvcrt.dll_wcslen]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
add esp, 0xc
cmp word [ebp + eax*2 - 0x20e], 0x5c
mov dword [ebp - 0x88c], eax
je 0x10027d10
push 0x100026fc
lea eax, [ebp - 0x20c]
push eax
call esi
inc dword [ebp - 0x88c]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push eax
call edi
add esp, 0x10
push 0x10027f18
lea eax, [ebp - 0x61c]
push eax
call esi
or dword [ebp - 0x870], 0xffffffff
and dword [ebp - 0x888], 0
cmp dword [ebp - 0x870], 0xffffffff
lea eax, [ebp - 0x86c]
push eax
jne 0x10027f1c
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x870], eax
cmp dword [ebp - 0x870], 0xffffffff
je 0x10027ef3
mov esi, dword [sym.imp.msvcrt.dll_wcscmp]
lea eax, [ebp - 0x840]
push eax
push 0x10002b88
call esi
test eax, eax
pop ecx
pop ecx
je 0x10027ed4
lea eax, [ebp - 0x840]
push eax
push 0x10002b80
call esi
test eax, eax
pop ecx
pop ecx
je 0x10027ed4
xor eax, eax
cmp dword [ebp - 0x874], eax
jne 0x10027de4
lea ecx, [ebp - 0x874]
push ecx
push eax
push eax
push 0x10004dc0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10027ee7
mov ebx, dword [ebp - 0x88c]
lea eax, [ebp - 0x840]
push eax
add ebx, ebx
lea eax, [ebp + ebx - 0x20c]
push eax
call edi
pop ecx
pop ecx
push 4
pop esi
lea ecx, [ebp - 0x880]
push ecx
lea ecx, [ebp - 0x878]
push ecx
xor eax, eax
lea ecx, [ebp - 0x87c]
push ecx
push eax
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x87c], eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x874]
mov dword [ebp - 0x880], esi
mov dword [ebp - 0x890], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10027e5d
cmp dword [ebp - 0x87c], esi
jne 0x10027e5d
cmp dword [ebp - 0x880], esi
je 0x10027e6e
and dword [ebp - 0x890], 0
mov dword [ebp - 0x878], 1
cmp dword [ebp + 8], 0
jne 0x10027f55
mov ebx, dword [sym.imp.ole32.dll_CoTaskMemAlloc]
push 0xc
call ebx
xor ecx, ecx
cmp eax, ecx
je 0x10027f4e
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov esi, eax
cmp esi, ecx
je 0x10027ee7
mov eax, dword [ebp - 0x878]
mov dword [esi + 4], eax
lea eax, [ebp - 0x840]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
call ebx
test eax, eax
mov dword [esi], eax
je 0x10028026
lea ecx, [ebp - 0x840]
push ecx
push eax
call edi
pop ecx
pop ecx
push esi
call fcn.10027967
inc dword [ebp - 0x888]
cmp dword [ebp - 0x888], 0x64
jb 0x10027d4f
push dword [ebp - 0x870]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x874], 0
pop edi
pop esi
pop ebx
je 0x10027f0b
push dword [ebp - 0x874]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
call fcn.10023cf0
leave
ret 4
push dword [ebp - 0x870]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10027d76
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x870]
call dword [sym.imp.KERNEL32.dll_FindClose]
or dword [ebp - 0x870], 0xffffffff
jmp 0x10027d76
xor esi, esi
jmp 0x10027e96
cmp dword [ebp + 8], 1
jne 0x10027ed4
mov esi, dword [0x1003c0fc]
and dword [ebp - 0x894], 0
test esi, esi
je 0x10027f9e
lea ebx, [ebp + ebx - 0x414]
push dword [esi]
push ebx
call edi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.msvcrt.dll_wcscmp]
add esp, 0x10
test eax, eax
je 0x10028004
mov esi, dword [esi + 8]
test esi, esi
jne 0x10027f77
and dword [ebp - 0x884], 0
cmp dword [ebp - 0x894], 0
je 0x10028010
mov eax, dword [esi + 4]
inc eax
cmp eax, dword [ebp - 0x878]
mov dword [ebp - 0x884], eax
sbb eax, eax
neg eax
test eax, eax
je 0x10027ed4
cmp dword [ebp - 0x890], 0
je 0x10027ed4
push dword [ebp - 0x880]
lea eax, [ebp - 0x884]
push eax
push dword [ebp - 0x87c]
lea eax, [ebp - 0x20c]
push 0
push eax
push dword [ebp - 0x874]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10027ed4
mov dword [ebp - 0x894], 1
jmp 0x10027f9e
xor ecx, ecx
inc ecx
xor eax, eax
cmp dword [ebp - 0x878], ecx
mov dword [ebp - 0x884], ecx
setne al
jmp 0x10027fc2
push 1
mov ecx, esi
call fcn.10027c5c
jmp 0x10027ee7