Function at 0x10002e6b
Capabilities:
Query or enumerate registry value
Read file via mapping

Disassembly:
push ebp
lea ebp, [esp - 0x7d0]
sub esp, 0x850
mov eax, dword [0x1001b0f8]
push ebx
push esi
push edi
mov esi, 0x420
push esi
mov dword [ebp + 0x7cc], eax
xor edi, edi
lea eax, [ebp - 0x70]
push edi
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp + 0x4b4]
push eax
call fcn.10002a85
add esp, 0x10
lea eax, [ebp + 0x4b4]
push eax
push esi
push edi
push 4
push edi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push edi
push edi
push edi
push 0xf001f
push eax
mov dword [ebp - 0x74], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, edi
je 0x10002ee9
push esi
lea eax, [ebp - 0x70]
push ebx
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + 0x2a0]
push eax
call ebx
test eax, eax
je 0x10002f25
push dword [ebp + 0x7dc]
lea eax, [ebp + 0x2a0]
push dword [ebp + 0x7d8]
push eax
call fcn.10002d3d
add esp, 0xc
jmp 0x100030df
push str.setupapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
mov dword [ebp - 0x80], eax
je 0x100030df
push str.IsUserAdmin
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
lea eax, [ebp + 0x3b0]
push eax
call fcn.10002d99
lea eax, [ebp + 0x5b8]
mov dword [esp], str.SOFTWAREMicrosoft_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp + 0x3b0]
push eax
lea eax, [ebp + 0x5b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x78]
push eax
push 0x20019
lea eax, [ebp + 0x5b8]
push edi
push eax
call esi
neg eax
sbb eax, eax
neg eax
add eax, 0x80000001
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100030d6
mov eax, pe_nt_image_headers32
push eax
mov dword [ebp - 0x74], eax
lea eax, [ebp + 0x6bc]
push edi
push eax
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
add esp, 0xc
push 0x100135b4
push dword [ebp + 0x7d8]
call esi
test eax, eax
jne 0x10003097
push str.resid
push dword [ebp + 0x7d8]
call esi
test eax, eax
jne 0x10003097
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x6bc]
push eax
push edi
push edi
push edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x100135a4
push dword [ebp + 0x7d8]
call esi
test eax, eax
lea eax, [ebp + 0x6bc]
je 0x1000305f
push eax
call ebx
cmp eax, 0x21
jl 0x100030d6
push 0x10013594
lea eax, [ebp + 0x6bc]
push eax
call esi
lea ecx, [ebp + 0x6bc]
sub eax, ecx
cmp eax, 0x20
jne 0x100030d6
push 0x21
mov eax, ecx
push eax
push dword [ebp + 0x7dc]
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
jmp 0x100030d6
mov edi, 0x10013594
push edi
push eax
call esi
lea ecx, [ebp + 0x6bc]
sub ecx, eax
lea eax, [ebp + 0x6bc]
push eax
mov dword [ebp - 0x7c], ecx
call ebx
mov ecx, dword [ebp - 0x7c]
lea eax, [ecx + eax - 1]
cmp eax, 0x20
jne 0x100030d6
push 0x21
push edi
lea eax, [ebp + 0x6bc]
push eax
call esi
inc eax
jmp 0x10003050
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0x6bc]
push eax
push edi
push edi
push 0x1001359c
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp + 0x7dc]
lea eax, [ebp + 0x6bc]
push dword [ebp + 0x7d8]
push eax
call fcn.10002d3d
add esp, 0xc
push dword [ebp - 0x80]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp + 0x7cc]
pop edi
pop esi
pop ebx
call fcn.100112e6
add ebp, 0x7d0
leave
ret