Function at 0x10002bd0
Capabilities:
Enumerate files on windows
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xf24]
sub esp, 0xfa4
mov eax, dword [0x10024b00]
xor eax, ebp
mov dword [ebp + 0xf20], eax
push esi
xor esi, esi
mov byte [ecx + 0x54], 1
mov dword [ebp - 0x54], ecx
cmp dword [0x10025b68], esi
jne 0x10002c0e
call fcn.100010ac
cmp dword [0x10025b68], esi
je 0x10002f4f
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push str.LanguageID
push dword [0x10025b68]
mov dword [ebp - 0x44], 4
call edi
test eax, eax
jne 0x10002f4e
movzx eax, word [ebp - 0x58]
push 9
mov dword [ebp - 0x50], eax
pop eax
cmp ax, word [ebp - 0x58]
je 0x10002f4e
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp + 0xc18]
push eax
push esi
push esi
push str.ExePath
push dword [0x10025b68]
mov dword [ebp - 0x44], 0x104
call edi
test eax, eax
jne 0x10002f4e
lea eax, [ebp + 0x214]
push eax
lea eax, [ebp + 0x114]
push eax
lea eax, [ebp + 0xe20]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 0xc18]
push eax
call fcn.1000f5cc
lea eax, [ebp + 0xe20]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 0xd1c]
push str._s_sLanguagesidm_.lng
push eax
call fcn.1000f35d
add esp, 0x24
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp + 0xd1c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x4c], eax
cmp eax, 0xffffffff
je 0x10002f4e
push ebx
lea eax, [ebp]
push eax
lea eax, [ebp + 0xe20]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp + 0xb14]
push str._s_sLanguages_s
push eax
call fcn.1000f35d
lea eax, [ebp + 0xb14]
push 0x1001daf0
push eax
call fcn.1000f346
add esp, 0x1c
mov dword [ebp - 0x38], eax
cmp eax, esi
je 0x10002f2f
push eax
mov ebx, 0x800
lea eax, [ebp + 0x314]
push ebx
push eax
call fcn.1000f13a
add esp, 0xc
test eax, eax
je 0x10002f26
xor edi, edi
cmp byte [ebp + 0x314], 0xef
mov dword [ebp - 0x40], esi
jne 0x10002d61
cmp byte [ebp + 0x315], 0xbb
jne 0x10002d61
cmp byte [ebp + 0x316], 0xbf
jne 0x10002d61
push 3
pop edi
mov dword [ebp - 0x40], 1
push 4
lea eax, [ebp + edi + 0x314]
push str.lang
push eax
call fcn.1000daba
add esp, 0xc
test eax, eax
jne 0x10002f26
lea eax, [ebp + edi + 0x318]
push 0x3d
push eax
call fcn.1000be60
pop ecx
pop ecx
cmp eax, esi
je 0x10002f26
lea ecx, [ebp - 0x60]
push ecx
inc eax
push 0x1001dae4
push eax
call fcn.1000da98
add esp, 0xc
cmp eax, 1
jne 0x10002f26
movzx edx, word [ebp - 0x50]
cmp edx, dword [ebp - 0x60]
jne 0x10002f26
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x40], esi
jne 0x10002e00
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x7c]
mov dword [ebp - 0x80], esi
rep stosd dword es:[edi], eax
mov eax, 0x400
cmp word [ebp - 0x50], ax
ja 0x10002de4
add edx, eax
push 0x1000
lea eax, [ebp - 0x80]
push eax
push edx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
test eax, eax
je 0x10002e07
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x34], eax
jmp 0x10002e07
mov dword [ebp - 0x34], 0xfde9
push dword [ebp - 0x38]
push ebx
jmp 0x10002f0f
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x314]
push 0x1001dae0
push eax
mov dword [ebp - 0x48], esi
call fcn.1000da98
add esp, 0xc
cmp eax, 1
jne 0x10002f07
lea eax, [ebp + 0x314]
push 0x3d
push eax
call fcn.1000be60
pop ecx
pop ecx
cmp eax, esi
je 0x10002f07
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x40], esi
jne 0x10002efb
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push esi
push esi
push 0xffffffffffffffff
push eax
push esi
push dword [ebp - 0x34]
call edi
mov dword [ebp - 0x30], eax
cmp eax, esi
je 0x10002f07
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov ebx, eax
cmp ebx, esi
je 0x10002f07
push dword [ebp - 0x30]
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x5c]
push esi
push dword [ebp - 0x34]
call edi
test eax, eax
je 0x10002ef2
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push ebx
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
cmp edi, esi
jle 0x10002ef2
lea eax, [edi + 1]
push eax
call fcn.1000cbf8
pop ecx
mov dword [ebp - 0x30], eax
cmp eax, esi
je 0x10002ef2
push esi
push esi
push edi
push eax
push 0xffffffffffffffff
push ebx
push esi
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x10002ee9
push dword [ebp - 0x30]
mov ecx, dword [ebp - 0x54]
push dword [ebp - 0x48]
call fcn.100025ee
push dword [ebp - 0x30]
call fcn.1000be36
pop ecx
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x10002f07
mov ecx, dword [ebp - 0x54]
push eax
push dword [ebp - 0x48]
call fcn.100025ee
push dword [ebp - 0x38]
push 0x800
lea eax, [ebp + 0x314]
push eax
call fcn.1000f13a
add esp, 0xc
test eax, eax
jne 0x10002e10
push dword [ebp - 0x38]
call fcn.1000d9b2
pop ecx
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10002cda
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
pop edi
mov ecx, dword [ebp + 0xf20]
xor ecx, ebp
pop esi
call fcn.1000c94b
add ebp, 0xf24
leave
ret