Function at 0x1002470d
Capabilities:
Check if file exists
Enumerate files on windows
Get system information on windows
Query or enumerate registry value
Read file via mapping
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x1003b164]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
cmp esi, edi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x14], edi
jne 0x1002474a
push 0x28a
push 0x10004ac0
push 0x100249dc
call fcn.100280bc
mov eax, dword [ebp + 8]
cmp eax, edi
je 0x10024756
cmp word [eax], di
jne 0x1002476a
push 0x28d
push 0x10004ac0
push 0x100249b0
call fcn.100280bc
cmp dword [0x1003b4b0], edi
jne 0x100249ec
push 0x10004b70
push 1
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
cmp eax, edi
mov dword [0x1003b4b0], eax
je 0x100249ec
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [ebp - 0x40]
push edi
push edi
push 4
push dword [0x1003b4b0]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x1003b4b4], eax
cmp eax, edi
je 0x1002480a
cmp dword [ebp + 0x14], edi
mov ecx, dword [eax + 0x10]
lea ebx, [esi + 8]
mov dword [ebx], ecx
mov eax, dword [eax + 0x14]
mov dword [ebx + 4], eax
jne 0x100249f6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, dword [0x1003b4b4]
sub ecx, dword [eax + 0xc]
cmp ecx, 0x1d4c0
jb 0x100249f6
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [0x1003b4b0]
mov dword [0x1003b4b4], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1003b4b0], edi
cmp dword [ebp + 0x10], edi
jne 0x10024866
cmp dword [ebp + 0x14], edi
jne 0x10024866
lea eax, [ebp - 0x10]
push eax
push 0x20019
push edi
push 0x10004ba8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10024866
lea eax, [ebp - 0x20]
push eax
lea ebx, [esi + 8]
push ebx
push edi
push edi
push 0x10004b8c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], edi
je 0x100248ef
mov dword [ebp - 0x14], 1
push dword [ebp + 8]
lea ebx, [esi + 8]
mov dword [ebx], edi
mov dword [ebx + 4], edi
call dword [sym.imp.msvcrt.dll_wcslen]
mov esi, eax
lea eax, [esi + esi + 0x26]
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.10001a44
lea eax, [esi + esi]
mov esi, dword [ebp + 8]
mov ecx, eax
mov edx, ecx
shr ecx, 2
mov edi, esp
mov dword [ebp - 8], edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, esp
lea edi, [eax + ecx]
push 9
pop ecx
mov esi, 0x10024988
rep movsd dword es:[edi], dword [esi]
mov eax, 0x250
movsw word es:[edi], word [esi]
call fcn.10001a44
mov esi, esp
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x10024a28
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x10024a1c
and dword [ebp - 0xc], 0
mov esi, dword [ebp + 0xc]
xor edi, edi
mov eax, dword [ebx]
or eax, dword [ebx + 4]
jne 0x10024901
xor eax, eax
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebx], eax
mov dword [ebx + 4], edi
push dword [ebx + 4]
lea eax, [esi + 0x54]
push dword [ebx]
push dword [ebp + 8]
push 0x104
push eax
call fcn.10024162
push dword [esi + 4]
push dword [esi]
add esi, 0x10
push dword [ebx + 4]
push dword [ebx]
push 0x20
push esi
call fcn.10023edb
cmp dword [ebp - 0x14], edi
je 0x10024971
cmp dword [ebp - 0xc], edi
jne 0x10024971
lea eax, [ebp - 0x10]
push eax
push 0x20006
push edi
push 0x10004ba8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10024971
push 8
push ebx
push 3
push edi
push 0x10004b8c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
lea esp, [ebp - 0x50]
mov ecx, dword [ebp - 4]
call fcn.10023cf0
pop edi
pop esi
pop ebx
leave
ret 0x10
mov eax, dword [0x1003b4b4]
jmp 0x100247b4
cmp dword [ebp + 0x10], edi
jne 0x10024866
cmp dword [ebx + 4], edi
jg 0x100248ef
jl 0x1002480a
cmp dword [ebx], 1
jbe 0x1002480a
jmp 0x100248ef
mov dword [ebp - 0xc], 0x80110474
jmp 0x10024971
lea eax, [esi + 0x2c]
push eax
call fcn.1002773b
mov edi, dword [ebx + 4]
mov ecx, eax
mov eax, edx
mov edx, dword [ebx]
mov dword [ebp - 0x1c], ecx
sub ecx, edx
mov dword [ebp - 0x18], eax
sbb eax, edi
js 0x10024a5a
jg 0x10024a4c
test ecx, ecx
jbe 0x10024a5a
cmp eax, 0x7fff
jl 0x10024a6c
jg 0x10024a5a
cmp ecx, 0xffffffff
jb 0x10024a6c
cmp eax, 0xffff8000
jl 0x10024a6c
jg 0x10024a68
cmp ecx, 1
jb 0x10024a6c
or edx, edi
jne 0x10024aa5
mov eax, dword [ebp - 0x1c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x18]
mov dword [ebx + 4], eax
mov ecx, dword [esi + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov ecx, dword [esi + 0x18]
mov dword [eax + 4], ecx
mov ecx, dword [esi + 0x20]
mov dword [eax + 0x50], ecx
cmp dword [esi + 0x1c], 0
je 0x10024aa5
push 0x309
push 0x10004ac0
push 0x10024ac8
call fcn.100280bc
push esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10024a28
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x100248ea