Function at 0x1002d390
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x930
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov dword [ebp - 0x930], ecx
mov word [ebp - 0x88], 0
push 0x3e
push 0
lea eax, [ebp - 0x86]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov ecx, 0x11
mov esi, str.C:WindowsSystem32ConfigSystem
lea edi, [ebp - 0x2d0]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x10
mov esi, str.C:WinNTSystem32ConfigSystem
lea edi, [ebp - 0x318]
rep movsd dword es:[edi], dword [esi]
mov cx, word [ebp + 8]
mov word [ebp - 0x2d0], cx
push str.C:Windows
lea edx, [ebp - 0x88]
push edx
call dword [sym.imp.ntdll.dll_wcscpy]
add esp, 8
mov ax, word [ebp + 8]
mov word [ebp - 0x88], ax
lea ecx, [ebp - 0x2d0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1002d46e
mov dx, word [ebp + 8]
mov word [ebp - 0x318], dx
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1002d467
push str.C:WinNT
lea ecx, [ebp - 0x88]
push ecx
call dword [sym.imp.ntdll.dll_wcscpy]
add esp, 8
mov dx, word [ebp + 8]
mov word [ebp - 0x88], dx
jmp 0x1002d46e
xor eax, eax
jmp 0x1002d6b0
mov word [ebp - 0x288], 0
push 0x1fe
push 0
lea eax, [ebp - 0x286]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x88]
push ecx
push str._sSystem32ConfigSystem
lea edx, [ebp - 0x288]
push edx
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0xc
mov word [ebp - 0x48], 0
push 0x3e
push 0
lea eax, [ebp - 0x46]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x31c], 1
jmp 0x1002d4da
mov ecx, dword [ebp - 0x31c]
add ecx, 1
mov dword [ebp - 0x31c], ecx
cmp dword [ebp - 0x31c], 0xa
jg 0x1002d517
mov edx, dword [ebp - 0x31c]
push edx
push str.TempSystem_d
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0xc
lea ecx, [ebp - 0x288]
push ecx
lea edx, [ebp - 0x48]
push edx
call fcn.1002c420
add esp, 8
test eax, eax
je 0x1002d515
jmp 0x1002d517
jmp 0x1002d4cb
mov dword [ebp - 0x2d4], 0
mov word [ebp - 0x520], 0
push 0x1fe
push 0
lea eax, [ebp - 0x51e]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x48]
push ecx
push str._sControlSet002ControlProductOptions
lea edx, [ebp - 0x520]
push edx
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0xc
mov word [ebp - 0x928], 0
push 0x1fe
push 0
lea eax, [ebp - 0x926]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x48]
push ecx
push str._sControlSet001ControlProductOptions
lea edx, [ebp - 0x928]
push edx
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0xc
mov dword [ebp - 0x528], 0
lea eax, [ebp - 0x528]
push eax
push 0x101
push 0
lea ecx, [ebp - 0x520]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0
je 0x1002d5f9
lea edx, [ebp - 0x528]
push edx
lea eax, [ebp - 0x928]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0
je 0x1002d5f9
xor eax, eax
jmp 0x1002d6b0
mov dword [ebp - 0x92c], 0
mov word [ebp - 0x728], 0
push 0x1fe
push 0
lea ecx, [ebp - 0x726]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x524], 0x200
lea edx, [ebp - 0x524]
push edx
lea eax, [ebp - 0x728]
push eax
lea ecx, [ebp - 0x92c]
push ecx
push 0
push str.ProductType
mov edx, dword [ebp - 0x528]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.LanmanNT
lea eax, [ebp - 0x728]
push eax
call dword [sym.imp.ntdll.dll_wcscmp]
add esp, 8
test eax, eax
je 0x1002d687
push str.ServerNT
lea ecx, [ebp - 0x728]
push ecx
call dword [sym.imp.ntdll.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x1002d691
mov dword [ebp - 0x2d4], 1
mov edx, dword [ebp - 0x528]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x48]
push eax
call fcn.1002c3b0
add esp, 4
mov eax, dword [ebp - 0x2d4]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret 4