Function at 0x1002457
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x1011024]
push ebx
push esi
push edi
push 0x17
pop ecx
mov esi, 0x10012d0
lea edi, [ebp - 0x604]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
movsw word es:[edi], word [esi]
push 0x68
pop ecx
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x818], eax
xor eax, eax
push 0x7e
xor ebx, ebx
lea edi, [ebp - 0x5a6]
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 0x204], ebx
lea edi, [ebp - 0x200]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7e
pop ecx
xor eax, eax
mov dword [ebp - 0x804], ebx
lea edi, [ebp - 0x800]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x804]
push eax
mov dword [ebp - 0x810], ebx
mov dword [ebp - 0x80c], ebx
mov dword [ebp - 0x814], 0xff
call esi
push 0x7e
mov dword [ebp - 0x404], ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x400]
rep stosd dword es:[edi], eax
push 0x1fc
stosw word es:[edi], ax
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
cmp edi, ebx
pop ecx
mov dword [ebp - 0x808], edi
je 0x1002685
push dword [ebp - 0x818]
call esi
test eax, eax
lea eax, [ebp - 0x204]
je 0x1002548
push 0x10012c4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x818]
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x1002555
push dword [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x80c]
push eax
push 0x80000002
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
test eax, eax
jne 0x1002671
lea eax, [ebp - 0x810]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x604]
push eax
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002671
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x814]
push eax
push edi
push ebx
push ebx
mov edi, 0x10012ac
push edi
push dword [ebp - 0x810]
call esi
cmp eax, 0xea
jne 0x10025f3
mov eax, dword [ebp - 0x814]
add eax, eax
push eax
push dword [ebp - 0x808]
call dword [sym.imp.msvcrt.dll_realloc]
pop ecx
pop ecx
lea ecx, [ebp - 0x814]
push ecx
push eax
push ebx
push ebx
push edi
push dword [ebp - 0x810]
mov dword [ebp - 0x808], eax
call esi
cmp eax, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x810]
je 0x100261d
call esi
push dword [ebp - 0x80c]
call esi
cmp dword [ebp - 0x808], ebx
je 0x1002685
push dword [ebp - 0x808]
jmp 0x100267e
call esi
push dword [ebp - 0x80c]
call esi
push 0x10012a4
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x808]
call dword [sym.imp.msvcrt.dll_wcsstr]
mov esi, eax
neg esi
sbb esi, esi
neg esi
inc esi
pop ecx
inc esi
cmp dword [ebp - 0x808], ebx
pop ecx
je 0x100266d
push dword [ebp - 0x808]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, esi
jmp 0x1002688
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
push 4
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100b77c
leave
ret 4