Function at 0x10026d20
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x4048
call fcn.1003baf0
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x4044], eax
mov eax, dword [esp + 0x404c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x4060]
push 0x1000
mov dword [esp + 0x28], eax
lea eax, [esp + 0x58]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x1000
lea eax, [esp + 0x2064]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push 0x1000
lea eax, [esp + 0x1070]
mov dword [esp + 0x3c], 0x800
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x24
mov dword [esp + 0x30], 0
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], 0
mov ebx, 0x800
mov dword [esp + 0x38], 0
push 0x20019
push str.SOFTWAREMozillaMozilla_Firefox
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10003a10
mov ebp, dword [esp + 0x30]
test eax, eax
je 0x10026ddd
mov ebx, 1
jmp 0x100273ea
lea eax, [esp + 0x14]
mov dword [esp + 0x2c], 0
push eax
push 0
push 0
push 0
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x2068]
push eax
push 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x100273d3
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [esp + 0x54]
push eax
call fcn.10003ca0
lea eax, [esp + 0x2058]
push eax
push str.SOFTWAREMozillaMozilla_Firefox_sMain
lea eax, [esp + 0x60]
push 0x800
push eax
call fcn.10005d50
mov esi, dword [esp + 0x4c]
add esp, 0x14
mov dword [esp + 0x1c], 0
test esi, esi
je 0x10026ea3
cmp dword [esi], 0
je 0x10026e96
push 0x1003e9d0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
jne 0x10026e68
mov eax, 1
jmp 0x10026ebf
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x10026e9c
push 0
push dword [esi]
lea ecx, [esp + 0x24]
push ecx
push 0x20019
push 0
lea ecx, [esp + 0x68]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x10026ebf
cmp dword [esi + 4], 0
jne 0x10026ea3
mov eax, 1
jmp 0x10026ebf
lea eax, [esp + 0x1c]
push eax
push 0x20019
push 0
lea eax, [esp + 0x60]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10026f25
test ebp, ebp
je 0x10026ece
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x1c]
test eax, eax
jne 0x10026f25
lea eax, [ebx + ebx]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x44]
push eax
push 0
push str.Install_Directory
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10026f25
mov eax, dword [esp + 0x3c]
cmp eax, 1
je 0x10026f0c
cmp eax, 2
jne 0x10026f25
mov ebx, dword [esp + 0x10]
test ebx, ebx
je 0x10026f2c
test bl, 1
jne 0x10026f25
mov eax, ebx
shr eax, 1
cmp word [esp + eax*2 + 0x52], 0
je 0x10026f33
xor ebx, ebx
jmp 0x100273ea
xor eax, eax
mov word [esp + 0x54], ax
push str.plugins
lea eax, [esp + 0x58]
shr ebx, 1
push eax
push str._s_s
lea eax, [esp + 0x1060]
push 0x800
push eax
call fcn.10005d50
push 0xc
call fcn.1003b014
mov esi, eax
add esp, 0x18
test esi, esi
je 0x10026f8e
lea eax, [esp + 0x1054]
mov dword [esi + 4], 0
push eax
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x10027410
jmp 0x10026f90
xor esi, esi
mov dword [esp + 0x10], esi
test esi, esi
je 0x10027410
push 0xc
call fcn.1003b014
mov esi, eax
add esp, 4
test esi, esi
je 0x10026fd1
push 0x1003e9cc
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x10027410
jmp 0x10026fd3
xor esi, esi
mov dword [esp + 0x14], esi
test esi, esi
je 0x10027410
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.10003700
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x10027029
mov eax, dword [esi]
test eax, eax
je 0x10027007
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1002701e
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003b014
add esp, 8
push 0xc
call fcn.1003b014
mov esi, eax
add esp, 4
test esi, esi
je 0x1002705e
push str.npDeployJava1.dll
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x10027410
jmp 0x10027060
xor esi, esi
mov dword [esp + 0x14], esi
test esi, esi
je 0x10027410
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.10003700
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x100270b6
mov eax, dword [esi]
test eax, eax
je 0x10027094
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100270ab
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003b014
add esp, 8
mov esi, dword [esp + 0x10]
test esi, esi
je 0x100270c2
mov edi, dword [esi]
jmp 0x100270c4
xor edi, edi
lea eax, [esp + 0x48]
mov dword [esp + 0x48], 0
push eax
push edi
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
call fcn.100298b0
add esp, 8
test eax, eax
je 0x10027178
xor eax, eax
mov ecx, dword [esp + 0x24]
mov ecx, dword [ecx + eax*4]
cmp ecx, dword [esp + eax*4 + 0x48]
ja 0x10027109
jb 0x10027178
inc eax
cmp eax, 3
jl 0x100270f4
push 0x1000
lea eax, [esp + 0x3058]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
push dword [esp + 0x5c]
mov eax, dword [esp + 0x34]
push dword [esp + 0x5c]
push dword [esp + 0x5c]
push edi
push dword [eax + 8]
push dword [eax + 4]
push dword [eax]
lea eax, [esp + 0x307c]
push str.curVersion:__d__d__d_Delete_File__s_version__d__d__d
push 0x800
push eax
call fcn.10005d50
lea eax, [esp + 0x3088]
push eax
call fcn.10003ca0
push 0
push 0
push 0
push 0
push edi
push 0
push 1
push 2
push dword [esp + 0x80]
call fcn.10026620
add esp, 0x5c
test esi, esi
je 0x100271c0
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x100271c0
mov eax, dword [esi]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
test eax, eax
je 0x1002719c
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100271b3
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003b014
add esp, 8
jmp 0x100271c6
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
push 0xc
call fcn.1003b014
mov esi, eax
add esp, 4
test esi, esi
je 0x100271fe
lea eax, [esp + 0x1054]
mov dword [esi + 4], 0
push eax
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x10027410
jmp 0x10027200
xor esi, esi
mov dword [esp + 0x10], esi
test esi, esi
je 0x10027410
push 0xc
call fcn.1003b014
mov esi, eax
add esp, 4
test esi, esi
je 0x10027241
push 0x1003e9cc
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x10027410
jmp 0x10027243
xor esi, esi
mov dword [esp + 0x14], esi
test esi, esi
je 0x10027410
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.10003700
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x10027299
mov eax, dword [esi]
test eax, eax
je 0x10027277
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1002728e
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003b014
add esp, 8
push 0xc
call fcn.1003b014
mov esi, eax
add esp, 4
test esi, esi
je 0x100272ce
push str.npdeploytk.dll
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov dword [esi], eax
test eax, eax
je 0x10027410
jmp 0x100272d0
xor esi, esi
mov dword [esp + 0x14], esi
test esi, esi
je 0x10027410
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.10003700
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x10027326
mov eax, dword [esi]
test eax, eax
je 0x10027304
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x1002731b
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003b014
add esp, 8
mov esi, dword [esp + 0x10]
test esi, esi
je 0x10027332
mov edi, dword [esi]
jmp 0x10027334
xor edi, edi
push edi
call fcn.1002a080
add esp, 4
test eax, eax
je 0x1002735c
push 0
push 0
push 0
push 0
push edi
push 0
push 1
push 2
push dword [esp + 0x48]
call fcn.10026620
add esp, 0x24
test esi, esi
je 0x100273a0
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
dec eax
jne 0x100273a0
mov eax, dword [esi]
test eax, eax
je 0x1002737e
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10027395
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.1003b014
add esp, 8
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x40]
push ecx
push 0
push 0
push 0
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], 0x800
push ecx
lea ecx, [esp + 0x2068]
inc eax
push ecx
push eax
push dword [esp + 0x38]
mov dword [esp + 0x4c], eax
jmp 0x10026e00
xor ebx, ebx
cmp eax, 0x103
sete bl
test ebp, ebp
je 0x100273f5
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebp, ebp
test ebp, ebp
je 0x100273f5
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x4054]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003b4ee
add esp, 0x4048
ret
push 0x8007000e
call fcn.1003b014
int3