Function at 0x10028100
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x10136674]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1002812c
push edi
call fcn.10025080
mov ecx, eax
call fcn.1001ce80
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.1007bae0
add esp, 0xc
mov dword [ebp - 0x420], 1
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x41c], 0x104
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x420]
push eax
push 0x100fe3bc
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathshalowp.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1002824a
call fcn.10025080
mov ecx, eax
call fcn.1001c990
push eax
call fcn.10017d10
mov ecx, eax
call fcn.10013690
push str.bizhi
call fcn.10017d10
mov ecx, eax
call fcn.10013750
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1007bae0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x10139a84]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.10017d10
mov ecx, eax
call fcn.10013600
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.exist_wp
mov dword [eax + 0x24], 0
call fcn.10017d10
mov ecx, eax
call fcn.10013240
test esi, esi
je 0x10028429
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x10028429
push str.exist
push eax
push esi
call fcn.100973c7
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069b58
mov esp, ebp
pop ebp
ret 0xc
call fcn.10025080
mov ecx, eax
call fcn.1001e090
test eax, eax
jne 0x10028332
push 1
call fcn.10019330
add esp, 4
test eax, eax
jne 0x10028332
call fcn.10025080
mov ecx, eax
call fcn.1001c990
push eax
call fcn.10017d10
mov ecx, eax
call fcn.10013690
push str.bizhi
call fcn.10017d10
mov ecx, eax
call fcn.10013750
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1007bae0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x10139a84]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.10017d10
mov ecx, eax
call fcn.10013600
sub esp, 0x28
mov eax, esp
push 0
push 0
push str.giveup
mov dword [eax + 0x24], 0
call fcn.10017d10
mov ecx, eax
call fcn.10013240
test esi, esi
je 0x10028429
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x10028429
push str.giveup
push eax
push esi
call fcn.100973c7
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069b58
mov esp, ebp
pop ebp
ret 0xc
cmp dword [0x10139a98], 0
jne 0x10028429
push 0
push edi
push 0
push dword [0x10139a84]
mov dword [0x10139a98], 1
call fcn.10028a20
test esi, esi
je 0x10028429
mov edi, dword [ebp + 0x10]
test edi, edi
jle 0x10028429
call fcn.10025080
mov ecx, eax
call fcn.1001c990
push eax
call fcn.10017d10
mov ecx, eax
call fcn.10013690
push str.bizhi
call fcn.10017d10
mov ecx, eax
call fcn.10013750
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1007bae0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x10139a84]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x20c]
push eax
call fcn.10017d10
mov ecx, eax
call fcn.10013600
cmp dword [0x1013522c], 0
jne 0x100283fc
push 0x10100164
push edi
push esi
call fcn.100973c7
sub esp, 0x1c
mov eax, esp
push 0
push 0
push 0x10100164
jmp 0x10028416
push str.fail
push edi
push esi
call fcn.100973c7
sub esp, 0x1c
mov eax, esp
push 0
push 0
push str.fail
mov dword [eax + 0x24], 0
call fcn.10017d10
mov ecx, eax
call fcn.10013240
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.10069b58
mov esp, ebp
pop ebp
ret 0xc