Function at 0x10027420
Capabilities:
Delete registry key
Link many functions at runtime
Query or enumerate registry key

Disassembly:
mov eax, 0x1028
call fcn.1003baf0
mov eax, dword [0x100530a0]
xor eax, esp
mov dword [esp + 0x1024], eax
push ebx
push ebp
push esi
push edi
push 0x2001f
push 0x10042150
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x34]
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
xor esi, esi
mov dword [esp + 0x3c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
call fcn.10003a10
push 0x2001f
test eax, eax
mov ecx, 1
push str.SOFTWAREJavaSoftJava_Web_Start
cmovne esi, ecx
lea ecx, [esp + 0x24]
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10003a10
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x100274c3
test esi, esi
je 0x100274c3
mov ebp, dword [esp + 0x28]
mov edi, dword [esp + 0x1c]
jmp 0x10027a3e
mov ebp, dword [esp + 0x28]
lea eax, [esp + 0x34]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
xor edi, edi
push 0x800
push eax
push edi
push ebp
mov dword [esp + 0x28], ebp
call esi
test eax, eax
jne 0x10027695
mov esi, dword [esp + 0x30]
mov ebx, dword [esp + 0x2c]
lea eax, [esp + 0x34]
inc edi
push 0
push eax
call fcn.1002a610
add esp, 8
test eax, eax
jne 0x1002766f
test esi, esi
je 0x10027557
cmp dword [esi], eax
je 0x1002754a
push 0x1003e9d0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
jne 0x10027528
lea ecx, [eax + 1]
jmp 0x100275bb
push str.RegDeleteKeyTransactedW
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x10027550
push 0
push dword [esi]
lea ecx, [esp + 0x3c]
push 0
push 0
push ecx
push ebp
call eax
jmp 0x100275b9
cmp dword [esi + 4], 0
jne 0x100275ad
mov ecx, 1
jmp 0x100275bb
cmp byte [0x1005394c], 0
jne 0x10027597
push 0x1003e9d0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x10027589
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x10053948], eax
mov byte [0x1005394c], 1
jmp 0x1002759c
mov eax, dword [0x10053948]
mov byte [0x1005394c], 1
jmp 0x1002759c
mov eax, dword [0x10053948]
test eax, eax
je 0x100275ad
push 0
push ebx
lea ecx, [esp + 0x3c]
push ecx
push ebp
call eax
jmp 0x100275b9
lea eax, [esp + 0x34]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, eax
test ecx, ecx
jne 0x10027735
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x100275d6
push ebp
call ebx
xor ebp, ebp
mov dword [esp + 0x18], ebp
xor edi, edi
mov dword [esp + 0x10], edi
test esi, esi
je 0x10027632
cmp dword [esi], edi
je 0x10027626
push 0x1003e9d0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
jne 0x100275f8
lea eax, [edi + 1]
jmp 0x1002764e
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x1002762b
push 0
push dword [esi]
lea ecx, [esp + 0x18]
push ecx
push 0x2001f
push 0
push 0x10042150
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x1002764e
cmp dword [esi + 4], edi
jne 0x10027632
mov eax, 1
jmp 0x1002764e
lea eax, [esp + 0x10]
push eax
push 0x2001f
push 0
push 0x10042150
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10027713
test ebp, ebp
je 0x1002765d
push ebp
call ebx
mov ebp, dword [esp + 0x10]
xor ebx, ebx
mov dword [esp + 0x18], ebp
test eax, eax
jne 0x10027713
push 0x800
lea eax, [esp + 0x38]
push eax
push edi
push ebp
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x100274f1
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test ebp, ebp
je 0x100276a2
push ebp
call ebx
xor ebp, ebp
mov dword [esp + 0x18], ebp
mov edi, dword [esp + 0x1c]
lea eax, [esp + 0x34]
push 0x800
push eax
xor ebx, ebx
push ebx
push edi
call esi
test eax, eax
jne 0x10027a2f
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
mov dword [esp + 0x10], eax
nop word [eax + eax]
lea eax, [esp + 0x34]
inc ebx
push 0
push eax
call fcn.1002ad90
add esp, 8
test eax, eax
jne 0x10027a15
test esi, esi
je 0x10027906
cmp dword [esi], eax
je 0x100278f9
push 0x1003e9d0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
jne 0x100278d7
lea ecx, [eax + 1]
jmp 0x1002796d
push str.Error_open_Java_Plug_in_key
call fcn.10003ca0
mov edi, dword [esp + 0x20]
add esp, 4
mov ebp, dword [esp + 0x18]
xor esi, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10027a43
cmp ecx, 5
mov edx, str.runtime_error
mov eax, str.access_denied
lea ecx, [esp + 0x10]
cmovne eax, edx
push eax
call fcn.100060b0
push 0xc
call fcn.10031690
mov ebp, dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
add esp, 4
test esi, esi
je 0x10027786
push str._when_deleting_key
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call ebp
mov dword [esi], eax
test eax, eax
je 0x10027bcd
jmp 0x10027788
xor esi, esi
mov dword [esp + 0x14], esi
test esi, esi
je 0x10027bcd
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.10003700
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
jne 0x100277e6
mov eax, dword [esi]
test eax, eax
je 0x100277c4
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100277db
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
push 0xc
call fcn.10031690
mov esi, eax
add esp, 4
test esi, esi
je 0x10027817
lea eax, [esp + 0x34]
mov dword [esi + 4], 0
push eax
mov dword [esi + 8], 1
call ebp
mov dword [esi], eax
test eax, eax
je 0x10027bcd
jmp 0x10027819
xor esi, esi
mov dword [esp + 0x14], esi
test esi, esi
je 0x10027bcd
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.10003700
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x1002786e
mov eax, dword [esi]
test eax, eax
je 0x1002784c
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10027863
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
mov esi, dword [esp + 0x10]
test esi, esi
je 0x1002787a
mov eax, dword [esi]
jmp 0x1002787c
xor eax, eax
push eax
call fcn.10003ca0
add esp, 4
test esi, esi
je 0x100278c2
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x100278c2
mov eax, dword [esi]
test eax, eax
je 0x100278a0
push eax
call edi
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x100278b7
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
mov edi, dword [esp + 0x1c]
xor esi, esi
mov ebp, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10027a43
push str.RegDeleteKeyTransactedW
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x100278ff
push 0
push dword [esi]
lea ecx, [esp + 0x3c]
push 0
push 0
push ecx
push edi
call eax
jmp 0x1002796b
cmp dword [esi + 4], 0
jne 0x1002795f
mov ecx, 1
jmp 0x1002796d
cmp byte [0x1005394c], 0
jne 0x10027946
push 0x1003e9d0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x10027938
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x10053948], eax
mov byte [0x1005394c], 1
jmp 0x1002794b
mov eax, dword [0x10053948]
mov byte [0x1005394c], 1
jmp 0x1002794b
mov eax, dword [0x10053948]
test eax, eax
je 0x1002795f
push 0
push dword [esp + 0x14]
lea ecx, [esp + 0x3c]
push ecx
push edi
call eax
jmp 0x1002796b
lea eax, [esp + 0x34]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, eax
test ecx, ecx
jne 0x10027a87
test edi, edi
je 0x10027982
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x10], ebx
test esi, esi
je 0x100279de
cmp dword [esi], ebx
je 0x100279d2
push 0x1003e9d0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
jne 0x100279a4
lea eax, [ebx + 1]
jmp 0x100279fa
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x100279d7
push 0
push dword [esi]
lea ecx, [esp + 0x18]
push ecx
push 0x2001f
push 0
push str.SOFTWAREJavaSoftJava_Web_Start
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x100279fa
cmp dword [esi + 4], ebx
jne 0x100279de
mov eax, 1
jmp 0x100279fa
lea eax, [esp + 0x10]
push eax
push 0x2001f
push 0
push str.SOFTWAREJavaSoftJava_Web_Start
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10027a6c
test edi, edi
je 0x10027a09
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [esp + 0x10]
mov dword [esp + 0x10], ebx
test eax, eax
jne 0x10027a6c
push 0x800
lea eax, [esp + 0x38]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x100276d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x10027a3e
push edi
call ebx
xor edi, edi
mov esi, 1
test edi, edi
je 0x10027a4a
push edi
call ebx
test ebp, ebp
je 0x10027a51
push ebp
call ebx
mov ecx, dword [esp + 0x1034]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1003b4ee
add esp, 0x1028
ret
push str.Error_open_Java_Web_Start_key
call fcn.10003ca0
mov ebp, dword [esp + 0x1c]
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
jmp 0x10027a43
cmp ecx, 5
mov edx, str.runtime_error
mov eax, str.access_denied
lea ecx, [esp + 0x10]
cmovne eax, edx
push eax
call fcn.100060b0
push str._when_deleting_key
lea ecx, [esp + 0x18]
call fcn.100032a0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.10003700
mov esi, dword [esp + 0x14]
or ebx, 0xffffffff
mov ebp, dword [sym.imp.OLEAUT32.dll_SysStringLen]
test esi, esi
je 0x10027b09
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x10027b09
mov eax, dword [esi]
test eax, eax
je 0x10027ae7
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10027afe
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x18]
call fcn.100032a0
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
call fcn.10003700
mov esi, dword [esp + 0x14]
test esi, esi
je 0x10027b68
mov eax, ebx
lock xadd dword [esi + 8], eax
dec eax
jne 0x10027b68
mov eax, dword [esi]
test eax, eax
je 0x10027b46
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10027b5d
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
mov esi, dword [esp + 0x10]
test esi, esi
je 0x10027b74
mov eax, dword [esi]
jmp 0x10027b76
xor eax, eax
push eax
call fcn.10003ca0
add esp, 4
test esi, esi
je 0x10027bbc
lock xadd dword [esi + 8], ebx
dec ebx
jne 0x10027bbc
mov eax, dword [esi]
test eax, eax
je 0x10027b9a
push eax
call ebp
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x10027bb1
push eax
call fcn.1003b898
add esp, 4
mov dword [esi + 4], 0
push 0xc
push esi
call fcn.10031690
add esp, 8
mov ebp, dword [esp + 0x18]
xor esi, esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10027a43
push 0x8007000e
call fcn.10031690
int3