Function at 0x100293f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x200
lea ebp, [esp - 4]
mov eax, dword [0x10113a30]
xor eax, ebp
mov dword [ebp + 0x200], eax
push 0x1c
mov eax, 0x100be234
call fcn.10092efa
mov edi, dword [ebp + 0x20c]
mov dword [ebp - 0x1c], ecx
call fcn.1006f7ae
push eax
lea ecx, [ebp - 0x10]
call fcn.10004d63
mov esi, pe_nt_image_headers32
xor ebx, ebx
push esi
lea eax, [ebp + 0x100]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.1008ef90
push esi
lea eax, [ebp]
push ebx
push eax
call fcn.1008ef90
lea eax, [ebp + 0x100]
push eax
call fcn.1000a470
mov eax, dword [ebp - 0x1c]
add esp, 0x1c
add eax, 0x84
push eax
lea eax, [ebp + 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
lea eax, [ebp - 0x10]
push str._04d
push eax
call fcn.10005cfd
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x24], eax
call fcn.10005348
lea ecx, [ebp - 0x24]
push ecx
push eax
lea eax, [ebp - 0x28]
push eax
push str.RunOnceInitConfigTool
lea eax, [ebp + 0x100]
push eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call fcn.1000b244
mov dword [ebp - 0x1c], eax
xor eax, eax
inc eax
add esp, 0x18
cmp dword [ebp - 0x1c], eax
je 0x100295b3
mov dword [edi], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], 0x20019
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], 4
call fcn.10009e6a
cmp dword [ebp - 0x20], 0xb
pop ecx
jl 0x10029509
cmp dword [ebp - 0x20], 0x18
jl 0x10029516
call fcn.1000a36a
test eax, eax
je 0x10029509
mov dword [ebp - 0x18], 0x20219
cmp dword [ebp - 0x20], 0x18
jne 0x10029516
push str.SOFTWAREWow6432NodeRALINKWLANInstallShield
jmp 0x1002951b
push str.SOFTWARERALINKWLANInstallShield
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
lea eax, [ebp]
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10029573
lea eax, [ebp - 0x24]
push eax
push edi
lea eax, [ebp - 0x28]
push eax
push ebx
push str.ConfigToolSelect
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
je 0x10029568
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x18], ebx
je 0x10029573
mov dword [edi], 1
push dword [edi]
lea eax, [ebp - 0x10]
push 0x100cedf4
push eax
call fcn.10005cfd
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
add esp, 0xc
push 0xf003f
push eax
push 1
push eax
lea ecx, [ebp - 0x10]
call fcn.10005348
push eax
push str.RunOnceInitConfigTool
lea eax, [ebp + 0x100]
push eax
push esi
call fcn.1000a248
add esp, 0x1c
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.10001210
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x200]
xor ecx, ebp
call fcn.1008e5e8
add ebp, 0x204
leave
ret 4
cmp byte [0x1011c700], 0
jne 0x10057703
push 0xfffffffffffffffe
pop eax
jmp 0x10057727
push esi
mov esi, 0x1011c88c
push esi
call fcn.10001272
test eax, eax
pop ecx
jne 0x10057718
push 0xfffffffffffffff7
jmp 0x10057725
push esi
call fcn.10001b5e
test eax, eax
pop ecx
jne 0x1005772a
push 0xfffffffffffffff5
pop eax
pop esi
ret 4
mov ecx, dword [0x1011cc1c]
pop esi
jmp 0x100293f4