Function at 0x100294c0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x230
mov eax, dword [0x1004f860]
xor eax, esp
mov dword [esp + 0x22c], eax
mov eax, dword [esp + 0x234]
push esi
push edi
xor edi, edi
push 0x20019
push str.SOFTWARE
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x18]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
xor esi, esi
mov dword [esp + 0x14], edi
call fcn.10003190
test eax, eax
je 0x10029551
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x10029538
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.1003779c
add esp, 0x230
ret
push ebp
mov ebp, dword [esp + 0x10]
push 0x20019
push str.JavaSoft
push ebp
lea ecx, [esp + 0x28]
call fcn.10003190
test eax, eax
je 0x100295a0
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x1002957f
push eax
call esi
cmp ebp, edi
je 0x10029586
push ebp
call esi
pop ebp
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x22c]
xor ecx, esp
call fcn.1003779c
add esp, 0x230
ret
push ebx
mov ebx, dword [esp + 0x20]
push 0x20019
push str.Java_Runtime_Environment
push ebx
lea ecx, [esp + 0x38]
call fcn.10003190
test eax, eax
je 0x100295e3
mov eax, dword [esp + 0x2c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
je 0x100295ce
push eax
call esi
cmp ebx, edi
je 0x100295d5
push ebx
call esi
cmp ebp, edi
je 0x100295dc
push ebp
call esi
xor eax, eax
jmp 0x1002970b
mov ebx, dword [esp + 0x2c]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0x80
lea edx, [esp + 0x40]
push edx
push edi
xor ecx, ecx
push ebx
mov word [esp + 0x14c], cx
call ebp
test eax, eax
jne 0x100296e4
lea ecx, [ecx]
lea eax, [esp + 0x13c]
push eax
lea ecx, [esp + 0x40]
push ecx
inc esi
call dword [sym.imp.MSVCR100.dll__wcsicmp]
add esp, 8
test eax, eax
jle 0x100296ad
mov ecx, str.11.241.2
lea eax, [esp + 0x3c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1002965e
cmp dx, di
je 0x1002965a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1002965e
add eax, 4
add ecx, 4
cmp dx, di
jne 0x10029638
xor eax, eax
jmp 0x10029663
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
je 0x100296ad
lea eax, [esp + 0x3c]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10029670
sub eax, edx
sar eax, 1
cmp eax, 3
jbe 0x100296ad
xor eax, eax
jmp 0x10029690
movzx ecx, word [esp + eax + 0x3c]
mov word [esp + eax + 0x13c], cx
add eax, 2
cmp cx, di
jne 0x10029690
mov dword [esp + 0x10], 1
push 0x80
lea edx, [esp + 0x40]
push edx
push esi
push ebx
call ebp
test eax, eax
je 0x10029610
cmp dword [esp + 0x10], edi
je 0x100296e4
mov ecx, dword [esp + 0x38]
lea eax, [esp + 0x13c]
push eax
push 0x1003c898
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x100296f1
push ebx
call esi
mov eax, dword [esp + 0x20]
cmp eax, edi
je 0x100296fc
push eax
call esi
mov eax, dword [esp + 0x14]
cmp eax, edi
je 0x10029707
push eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x23c]
pop ebx
pop ebp
pop edi
pop esi
xor ecx, esp
call fcn.1003779c
add esp, 0x230
ret