Function at 0x402a90
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5ac
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x588], eax
mov ebx, eax
mov eax, dword [0x408090]
and ebx, 0x100
test eax, eax
je 0x402ae0
mov edx, dword [ebp + 8]
test ebx, ebx
mov dword [esp + 0xc], edx
mov edx, 0x407244
jne 0x402acb
mov edx, 0x407247
mov dword [esp + 8], edx
mov ecx, str._s_bit_search:_t_s..._n
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
or ebx, 0x20019
xor esi, esi
lea edi, [ebp - 0x56c]
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov ebx, dword [ebp + 8]
mov dword [esp], 0x80000002
mov dword [esp + 4], ebx
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x402b1c
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0x104
xor ecx, ecx
mov edx, 0x104
mov dword [ebp - 0x584], esi
xor eax, eax
lea esi, [ebp - 0x128]
mov dword [ebp - 0x58c], ecx
mov edi, 0x104
xor ebx, ebx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], esi
call sub.msvcrt.dll_memset
mov dword [esp + 8], edi
lea ecx, [ebp - 0x238]
lea edi, [ebp - 0x348]
mov dword [esp + 4], ebx
mov dword [esp], ecx
call sub.msvcrt.dll_memset
mov dword [esp], edi
mov edx, 0x104
xor eax, eax
mov dword [esp + 8], edx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memset
jmp 0x402bb9
mov dword [esp], edi
mov eax, 0x410460
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcmp
test eax, eax
jle 0x402c8e
mov eax, dword [0x408090]
test eax, eax
jne 0x402d30
mov eax, 0x104
mov dword [ebp - 0x584], eax
xor ecx, ecx
lea eax, [ebp - 0x580]
xor ebx, ebx
mov dword [esp + 0x1c], eax
xor edx, edx
lea eax, [ebp - 0x584]
mov dword [esp + 0x18], ecx
lea ecx, [ebp - 0x238]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ecx
mov ebx, dword [ebp - 0x58c]
mov dword [esp + 4], ebx
mov edx, dword [ebp - 0x56c]
inc ebx
mov dword [ebp - 0x58c], ebx
mov dword [esp], edx
call sub.ADVAPI32.DLL_RegEnumKeyExA
sub esp, 0x20
test eax, eax
jne 0x402e86
mov ebx, dword [ebp + 8]
mov dword [esp], esi
mov dword [esp + 4], ebx
call sub.msvcrt.dll_strcpy
mov dword [esp], esi
call sub.msvcrt.dll_strlen
cmp byte [eax + esi - 1], 0x5c
je 0x402c37
mov word [eax + esi], 0x5c
mov dword [esp], esi
lea eax, [ebp - 0x238]
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcat
mov eax, dword [0x408090]
test eax, eax
jne 0x402d50
mov dword [esp], edi
lea ebx, [ebp - 0x238]
mov dword [esp + 4], ebx
call fcn.004024b0
mov dword [esp], edi
mov ecx, 0x4103e0
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strcmp
test eax, eax
js 0x402ba1
cmp byte [0x410460], 0
jne 0x402b88
mov dword [esp], edi
mov edx, 0x4104e0
mov dword [esp + 4], edx
call sub.msvcrt.dll_strcmp
test eax, eax
jle 0x402ba1
xor ecx, ecx
xor eax, eax
lea edx, [ebp - 0x458]
mov dword [ebp - 0x590], eax
mov ebx, 0x104
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov dword [esp], edx
call sub.msvcrt.dll_memset
mov dword [esp + 4], esi
mov ebx, dword [ebp - 0x588]
xor ecx, ecx
mov dword [esp + 8], ecx
lea eax, [ebp - 0x570]
mov dword [esp + 0x10], eax
and ebx, 0x100
or ebx, 0x20019
mov dword [esp + 0xc], ebx
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x402d6a
mov eax, dword [0x408090]
mov ebx, 1
mov dword [0x4102dc], ebx
test eax, eax
je 0x402bae
jmp 0x402d30
mov dword [esp + 8], edi
mov ecx, str.Ignore:_t_t_s_n
mov dword [esp + 4], ecx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x402bae
mov dword [esp + 8], esi
mov edx, str.Check:_t_t_s_n
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x402c56
lea ebx, [ebp - 0x568]
mov edx, 0x104
xor eax, eax
mov dword [esp + 8], edx
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_memset
mov ecx, 0x104
lea edx, [ebp - 0x574]
lea eax, [ebp - 0x578]
mov dword [ebp - 0x574], ecx
mov ecx, str.JavaHome
mov dword [esp + 0x10], ebx
xor ebx, ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], ecx
mov edx, dword [ebp - 0x570]
mov dword [esp], edx
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x402df8
xor edx, edx
movzx ebx, byte [edx + ebp - 0x568]
mov byte [edx + ebp - 0x458], bl
inc edx
test bl, bl
jne 0x402dd0
lea ecx, [ebp - 0x458]
mov dword [esp], ecx
call fcn.00402840
mov dword [ebp - 0x590], eax
mov edx, dword [ebp - 0x570]
mov dword [esp], edx
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0x590]
sub esp, 4
test eax, eax
je 0x402d09
mov dword [esp], 0x410664
lea eax, [ebp - 0x458]
mov dword [esp + 4], eax
call sub.msvcrt.dll_strcpy
mov ecx, dword [ebp - 0x590]
test ecx, ecx
je 0x402ba1
mov dword [esp + 4], edi
mov dword [esp], 0x4104e0
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], esi
mov dword [esp], 0x410560
call sub.msvcrt.dll_strcpy
mov eax, dword [0x408090]
mov edx, dword [ebp - 0x588]
test eax, eax
mov dword [0x4102d4], edx
je 0x402bae
mov dword [esp + 8], edi
mov ebx, str.Match:_t_t_s_n
mov dword [esp + 4], ebx
jmp 0x402d3d
mov edi, dword [ebp - 0x56c]
mov dword [esp], edi
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret