Function at 0x10029060
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc
mov dword [0x10255764], eax
mov eax, dword [esp + 0x1c]
mov dword [0x10255768], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
mov dword [0x1025576c], eax
mov eax, dword [section..data]
mov ebx, 0x101d4a68
cmp eax, section..data
je 0x100290a3
push ebx
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
push 0x101d46b0
push 0xd
call fcn.10028647
xor ebp, ebp
push 0xc
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x18], ebp
call fcn.10028633
push eax
call fcn.10026306
push 0xc
call fcn.10028633
push eax
mov esi, 0x104
push esi
push 0x102554d0
call fcn.1017c1f6
add esp, 0x20
push esi
mov esi, 0x10255ba0
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x10029123
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002911f
push ebx
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
push 0xe
jmp 0x10029169
push 0x5c
push esi
call fcn.1017c4a0
pop ecx
pop ecx
lea ecx, [eax + 2]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bp
jne 0x10029133
sub ecx, edx
sar ecx, 1
cmp ecx, 0x3e
jbe 0x1002914b
push 0x19
jmp 0x10029169
lea eax, [esp + 0x14]
push eax
call fcn.10033bd5
pop ecx
test eax, eax
jne 0x1002915e
push 7
jmp 0x10029169
call fcn.10158b10
test eax, eax
jne 0x1002916f
push 8
pop esi
jmp 0x100293f7
push edi
push ebp
lea eax, [esp + 0x30]
push eax
push 0x1f0001
push ebp
push 0x101d46b4
call fcn.10028a13
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x100291bb
mov eax, dword [section..data]
cmp eax, section..data
je 0x10029359
push ebx
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
jmp 0x10029359
mov eax, dword [section..data]
cmp eax, section..data
je 0x100291d8
push ebx
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
cmp dword [0x10255778], ebp
je 0x100291e8
push 0xe
pop esi
jmp 0x10029359
push ebp
lea eax, [esp + 0x28]
push eax
xor eax, eax
push 0x1f0003
inc eax
push eax
push 0x101d46c0
call fcn.10028a13
mov esi, eax
add esp, 0x14
test esi, esi
je 0x10029230
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002934c
push ebx
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
jmp 0x1002934c
push ebp
lea eax, [esp + 0x14]
push eax
push 0xf003f
push 2
push ebp
call fcn.10028a13
mov ebx, dword [esp + 0x24]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1002927a
mov eax, dword [section..data]
cmp eax, section..data
je 0x10029345
push 0x101d4a68
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
jmp 0x10029345
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push ebp
push ebp
push ebp
push 0x101d46c8
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100292bf
mov eax, dword [section..data]
cmp eax, section..data
je 0x100292b7
push 0x101d4a68
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
push 2
pop esi
jmp 0x10029345
push 0xa
call fcn.10028633
mov ebp, dword [esp + 0x28]
pop ecx
cmp word [eax], 0x30
jne 0x10029392
mov eax, dword [section..data]
cmp eax, section..data
je 0x100292f6
push 0x101d4a68
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
push 0
lea eax, [esp + 0x2c]
push eax
push 0x1f0001
push 0
push str.install
call fcn.10028a13
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1002936f
mov eax, dword [section..data]
cmp eax, section..data
je 0x10029338
push 0x101d4a68
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
cmp dword [esp + 0x28], 0
je 0x10029345
push dword [esp + 0x28]
call edi
test ebx, ebx
je 0x1002934c
push ebx
call edi
cmp dword [esp + 0x24], 0
je 0x10029359
push dword [esp + 0x24]
call edi
cmp dword [esp + 0x2c], 0
je 0x100293f6
push dword [esp + 0x2c]
call edi
jmp 0x100293f6
mov eax, dword [section..data]
cmp eax, section..data
je 0x10029399
push 0x101d4a68
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002114e
add esp, 0x10
jmp 0x10029399
push ebp
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xb
call fcn.10028633
pop ecx
mov ecx, dword [0x10255760]
push 1
cmp word [eax], 0x31
mov eax, dword [esp + 0x30]
pop edx
push dword [esp + 0x18]
cmove ecx, edx
mov dword [0x102556dc], eax
mov eax, dword [esp + 0x2c]
push 0x101d46d4
push 0xc
mov dword [0x10255760], ecx
mov dword [0x102556d8], eax
mov dword [0x10255784], ebp
mov dword [0x10255dac], ebx
mov dword [0x10255778], edx
call fcn.10028633
pop ecx
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
pop edi
push esi
push 0x101d46dc
push 0xa
call fcn.10028633
pop ecx
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [section..data]
cmp eax, section..data
je 0x10029431
push esi
push 0x101d4a68
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1002116b
add esp, 0x14
pop esi
pop ebp
pop ebx
add esp, 0xc
ret