Function at 0x10026c20
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100939bc
mov eax, dword fs:[0]
push eax
sub esp, 0x364
mov eax, dword [0x100d7294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2d8], ecx
mov dword [ebp - 0x2b4], 0
mov dword [ebp - 0x29c], 0
mov dword [ebp - 0x2a0], 0
push 0x208
push 0
lea eax, [ebp - 0x250]
push eax
call fcn.100672b0
add esp, 0xc
mov dword [ebp - 0x2c0], 1
mov dword [ebp - 0x2bc], 0x208
lea ecx, [ebp - 0x2bc]
push ecx
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x2c0]
push eax
push 0x100a1210
call fcn.10027900
push eax
push SysStringLen
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0
jne 0x10026ce4
lea ecx, [ebp - 0x250]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10026ce9
jmp 0x10027004
lea edx, [ebp - 0x250]
push edx
lea ecx, [ebp - 0x268]
call fcn.10005180
mov dword [ebp - 4], 0
mov eax, 0x5c
mov word [ebp - 0x48], ax
mov ecx, 0x6e
mov word [ebp - 0x46], cx
mov edx, 0x65
mov word [ebp - 0x44], dx
mov eax, 0x74
mov word [ebp - 0x42], ax
mov ecx, 0x6d
mov word [ebp - 0x40], cx
mov edx, 0x6f
mov word [ebp - 0x3e], dx
mov eax, 0x6e
mov word [ebp - 0x3c], ax
mov ecx, 0x5c
mov word [ebp - 0x3a], cx
mov edx, 0x33
mov word [ebp - 0x38], dx
mov eax, 0x36
mov word [ebp - 0x36], ax
mov ecx, 0x30
mov word [ebp - 0x34], cx
mov edx, 0x57
mov word [ebp - 0x32], dx
mov eax, 0x65
mov word [ebp - 0x30], ax
mov ecx, 0x62
mov word [ebp - 0x2e], cx
mov edx, 0x49
mov word [ebp - 0x2c], dx
mov eax, 0x64
mov word [ebp - 0x2a], ax
mov ecx, 0x65
mov word [ebp - 0x28], cx
mov edx, 0x6e
mov word [ebp - 0x26], dx
mov eax, 0x74
mov word [ebp - 0x24], ax
mov ecx, 0x69
mov word [ebp - 0x22], cx
mov edx, 0x66
mov word [ebp - 0x20], dx
mov eax, 0x79
mov word [ebp - 0x1e], ax
mov ecx, 0x2e
mov word [ebp - 0x1c], cx
mov edx, 0x64
mov word [ebp - 0x1a], dx
mov eax, 0x6c
mov word [ebp - 0x18], ax
mov ecx, 0x6c
mov word [ebp - 0x16], cx
xor edx, edx
mov word [ebp - 0x14], dx
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x268]
call fcn.10023ba0
lea ecx, [ebp - 0x268]
call fcn.1000e0d0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 0
jne 0x10026e39
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10006330
jmp 0x10027004
push str.GetWebIdentifyState
mov ecx, dword [ebp - 0x29c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0
jne 0x10026e71
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10006330
jmp 0x10027004
call dword [ebp - 0x2a0]
mov dword [ebp - 0x2ac], eax
call fcn.10052b20
mov dword [ebp - 0x2a4], eax
push 1
mov edx, dword [ebp - 0x2a4]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2a4]
mov edx, dword [eax + 8]
call edx
mov byte [ebp - 0x2c8], al
cmp byte [ebp - 0x2c8], 1
je 0x10026eb1
jmp 0x10026fbf
mov dword [ebp - 0x2cc], 0xd9
push 0x100a1230
lea ecx, [ebp - 0x298]
call fcn.10004fd0
mov byte [ebp - 4], 1
push 0x100a129c
lea ecx, [ebp - 0x280]
call fcn.10004fd0
mov byte [ebp - 4], 2
call fcn.10052b20
mov dword [ebp - 0x2a8], eax
push 0x100a12f8
lea eax, [ebp - 0x2cc]
push eax
push 0x100a12f4
push 0x100a12a8
push 0x100a12a4
lea ecx, [ebp - 0x2ac]
push ecx
push 0x100a12a0
push 0xd9
lea edx, [ebp - 0x298]
push edx
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x370]
call fcn.10005660
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp - 0x2d4], ecx
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2d4]
call fcn.10002ad0
mov ecx, eax
call fcn.10002af0
mov ecx, eax
call fcn.10002ad0
mov ecx, eax
call fcn.100117d0
mov ecx, eax
call fcn.10002ad0
mov ecx, eax
call fcn.10022e30
mov ecx, eax
call fcn.10002ad0
push eax
mov edx, dword [ebp - 0x2a8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x2a8]
mov edx, dword [eax + 0x1c]
call edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x370]
call fcn.100065c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x280]
call fcn.100062e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x298]
call fcn.100062e0
cmp dword [ebp - 0x2ac], 0
je 0x10026fd4
mov dword [ebp - 0x2b0], 1
jmp 0x10026fde
mov dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x2b4], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10006330
xor ecx, ecx
jne 0x10026c6f
cmp dword [ebp - 0x29c], 0
je 0x1002701a
mov edx, dword [ebp - 0x29c]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x2b4]
mov dword [ebp + 8], eax
cmp dword [ebp - 0x2a0], 0
jne 0x10027038
mov dword [ebp - 0x2b8], 1
jmp 0x10027042
mov dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x2b8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005fbb2
mov esp, ebp
pop ebp
ret 4