Function at 0x10006da0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002d9ab
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x100411cc]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x130], edx
mov ebx, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x12c], eax
xor eax, eax
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 4], eax
push 6
mov dword [ebp - 0x124], 2
call fcn.1001c012
mov esi, eax
add esp, 4
mov dword [ebp - 0x128], esi
test esi, esi
je 0x10006e41
xor eax, eax
mov edi, 0x1003d2c8
mov word [esi + 4], ax
mov ecx, esi
sub edi, esi
mov edx, 2
nop
mov ax, word [edi + ecx]
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10006e30
jmp 0x10006e4b
mov dword [ebp - 0x124], 0
push ecx
lea eax, [ebp - 0x128]
mov ecx, ebx
push eax
call fcn.10008be0
mov edi, eax
test esi, esi
je 0x10006e6b
push 2
push esi
call fcn.1001c004
add esp, 8
cmp edi, 0xffffffff
jne 0x10006ed0
push ebx
lea ecx, [ebp - 0x120]
call fcn.10007ef0
push 2
mov dword [ebp - 0x124], 0
call fcn.1001c012
mov esi, eax
add esp, 4
mov dword [ebp - 0x128], esi
test esi, esi
je 0x10006ea3
xor eax, eax
mov word [esi], ax
jmp 0x10006ead
mov dword [ebp - 0x124], 0
lea eax, [ebp - 0x128]
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x130]
push eax
call fcn.10007ef0
mov byte [ebp - 4], 0
test esi, esi
je 0x10006f47
push 2
push esi
jmp 0x10006f3f
push edi
push 0
lea eax, [ebp - 0x128]
mov ecx, ebx
push eax
call fcn.10008d90
push eax
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 2
call fcn.10007ef0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x10006f0a
push 2
push eax
call fcn.1001c004
add esp, 8
push 0xffffffffffffffff
lea eax, [edi + 1]
mov ecx, ebx
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.10008d90
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x130]
push eax
call fcn.10007ef0
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x10006f47
push 2
push eax
call fcn.1001c004
add esp, 8
cmp dword [ebp - 0x11c], 0
mov edi, dword [ebp - 0x120]
je 0x10007775
mov edi, 4
push 0xa
mov dword [ebp - 0x124], edi
call fcn.1001c012
mov esi, eax
add esp, 4
mov dword [ebp - 0x128], esi
test esi, esi
je 0x10006fa8
xor eax, eax
mov ecx, esi
mov word [esi + 8], ax
mov edx, edi
mov esi, str.HKCU
sub esi, ecx
nop dword [eax]
mov ax, word [esi + ecx]
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
sub edx, 1
jne 0x10006f90
mov esi, dword [ebp - 0x128]
jmp 0x10006fb0
xor edi, edi
mov dword [ebp - 0x124], edi
mov byte [ebp - 4], 4
mov ebx, 1
mov edx, dword [ebp - 0x120]
mov dword [ebp - 0x138], ebx
test edx, edx
je 0x10007021
cmp dword [ebp - 0x11c], 0
jbe 0x10007021
test esi, esi
je 0x10007021
test edi, edi
je 0x10007021
mov ecx, esi
mov eax, edx
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10007006
test dx, dx
je 0x10007002
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10007006
add eax, 4
add ecx, 4
test dx, dx
jne 0x10006fe0
xor eax, eax
jmp 0x1000700b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10007021
mov edi, dword [ebp - 0x12c]
mov byte [ebp - 0x115], 1
jmp 0x100070c1
push 0x24
mov dword [ebp - 0x130], 0
mov ebx, 0x11
call fcn.1001c012
push 0xffffffffffffffff
push str.HKEY_CURRENT_USER
mov edi, eax
lea eax, [ebp - 0x130]
push 0x12
push edi
push eax
call fcn.10021c0c
xor ecx, ecx
add esp, 0x18
test eax, eax
mov eax, dword [ebp - 0x120]
cmovne ebx, ecx
mov dword [ebp - 0x138], ebx
lea ebx, [ecx + 3]
test eax, eax
je 0x100070ba
cmp dword [ebp - 0x11c], ecx
jbe 0x100070ba
test edi, edi
je 0x100070ba
cmp dword [ebp - 0x138], ecx
jbe 0x100070ba
mov ecx, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100070a8
test dx, dx
je 0x100070a4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100070a8
add eax, 4
add ecx, 4
test dx, dx
jne 0x10007082
xor eax, eax
jmp 0x100070ad
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100070ba
mov byte [ebp - 0x115], 1
jmp 0x100070c1
mov byte [ebp - 0x115], 0
test bl, 2
je 0x100070d8
and ebx, 0xfffffffd
test edi, edi
je 0x100070d8
push 2
push edi
call fcn.1001c004
add esp, 8
and ebx, 0xfffffffe
mov dword [ebp - 4], 0
test esi, esi
je 0x100070f1
push 2
push esi
call fcn.1001c004
add esp, 8
cmp byte [ebp - 0x115], 0
je 0x1000717e
push 0x80
lea eax, [ebp - 0x114]
mov dword [ebp - 0x130], 0
push eax
push str.Client_SID
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x10007163
lea eax, [ebp - 0x130]
push eax
mov eax, dword [ebp - 0x12c]
or eax, 0x20006
push eax
push 0
lea eax, [ebp - 0x114]
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [ebp - 0x130]
mov ebx, eax
mov edi, dword [ebp - 0x120]
mov dword [ebp - 0x130], eax
jmp 0x10007777
mov edi, dword [ebp - 0x120]
mov dword [ebp - 0x130], 0x80000001
mov ebx, dword [ebp - 0x130]
jmp 0x10007777
mov edi, 3
push 8
mov dword [ebp - 0x124], edi
call fcn.1001c012
mov esi, eax
add esp, 4
mov dword [ebp - 0x128], esi
test esi, esi
je 0x100071c8
xor eax, eax
mov ecx, esi
mov word [esi + 6], ax
mov edx, edi
mov esi, 0x1003d2f0
sub esi, ecx
mov ax, word [esi + ecx]
lea ecx, [ecx + 2]
mov word [ecx - 2], ax
sub edx, 1
jne 0x100071b0
mov esi, dword [ebp - 0x128]
jmp 0x100071d0
xor edi, edi
mov dword [ebp - 0x124], edi
mov byte [ebp - 4], 5
or ebx, 4
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x138], ebx
test eax, eax
je 0x10007241
cmp dword [ebp - 0x11c], 0
jbe 0x10007241
test esi, esi
je 0x10007241
test edi, edi
je 0x10007241
mov ecx, esi
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10007226
test dx, dx
je 0x10007222
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10007226
add eax, 4
add ecx, 4
test dx, dx
jne 0x10007200
xor eax, eax
jmp 0x1000722b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10007241
mov edi, dword [ebp - 0x12c]
mov byte [ebp - 0x115], 1
jmp 0x100072df
push 0x16
mov dword [ebp - 0x12c], 0
call fcn.1001c012
push 0xffffffffffffffff
push str.HKEY_USERS
mov edi, eax
lea eax, [ebp - 0x12c]
push 0xb
push edi
push eax
call fcn.10021c0c
mov edx, dword [ebp - 0x120]
xor ecx, ecx
add esp, 0x18
test eax, eax
mov eax, 0xa
cmovne eax, ecx
or ebx, 8
test edx, edx
je 0x100072d8
cmp dword [ebp - 0x11c], ecx
jbe 0x100072d8
test edi, edi
je 0x100072d8
test eax, eax
je 0x100072d8
mov ecx, edi
mov eax, edx
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100072c6
test dx, dx
je 0x100072c2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100072c6
add eax, 4
add ecx, 4
test dx, dx
jne 0x100072a0
xor eax, eax
jmp 0x100072cb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100072d8
mov byte [ebp - 0x115], 1
jmp 0x100072df
mov byte [ebp - 0x115], 0
test bl, 8
je 0x100072f6
and ebx, 0xfffffff7
test edi, edi
je 0x100072f6
push 2
push edi
call fcn.1001c004
add esp, 8
and ebx, 0xfffffffb
mov dword [ebp - 4], 0
test esi, esi
je 0x1000730f
push 2
push esi
call fcn.1001c004
add esp, 8
cmp byte [ebp - 0x115], 0
je 0x10007328
mov edi, dword [ebp - 0x120]
mov ebx, 0x80000003
jmp 0x10007777
push str.HKLM
lea ecx, [ebp - 0x128]
call fcn.10007e60
mov byte [ebp - 4], 6
or ebx, 0x10
mov edi, dword [ebp - 0x120]
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x138], ebx
test edi, edi
je 0x100073b1
cmp dword [ebp - 0x11c], 0
jbe 0x100073b1
test eax, eax
je 0x100073b1
cmp dword [ebp - 0x124], 0
jbe 0x100073b1
mov ecx, eax
mov eax, edi
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10007396
test dx, dx
je 0x10007392
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10007396
add eax, 4
add ecx, 4
test dx, dx
jne 0x10007370
xor eax, eax
jmp 0x1000739b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100073b1
mov esi, dword [ebp - 0x12c]
mov byte [ebp - 0x115], 1
jmp 0x10007455
push 0x26
mov dword [ebp - 0x12c], 0
mov edi, 0x12
call fcn.1001c012
push 0xffffffffffffffff
push str.HKEY_LOCAL_MACHINE
mov esi, eax
lea eax, [ebp - 0x12c]
push 0x13
push esi
push eax
call fcn.10021c0c
mov edx, dword [ebp - 0x120]
xor ecx, ecx
add esp, 0x18
test eax, eax
cmovne edi, ecx
or ebx, 0x20
test edx, edx
je 0x10007448
cmp dword [ebp - 0x11c], ecx
jbe 0x10007448
test esi, esi
je 0x10007448
test edi, edi
mov edi, edx
je 0x1000744e
mov ecx, esi
mov eax, edi
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10007436
test dx, dx
je 0x10007432
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10007436
add eax, 4
add ecx, 4
test dx, dx
jne 0x10007410
xor eax, eax
jmp 0x1000743b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000744e
mov byte [ebp - 0x115], 1
jmp 0x10007455
mov edi, dword [ebp - 0x120]
mov byte [ebp - 0x115], 0
test bl, 0x20
je 0x1000746c
and ebx, 0xffffffdf
test esi, esi
je 0x1000746c
push 2
push esi
call fcn.1001c004
add esp, 8
mov dword [ebp - 4], 0
and ebx, 0xffffffef
mov eax, dword [ebp - 0x128]
test eax, eax
je 0x1000748b
push 2
push eax
call fcn.1001c004
add esp, 8
cmp byte [ebp - 0x115], 0
je 0x1000749e
mov ebx, 0x80000002
jmp 0x10007777
push str.HKCR
lea ecx, [ebp - 0x134]
call fcn.10007e60
or ebx, 0x40
mov byte [ebp - 4], 7
mov dword [ebp - 0x138], ebx
test edi, edi
je 0x10007513
cmp dword [ebp - 0x11c], 0
jbe 0x10007513
mov eax, dword [ebp - 0x134]
test eax, eax
je 0x10007513
cmp dword [ebp - 0x130], 0
jbe 0x10007513
mov ecx, edi
nop dword [eax]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x10007506
test dx, dx
je 0x10007502
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x10007506
add ecx, 4
add eax, 4
test dx, dx
jne 0x100074e0
xor eax, eax
jmp 0x1000750b
sbb eax, eax
or eax, 1
test eax, eax
je 0x100075bf
push 0x24
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x124], 0x11
call fcn.1001c012
push 0xffffffffffffffff
push str.HKEY_CLASSES_ROOT
mov esi, eax
mov edi, 0x11
push 0x12
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x128], esi
push esi
push eax
call fcn.10021c0c
add esp, 0x18
test eax, eax
je 0x10007564
mov dword [ebp - 0x124], 0
xor edi, edi
mov edx, dword [ebp - 0x120]
or ebx, 0x80
test edx, edx
je 0x100075c8
cmp dword [ebp - 0x11c], 0
jbe 0x100075c8
test esi, esi
je 0x100075c8
test edi, edi
mov edi, edx
je 0x100075ce
mov eax, edi
nop dword [eax]
mov cx, word [eax]
cmp cx, word [esi]
jne 0x100075b6
test cx, cx
je 0x100075b2
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x100075b6
add eax, 4
add esi, 4
test cx, cx
jne 0x10007590
xor eax, eax
jmp 0x100075bb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100075ce
mov byte [ebp - 0x115], 1
jmp 0x100075d5
mov edi, dword [ebp - 0x120]
mov byte [ebp - 0x115], 0
test bl, bl
jns 0x100075ea
lea ecx, [ebp - 0x128]
and ebx, 0xffffff7f
call fcn.10007f70
lea ecx, [ebp - 0x134]
mov dword [ebp - 4], 0
and ebx, 0xffffffbf
call fcn.10007f70
cmp byte [ebp - 0x115], 0
je 0x10007612
mov ebx, 0x80000000
jmp 0x10007777
push str.HKCC
lea ecx, [ebp - 0x134]
call fcn.10007e60
or ebx, 0x100
mov byte [ebp - 4], 8
mov dword [ebp - 0x138], ebx
test edi, edi
je 0x10007687
cmp dword [ebp - 0x11c], 0
jbe 0x10007687
mov eax, dword [ebp - 0x134]
test eax, eax
je 0x10007687
cmp dword [ebp - 0x130], 0
jbe 0x10007687
mov ecx, edi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x1000767a
test dx, dx
je 0x10007676
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x1000767a
add ecx, 4
add eax, 4
test dx, dx
jne 0x10007654
xor eax, eax
jmp 0x1000767f
sbb eax, eax
or eax, 1
test eax, eax
je 0x1000772f
push 0x28
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0x124], 0x13
call fcn.1001c012
push 0xffffffffffffffff
push str.HKEY_CURRENT_CONFIG
mov esi, eax
mov edi, 0x13
push 0x14
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x128], esi
push esi
push eax
call fcn.10021c0c
add esp, 0x18
test eax, eax
je 0x100076d8
mov dword [ebp - 0x124], 0
xor edi, edi
or ebx, 0x200
cmp dword [ebp - 0x120], 0
je 0x10007738
cmp dword [ebp - 0x11c], 0
jbe 0x10007738
test esi, esi
je 0x10007738
test edi, edi
mov edi, dword [ebp - 0x120]
je 0x1000773e
mov eax, edi
mov cx, word [eax]
cmp cx, word [esi]
jne 0x10007726
test cx, cx
je 0x10007722
mov cx, word [eax + 2]
cmp cx, word [esi + 2]
jne 0x10007726
add eax, 4
add esi, 4
test cx, cx
jne 0x10007700
xor eax, eax
jmp 0x1000772b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1000773e
mov byte [ebp - 0x115], 1
jmp 0x10007745
mov edi, dword [ebp - 0x120]
mov byte [ebp - 0x115], 0
test ebx, 0x200
je 0x10007758
lea ecx, [ebp - 0x128]
call fcn.10007f70
lea ecx, [ebp - 0x134]
call fcn.10007f70
xor ebx, ebx
mov eax, 0x80000005
cmp byte [ebp - 0x115], bl
cmovne ebx, eax
jmp 0x10007777
xor ebx, ebx
test edi, edi
je 0x10007786
push 2
push edi
call fcn.1001c004
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1001bb62
mov esp, ebp
pop ebp
ret