Function at 0x10094aa
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x101200c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0x18]
push 0x41
mov dword [ebp - 0x220], eax
xor eax, eax
test byte [ebp + 8], 1
pop ecx
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov esi, 0x104
je 0x10095b5
mov byte [ebx], al
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0x1001f48
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10095b5
lea eax, [ebp - 0x210]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x1002134
push dword [ebp - 0x214]
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10095a9
dec dword [ebp - 0x210]
mov eax, dword [ebp - 0x210]
add eax, ebx
push eax
push ebx
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x5c
je 0x1009586
mov eax, dword [ebp - 0x210]
mov byte [ebx + eax], 0x5c
inc dword [ebp - 0x210]
mov eax, dword [ebp - 0x210]
mov byte [ebx + eax], 0
cmp dword [ebp - 0x21c], 2
jne 0x10095a9
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
mov ebx, eax
and ebx, 2
je 0x10095c8
mov ecx, dword [ebp - 0x218]
mov byte [ecx], 0
test al, 4
je 0x10095d5
mov ecx, dword [ebp - 0x224]
mov byte [ecx], 0
test al, 8
je 0x10095e2
mov ecx, dword [ebp - 0x220]
mov byte [ecx], 0
test al, 0xe
je 0x100978e
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0x1006b58
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100978e
mov byte [ebp - 5], al
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x100552c
push dword [ebp - 0x214]
mov dword [ebp - 0x210], 0x103
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1009782
dec dword [ebp - 0x210]
mov eax, dword [ebp - 0x210]
lea eax, [ebp + eax - 0x108]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x5c
je 0x100968d
mov eax, dword [ebp - 0x210]
mov byte [ebp + eax - 0x108], 0x5c
inc eax
mov dword [ebp - 0x210], eax
mov byte [ebp + eax - 0x108], 0
cmp dword [ebp - 0x21c], 2
jne 0x10096bc
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test ebx, ebx
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 0x210], eax
je 0x100970e
push esi
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x218]
call edi
mov eax, dword [ebp - 0x210]
mov ecx, esi
sub ecx, eax
push ecx
mov ecx, dword [ebp - 0x218]
add ecx, eax
push ecx
push 0x40b
push dword [0x1016c8c]
call ebx
or dword [ebp + 8], 2
test byte [ebp + 8], 4
je 0x1009749
push esi
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x224]
call edi
mov eax, dword [ebp - 0x210]
mov ecx, esi
sub ecx, eax
push ecx
mov ecx, dword [ebp - 0x224]
add ecx, eax
push ecx
push 0x408
push dword [0x1016c8c]
call ebx
or dword [ebp + 8], 4
test byte [ebp + 8], 8
je 0x1009782
push esi
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x220]
call edi
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 0x220]
sub esi, eax
push esi
add ecx, eax
push ecx
push 0x409
push dword [0x1016c8c]
call ebx
or dword [ebp + 8], 8
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
call fcn.0100d528
leave
ret 0x14