Function at 0x100a29b
Capabilities:
Get hostname
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6a8
mov eax, dword [0x10191f4]
push 0x104
lea ecx, [ebp - 0x22c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
mov dword [ebp - 0x644], eax
call fcn.0101066f
test eax, eax
jl 0x100a5ac
push ebx
xor ebx, ebx
inc ebx
push ebx
call fcn.010050ae
cmp word [ebp - 0x22c], 0x5c
jne 0x100a2f5
cmp word [ebp - 0x22a], 0x5c
lea eax, [ebp - 0x228]
je 0x100a2fb
lea eax, [ebp - 0x22c]
push esi
push edi
push eax
mov dword [ebp - 0x638], eax
call dword [sym.imp.USER32.dll_CharLowerW]
push ebx
push dword [ebp - 0x638]
call dword [sym.imp.USER32.dll_CharUpperBuffW]
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x648], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x100a359
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x638]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100a359
mov dword [ebp - 0x63c], 0x99
jmp 0x100a57f
mov eax, dword [0x1019060]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
mov edi, 0x110a
push edi
push eax
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x6a8], 0x15
call esi
lea ecx, [ebp - 0x434]
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x698], ecx
mov dword [ebp - 0x694], 0x104
jmp 0x100a3d4
lea eax, [ebp - 0x6a8]
push eax
push 0
push 0x113e
push dword [ebp - 0x63c]
call esi
lea eax, [ebp - 0x434]
push eax
push dword [ebp - 0x638]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100a426
jl 0x100a3ef
mov eax, dword [ebp - 0x6a4]
push eax
push ebx
push edi
push dword [ebp - 0x63c]
mov dword [ebp - 0x640], eax
call esi
test eax, eax
mov dword [ebp - 0x6a4], eax
jne 0x100a39f
lea eax, [ebp - 0x64c]
push eax
push 0x80000002
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
xor ecx, ecx
cmp eax, ecx
je 0x100a440
cmp eax, 5
sete cl
lea ecx, [ecx + ecx + 0x9a]
mov dword [ebp - 0x63c], ecx
jmp 0x100a57f
push dword [ebp - 0x6a4]
push 9
push 0x110b
push dword [ebp - 0x63c]
call esi
jmp 0x100a5a9
mov eax, dword [ebp - 0x640]
mov edi, dword [0x1019060]
mov dword [ebp - 0x67c], eax
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x668], eax
lea eax, [ebp - 0x680]
push eax
push ecx
push 0x1132
push edi
mov dword [ebp - 0x63c], ecx
mov dword [ebp - 0x680], 0xffff0000
mov dword [ebp - 0x678], 0x67
mov dword [ebp - 0x660], ebx
mov dword [ebp - 0x65c], ebx
mov dword [ebp - 0x658], ebx
mov dword [ebp - 0x654], ecx
call esi
mov dword [ebp - 0x680], eax
xor eax, eax
mov dword [ebp - 0x660], 2
mov dword [ebp - 0x65c], 3
mov dword [ebp - 0x638], eax
lea ecx, [eax + eax*2]
shl ecx, 2
cmp eax, ebx
mov edx, dword [ecx + 0x10019e0]
mov dword [ebp - 0x668], edx
je 0x100a52d
test eax, eax
je 0x100a52d
cmp eax, 2
jne 0x100a5b8
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x654], eax
push 0x100
lea eax, [ebp - 0x634]
push eax
push 0
push dword [ebp - 0x654]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x658], eax
lea eax, [ebp - 0x680]
push eax
push 0
push 0x1132
push edi
call esi
mov eax, dword [ebp - 0x638]
inc eax
cmp eax, 6
mov dword [ebp - 0x638], eax
jb 0x100a4c2
push dword [ebp - 0x680]
push 2
push 0x1102
push edi
call esi
push dword [ebp - 0x680]
xor ebx, ebx
push ebx
push 0x1114
push edi
call esi
push ebx
call fcn.010050ae
push dword [ebp - 0x680]
push 9
push 0x110b
push edi
call esi
push edi
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x63c], ebx
je 0x100a5a9
lea eax, [ebp - 0x22c]
push eax
movzx eax, word [ebp - 0x63c]
push 0x10
push 0x98
push eax
push dword [ebp - 0x644]
push dword [0x1019510]
call fcn.01009ee7
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.01016b82
leave
ret 4
cmp eax, 5
je 0x100a52d
cmp eax, 4
je 0x100a52d
lea eax, [ebp - 0x654]
push eax
push dword [ecx + 0x10019e4]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
test eax, eax
je 0x100a4f1
mov dword [ebp - 0x63c], 0x9b
jmp 0x100a527