Function at 0x8f866a8
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
cmp eax, esi
je 0x8f86716
cmp eax, 2
jne 0x8f86780
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x8f8670a
cmp dword [ebp + 0xc], 7
jne 0x8f866f0
push eax
call fcn.08f84562
add eax, eax
jmp 0x8f86705
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x8f866f3
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 4], eax
jmp 0x8f86728
push 2
push 0x8f72990
jmp 0x8f8688f
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 8], eax
je 0x8f86725
xor eax, eax
jmp 0x8f868e3
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x8f86732
push 0x20
pop eax
mov dword [ebp - 4], eax
mov ecx, eax
and ecx, 1
lea ebx, [ecx + eax + 2]
push ebx
call fcn.08f83725
mov esi, eax
test esi, esi
je 0x8f867d9
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
mov byte [ebx + esi - 1], 0
mov byte [ebx + esi - 2], 0
test byte [ebp - 4], 1
je 0x8f86773
mov byte [ebx + esi - 3], 0
test eax, eax
je 0x8f8682a
cmp eax, 2
je 0x8f8678b
push eax
push 0x8f727d8
jmp 0x8f8688f
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x8f8681e
cmp dword [ebp + 0xc], 7
push edi
jne 0x8f8680b
call fcn.08f84562
add eax, eax
push eax
push edi
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x8f8682a
push eax
push dword [ebp + 0x10]
push 0x8f72790
call fcn.08f876b8
add esp, 0xc
push esi
call fcn.08f837bd
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x8f867e9
and dword [edi], 0
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x8f8671e
cmp dword [ebp + 0xc], 7
jne 0x8f8689b
push ebx
call fcn.08f84562
add eax, eax
jmp 0x8f868b2
push ebx
push esi
call fcn.08f8459b
test eax, eax
jge 0x8f867af
push eax
push 0x8f72954
jmp 0x8f8688f
push 0x8f72900
call fcn.08f876b8
jmp 0x8f86895
cmp dword [ebp + 0xc], 2
jne 0x8f8686d
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x8f867d9
lea eax, [ebx + ebx + 2]
push eax
mov dword [ebp - 4], eax
call fcn.08f83725
mov dword [ebp + 0x10], eax
test eax, eax
je 0x8f867d9
push ebx
push eax
push esi
call edi
test eax, eax
je 0x8f8687b
cmp eax, ebx
jg 0x8f8687b
push esi
call fcn.08f837bd
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x8f868e1
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x8f868e1
push dword [ebp + 0x10]
call fcn.08f837bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x8f728a8
call fcn.08f876b8
pop ecx
pop ecx
jmp 0x8f867d9
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x8f868a0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 4], eax
call fcn.08f83725
mov esi, eax
test esi, esi
je 0x8f8671e
cmp dword [ebp + 0xc], 7
jne 0x8f868ea
push dword [ebp - 4]
push ebx
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, edi
je 0x8f868e1
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x14
push ebx
push dword [ebp - 4]
push esi
call fcn.08f8459b
test eax, eax
jge 0x8f868d8
push eax
push 0x8f72868
call fcn.08f876b8
pop ecx
pop ecx
push esi
call fcn.08f837bd
jmp 0x8f8671e