Function at 0x100900f
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x101203c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x218], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x224], eax
mov eax, dword [ebp + 0x18]
push 0x41
mov dword [ebp - 0x220], eax
xor eax, eax
test byte [ebp + 8], 1
pop ecx
lea edi, [ebp - 0x20c]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov esi, 0x104
je 0x100911a
mov byte [ebx], al
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0x1001f78
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100911a
lea eax, [ebp - 0x210]
push eax
push ebx
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x100210c
push dword [ebp - 0x214]
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100910e
dec dword [ebp - 0x210]
mov eax, dword [ebp - 0x210]
add eax, ebx
push eax
push ebx
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x5c
je 0x10090eb
mov eax, dword [ebp - 0x210]
mov byte [ebx + eax], 0x5c
inc dword [ebp - 0x210]
mov eax, dword [ebp - 0x210]
mov byte [ebx + eax], 0
cmp dword [ebp - 0x21c], 2
jne 0x100910e
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push esi
lea eax, [ebp - 0x20c]
push eax
push ebx
call edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
mov ebx, eax
and ebx, 2
je 0x100912d
mov ecx, dword [ebp - 0x218]
mov byte [ecx], 0
test al, 4
je 0x100913a
mov ecx, dword [ebp - 0x224]
mov byte [ecx], 0
test al, 8
je 0x1009147
mov ecx, dword [ebp - 0x220]
mov byte [ecx], 0
test al, 0xe
je 0x10092ec
lea eax, [ebp - 0x214]
push eax
push 1
push 0
push 0x10066e0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10092ec
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x21c]
push eax
push 0
push 0x1005520
push dword [ebp - 0x214]
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10092e0
dec dword [ebp - 0x210]
mov eax, dword [ebp - 0x210]
lea eax, [ebp + eax - 0x108]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharPrevA]
cmp byte [eax], 0x5c
je 0x10091eb
mov eax, dword [ebp - 0x210]
mov byte [ebp + eax - 0x108], 0x5c
inc eax
mov dword [ebp - 0x210], eax
mov byte [ebp + eax - 0x108], 0
cmp dword [ebp - 0x21c], 2
jne 0x100921a
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test ebx, ebx
mov ebx, dword [sym.imp.USER32.dll_LoadStringA]
mov dword [ebp - 0x210], eax
je 0x100926c
push esi
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x218]
call edi
mov eax, dword [ebp - 0x210]
mov ecx, esi
sub ecx, eax
push ecx
mov ecx, dword [ebp - 0x218]
add ecx, eax
push ecx
push 0x40b
push dword [0x1016cac]
call ebx
or dword [ebp + 8], 2
test byte [ebp + 8], 4
je 0x10092a7
push esi
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x224]
call edi
mov eax, dword [ebp - 0x210]
mov ecx, esi
sub ecx, eax
push ecx
mov ecx, dword [ebp - 0x224]
add ecx, eax
push ecx
push 0x408
push dword [0x1016cac]
call ebx
or dword [ebp + 8], 4
test byte [ebp + 8], 8
je 0x10092e0
push esi
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x220]
call edi
mov eax, dword [ebp - 0x210]
mov ecx, dword [ebp - 0x220]
sub esi, eax
push esi
add ecx, eax
push ecx
push 0x409
push dword [0x1016cac]
call ebx
or dword [ebp + 8], 8
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
call fcn.0100d058
leave
ret 0x14