Function at 0x100a29d
Capabilities:
Query or enumerate registry value
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xfc
mov eax, dword [0x100f6ec]
or dword [ebp - 0x88], 0xffffffff
push ebx
xor ebx, ebx
mov dword [ebp + 0x70], eax
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
push ebx
push 3
push ebx
push ebx
push ebx
push 0x1001e00
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x100a30c
mov al, byte [0x1029a64]
test al, 1
je 0x100a675
test al, 2
je 0x100a675
mov dword [0x102a24c], 0x102aa80
jmp 0x100a675
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push 4
pop edi
lea eax, [ebp - 0x78]
push eax
push 0x102a1d4
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x1001dec
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], edi
call esi
test eax, eax
je 0x100a33c
mov dword [0x102a1d4], ebx
lea eax, [ebp - 0x78]
push eax
push 0x100f7c4
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x1001684
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], edi
call esi
test eax, eax
je 0x100a365
mov dword [0x100f7c4], 1
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push 0x30
lea eax, [ebp + 0x10]
push eax
push 0x79
push dword [0x10299d0]
call ebx
mov al, byte [0x1029a64]
test al, 1
mov dword [ebp - 0x78], edi
je 0x100a3bc
test al, 2
je 0x100a3bc
mov eax, dword [ebp + 0x7c]
add eax, 0x30
lea ecx, [ebp - 0x78]
push ecx
push eax
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x80]
push eax
push 0
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 0x7c]
call esi
test eax, eax
je 0x100a3dc
mov eax, dword [ebp - 0x84]
or word [eax], 0x4080
jmp 0x100a3dc
mov eax, dword [ebp + 0x7c]
add eax, 0x30
lea ecx, [ebp - 0x78]
push ecx
push eax
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x80]
push eax
push 0
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 0x7c]
call esi
push 0x30
lea eax, [ebp + 0x10]
push eax
push 0x7a
push dword [0x10299d0]
call ebx
lea eax, [ebp - 0x78]
push eax
mov eax, dword [ebp + 0x7c]
add eax, 0x2c
push eax
lea eax, [ebp - 0x80]
push eax
push 0
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], edi
call esi
lea eax, [ebp - 0x78]
push eax
push 0x102ab80
lea eax, [ebp - 0x80]
push eax
push 0
push 0x1001824
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], edi
call esi
test eax, eax
je 0x100a430
and dword [0x102ab80], 0
lea eax, [ebp - 0x78]
push eax
push 0x102ab84
lea eax, [ebp - 0x80]
push eax
push 0
push 0x1001808
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], edi
call esi
test eax, eax
je 0x100a457
and dword [0x102ab84], 0
lea eax, [ebp - 0x78]
push eax
push 0x100f75c
lea eax, [ebp - 0x80]
push eax
push 0
push 0x1001818
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], edi
call esi
test eax, eax
je 0x100a49c
test byte [0x100f743], 0x80
je 0x100a489
and dword [0x100f75c], 0
jmp 0x100a4a5
mov dword [0x100f75c], 1
or byte [0x102a261], 1
jmp 0x100a4ac
cmp dword [0x100f75c], 0
jne 0x100a493
and byte [0x102a261], 0xfe
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0x10017fc
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], 0x105
call esi
lea eax, [ebp - 0x74]
push 0x1001ddc
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x100a506
lea eax, [ebp - 0x74]
push 0x1001dcc
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x100a506
lea eax, [ebp - 0x74]
push 0x1001dcc
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x74]
push eax
push 0x100137c
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov al, byte [0x1029a64]
test al, 1
je 0x100a66a
test al, 2
je 0x100a66a
push 0x30
lea eax, [ebp + 0x10]
push eax
push 0xc1
push dword [0x10299d0]
call ebx
mov eax, dword [ebp + 0x7c]
add eax, 0x50
lea ecx, [ebp - 0x78]
push ecx
push eax
lea eax, [ebp - 0x80]
push eax
push 0
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], edi
call esi
test eax, eax
je 0x100a567
mov eax, dword [ebp + 0x7c]
add eax, 0x50
and dword [eax], 0
push 0x30
lea eax, [ebp + 0x10]
push eax
push 0xc2
push dword [0x10299d0]
call ebx
mov dword [ebp - 0x78], edi
mov edi, dword [ebp + 0x7c]
lea eax, [ebp - 0x78]
push eax
add edi, 0x54
push edi
lea eax, [ebp - 0x80]
push eax
push 0
lea eax, [ebp + 0x10]
push eax
push dword [ebp - 0x7c]
call esi
test eax, eax
je 0x100a5be
mov al, byte [0x1029a64]
test al, 1
je 0x100a5bb
test al, 2
je 0x100a5bb
xor ebx, ebx
inc ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardType]
cmp ah, 0xd
jne 0x100a5bb
mov dword [edi], ebx
jmp 0x100a5be
and dword [edi], 0
test byte [edi], 1
jne 0x100a5e4
mov edx, dword [ebp - 0x84]
mov eax, dword [edx]
mov ecx, 0x280
mov edi, eax
and edi, ecx
cmp edi, ecx
jne 0x100a5e4
and eax, 0xfffffdff
or eax, 0x4080
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp eax, 0x3a4
jne 0x100a632
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0x1001624
push dword [ebp - 0x7c]
call esi
test eax, eax
jne 0x100a632
mov edx, dword [ebp - 0x88]
test edx, edx
jl 0x100a632
mov ecx, 0x100e878
cmp edx, dword [ecx]
je 0x100a685
add ecx, 0x210
inc eax
cmp ecx, 0x100f6e8
jl 0x100a61f
and byte [0x100f740], 0x3f
and byte [0x102a261], 0xef
and word [0x102a3d8], 0
and dword [0x102a3d4], 0
mov byte [0x100f741], 0
push 0x102a1cc
mov dword [0x102a24c], 0x102aa80
call fcn.01006fd7
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp + 0x70]
pop ebx
call fcn.0100c260
add ebp, 0x74
leave
ret 4
or byte [0x102a261], 0x10
imul eax, eax, 0x210
mov ecx, dword [eax + 0x100e878]
mov eax, dword [eax + 0x100e87c]
or ecx, 0x80
mov byte [0x100f741], 0
or dword [0x100f740], ecx
mov dword [0x102a3d4], eax
jmp 0x100a656