Function at 0x1010504
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018209
mov eax, dword fs:[0]
push eax
mov eax, 0x1044
call fcn.010133d0
mov eax, dword [0x101c20c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x104c], ecx
call fcn.0100f737
mov esi, 0x1002580
xor edi, edi
push esi
lea ecx, [ebp - 0x1038]
mov dword [ebp - 4], edi
call fcn.0100f8d6
push esi
lea ecx, [ebp - 0x102c]
mov byte [ebp - 4], 1
call fcn.0100f8d6
push esi
lea ecx, [ebp - 0x1040]
mov byte [ebp - 4], 2
call fcn.0100f8d6
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp - 0x1028]
push eax
push 0x1002748
push SysReAllocString
mov byte [ebp - 4], 3
mov dword [ebp - 0x1034], edi
mov dword [ebp - 0x1028], edi
call ebx
test eax, eax
jne 0x1010794
push 0x200
lea eax, [ebp - 0x410]
push eax
push edi
push dword [ebp - 0x1028]
mov dword [ebp - 0x1044], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1010788
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc dword [ebp - 0x1044]
lea eax, [ebp - 0x410]
push eax
lea ecx, [ebp - 0x102c]
call fcn.0100a18b
lea eax, [ebp - 0x1024]
push eax
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x1028]
mov dword [ebp - 0x1024], edi
call ebx
test eax, eax
jne 0x1010762
lea eax, [ebp - 0x1030]
push eax
lea eax, [ebp - 0x1034]
push eax
push edi
push edi
push 0x1002724
push dword [ebp - 0x1024]
mov dword [ebp - 0x1034], edi
mov dword [ebp - 0x1030], 4
call esi
lea eax, [ebp - 0x1030]
push eax
lea eax, [ebp - 0x1020]
push eax
push edi
push edi
push 0x1002710
push dword [ebp - 0x1024]
mov dword [ebp - 0x1030], 0x800
call esi
lea eax, [ebp - 0x1020]
push eax
lea ecx, [ebp - 0x1038]
call fcn.0100a18b
lea eax, [ebp - 0x103c]
push eax
push 0x10026c0
push dword [ebp - 0x1024]
mov dword [ebp - 0x103c], edi
call ebx
test eax, eax
jne 0x1010756
lea eax, [ebp - 0x1050]
push eax
lea eax, [ebp - 0x820]
push eax
push edi
push edi
push 0x10026a4
push dword [ebp - 0x103c]
mov dword [ebp - 0x1050], 0x208
call esi
push 0x104
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x820]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0x1040]
call fcn.0100a18b
push 0x10
call fcn.01012b8f
pop ecx
mov ecx, eax
mov dword [ebp - 0x1048], ecx
cmp ecx, edi
mov byte [ebp - 4], 4
je 0x1010724
push dword [ebp - 0x1040]
push dword [ebp - 0x1034]
push dword [ebp - 0x1038]
push dword [ebp - 0x102c]
call fcn.010100b7
jmp 0x1010726
xor eax, eax
cmp eax, edi
mov byte [ebp - 4], 3
mov dword [ebp - 0x1048], eax
je 0x101074a
mov ecx, dword [ebp - 0x104c]
mov eax, dword [ecx + 4]
lea edx, [ebp - 0x1048]
push edx
push eax
call fcn.01010103
push dword [ebp - 0x103c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x1024]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x200
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x1044]
push dword [ebp - 0x1028]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x10105d7
push dword [ebp - 0x1028]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1040]
add ecx, 0xfffffff0
call fcn.01008d5a
mov ecx, dword [ebp - 0x102c]
add ecx, 0xfffffff0
call fcn.01008d5a
mov ecx, dword [ebp - 0x1038]
add ecx, 0xfffffff0
call fcn.01008d5a
mov eax, dword [ebp - 0x104c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.01013069
leave
ret