Function at 0x1008c0f
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x860
mov eax, dword [0x100f3b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, 0x1001690
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x858], eax
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x844]
push eax
xor ebx, ebx
mov edi, 0x20019
push edi
push ebx
lea eax, [ebp - 0x10]
push eax
push 0x80000001
mov dword [ebp - 0x840], ebx
mov dword [ebp - 0x844], ebx
mov dword [ebp - 0x848], ebx
mov dword [ebp - 0x83c], 1
call esi
test eax, eax
je 0x1008c84
xor eax, eax
jmp 0x1008f0a
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
push 0x1001688
lea eax, [ebp - 0x20]
push 8
push eax
call fcn.01002e37
add esp, 0x10
test eax, eax
jl 0x1008ecd
lea eax, [ebp - 0x840]
push eax
push edi
push ebx
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x844]
call esi
test eax, eax
jne 0x1008ede
lea eax, [ebp - 0x854]
push eax
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x860]
push eax
push ebx
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x428]
push eax
push ebx
push dword [ebp - 0x840]
mov dword [ebp - 0x84c], ebx
mov dword [ebp - 0x850], 0x100
mov dword [ebp - 0x854], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1008ede
mov esi, dword [sym.imp.KERNEL32.dll_CompareStringW]
mov edi, 0x100152c
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x428]
push eax
push 1
push 0x7f
call esi
cmp eax, 2
jne 0x1008d4e
cmp dword [ebp - 0x848], ebx
jne 0x1008e73
mov dword [ebp - 0x848], 1
push 0x104
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, 2
jb 0x1008ecd
cmp word [ebp - 0x226], 0x3a
jne 0x1008d92
lea eax, [ebp - 0x228]
push 0x1001684
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
jne 0x1008e02
lea eax, [ebp - 0x228]
push eax
push 0x104
lea eax, [ebp - 0x838]
push eax
call fcn.01002dc8
test eax, eax
jl 0x1008ecd
push 0x104
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push 0x1001674
push 0x104
lea eax, [ebp - 0x228]
push eax
call fcn.01008555
test eax, eax
jl 0x1008ecd
lea eax, [ebp - 0x838]
push eax
push 0x104
lea eax, [ebp - 0x228]
push eax
call fcn.01008555
test eax, eax
jl 0x1008ecd
lea eax, [ebp - 0x85c]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.01007cc7
mov ebx, eax
lea eax, [ebp - 0x428]
test ebx, ebx
jne 0x1008e42
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push eax
push 1
push 0x7f
call esi
cmp eax, 2
jne 0x1008e71
cmp dword [ebp - 0x848], ebx
je 0x1008e71
and dword [ebp - 0x848], ebx
jmp 0x1008e71
push eax
mov eax, dword [ebp - 0x858]
push 0x20
add eax, 0x1c
push eax
call fcn.01002dc8
test eax, eax
jl 0x1008ed5
mov eax, dword [ebp - 0x85c]
dec eax
push eax
push ebx
push 0x10000004
push dword [ebp - 0x858]
call fcn.010085af
xor ebx, ebx
inc dword [ebp - 0x84c]
lea eax, [ebp - 0x854]
push eax
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x860]
push eax
push ebx
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 0x84c]
mov dword [ebp - 0x850], 0x100
push dword [ebp - 0x840]
mov dword [ebp - 0x854], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1008d21
jmp 0x1008ede
mov dword [ebp - 0x83c], ebx
jmp 0x1008ede
and dword [ebp - 0x83c], 0
xor ebx, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x840], ebx
je 0x1008ef4
push dword [ebp - 0x840]
call esi
cmp dword [ebp - 0x844], ebx
je 0x1008f04
push dword [ebp - 0x844]
call esi
mov eax, dword [ebp - 0x83c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100c8fb
leave
ret 4