Function at 0x1000a7c7
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push 0xa2c
mov eax, 0x10035693
call fcn.1001f7cd
mov eax, ecx
mov dword [ebp - 0x904], eax
lea esi, [eax + 0x4120]
xor ecx, ecx
mov dword [ebp - 0x90c], esi
cmp cx, word [esi]
jne 0x1000a7f8
xor eax, eax
jmp 0x1000b0da
lea edi, [eax + 0x5188]
xor ebx, ebx
lea ecx, [ebp - 0x974]
mov dword [ebp - 0x914], edi
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [ebp - 0x918], ebx
call fcn.10018d09
mov ecx, dword [ebp - 0x904]
mov dword [ebp - 4], ebx
lea eax, [ecx + 0x2090]
cmp byte [ebp - 0x944], bl
je 0x1000a9c5
mov ecx, dword [ebp - 0x974]
push ebx
push eax
push esi
mov dword [ebp - 0x918], ecx
lea ecx, [ebp - 0x974]
push ebx
mov dword [ebp - 0x910], ebx
call fcn.10018d09
test al, al
jne 0x1000a8c7
lea eax, [ebp - 0x910]
push eax
mov eax, dword [ebp - 0x904]
lea ecx, [ebp - 0x974]
push ebx
add eax, 0x2090
push eax
push esi
push ebx
call fcn.10018d09
test al, al
jne 0x1000a8c7
mov esi, dword [ebp - 0x904]
add esi, 0x30d8
mov eax, dword [ebp - 0x904]
mov edx, esi
add eax, 0x2090
mov dword [ebp - 0x908], edx
cmp dword [ebp - 0x918], 4
mov ecx, eax
je 0x1000b099
cmp dword [ebp - 0x918], 0
jne 0x1000a9e4
jmp 0x1000a9cb
mov esi, dword [ebp - 0x904]
push ecx
add esi, 0x30d8
push esi
push edi
push ecx
lea ecx, [ebp - 0x974]
call fcn.10018d09
test al, al
je 0x1000a893
mov eax, dword [ebp - 0x918]
cmp eax, 4
jne 0x1000a93c
mov ecx, dword [ebp - 0x904]
lea eax, [ecx + 0x2090]
push eax
push dword [ebp - 0x90c]
mov dword [ebp - 0x910], eax
push ecx
lea ecx, [ebp - 0x974]
call fcn.10018d09
test al, al
je 0x1000b093
mov ecx, dword [ebp - 0x904]
add ecx, 0x2090
cmp dword [ebp - 0x950], 0
je 0x1000b099
jmp 0x1000b0c4
cmp eax, 2
jne 0x1000b0c4
mov eax, dword [ebp - 0x910]
test eax, eax
je 0x1000b0c4
mov esi, dword [ebp - 0x90c]
mov ecx, dword [eax + 4]
test esi, esi
jne 0x1000a964
mov ecx, ebx
jmp 0x1000a987
test ecx, ecx
je 0x1000a960
push 0xffffffffffffffff
push ecx
push 0x824
push esi
call fcn.10018d09
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
mov eax, dword [ebp - 0x910]
setne cl
test ecx, ecx
je 0x1000a9fd
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x904]
add eax, 0x2090
jne 0x1000a99f
mov ecx, ebx
jmp 0x1000a9bc
test edx, edx
je 0x1000a99b
push 0xffffffffffffffff
push edx
push 0x824
push eax
call fcn.10018d09
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
setne cl
test ecx, ecx
je 0x1000a9fd
jmp 0x1000b0c4
lea esi, [ecx + 0x30d8]
mov dword [ebp - 0x910], eax
mov dword [ebp - 0x908], esi
call fcn.10016e9e
test al, al
jne 0x1000b093
mov eax, dword [ebp - 0x918]
mov esi, dword [ebp - 0x90c]
cmp eax, 2
je 0x1000a9fd
test eax, eax
jne 0x1000ab06
mov eax, dword [ebp - 0x904]
xor edx, edx
push ecx
add eax, 0x30d8
mov ecx, esi
push eax
push edi
call fcn.10018d09
test eax, eax
jns 0x1000b0c4
mov ecx, dword [ebp - 0x904]
mov edx, esi
lea eax, [ecx + 0x30d8]
mov dword [ebp - 0x908], eax
lea eax, [ebp - 0x938]
push eax
push ecx
xor ecx, ecx
call fcn.10018d09
test eax, eax
je 0x1000ab06
mov ecx, dword [ebp - 0x904]
xor edx, edx
add ecx, 0x30d8
push ecx
push ecx
mov dword [ebp - 0x908], ecx
mov ecx, dword [ebp - 0x934]
push edi
call fcn.10018d09
test eax, eax
js 0x1000ab06
test esi, esi
jne 0x1000aa79
mov ecx, ebx
jmp 0x1000aaa0
cmp dword [ebp - 0x934], 0
je 0x1000aa75
push 0xffffffffffffffff
push dword [ebp - 0x934]
push 0x824
push esi
call fcn.10018d09
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
setne cl
mov edx, dword [ebp - 0x904]
lea eax, [edx + 0x30d8]
mov dword [ebp - 0x908], eax
test ecx, ecx
je 0x1000ab0c
lea eax, [edx + 0x2090]
test eax, eax
jne 0x1000aac4
mov ecx, ebx
jmp 0x1000aaf1
cmp dword [ebp - 0x930], 0
je 0x1000aac0
push 0xffffffffffffffff
push dword [ebp - 0x930]
push 0x824
push eax
call fcn.10018d09
mov edx, dword [ebp - 0x904]
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
setne cl
lea eax, [edx + 0x30d8]
mov dword [ebp - 0x908], eax
test ecx, ecx
je 0x1000ab0c
jmp 0x1000b0c4
mov eax, dword [ebp - 0x908]
mov ecx, dword [ebp - 0x918]
cmp ecx, 3
je 0x1000ab1f
test ecx, ecx
jne 0x1000ad40
test eax, eax
je 0x1000ad40
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0xa38]
call fcn.10007b32
push str.c2r32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
lea ecx, [ebp - 0xa38]
mov dword [ebp - 0x980], eax
call fcn.10007bee
cmp dword [ebp - 0xa34], 0
je 0x1000ab85
call dword [ebp - 0xa34]
test eax, eax
je 0x1000ab85
mov byte [ebp - 4], 1
cmp dword [ebp - 0xa30], 0
jne 0x1000ab7a
mov eax, ebx
jmp 0x1000ae91
call dword [ebp - 0xa30]
jmp 0x1000ae91
push 0x64
lea eax, [ebp - 0x78]
push ebx
push eax
call fcn.10021114
mov eax, 0x1003e770
add esp, 0xc
mov dword [ebp - 0x90c], eax
cmp dword [eax], ebx
je 0x1000abe2
test esi, esi
je 0x1000abbc
push dword [eax + 4]
push esi
call fcn.10018d09
pop ecx
test eax, eax
mov eax, dword [ebp - 0x90c]
pop ecx
je 0x1000abc9
add eax, 0x24
mov dword [ebp - 0x90c], eax
jne 0x1000ab9f
jmp 0x1000abe2
cmp dword [eax + 0x1c], 0
je 0x1000abe2
push 0xffffffffffffffff
push dword [eax + 0x1c]
lea eax, [ebp - 0x78]
push 0x32
push eax
call fcn.10018d09
add esp, 0x10
cmp word [ebp - 0x78], 0
je 0x1000ad40
push 0x10
pop esi
mov dword [ebp - 0x920], esi
push esi
push str.SoftwareMicrosoftOffice_i.0CommonInstallRootVirtual
lea eax, [ebp - 0x2e8]
push 0x104
push eax
call fcn.10018d09
add esp, 0x10
test eax, eax
je 0x1000ad40
mov eax, ebx
mov dword [ebp - 0x91c], ebx
mov eax, dword [eax*4 + 0x1003d830]
lea ecx, [ebp - 0x928]
push ecx
or eax, 1
mov dword [ebp - 0x910], ebx
push eax
push ebx
lea eax, [ebp - 0x2e8]
mov dword [ebp - 0x928], ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x924], eax
test eax, eax
jne 0x1000ac91
lea eax, [ebp - 0x92c]
mov dword [ebp - 0x92c], 0x64
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x910]
push eax
push ebx
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x928]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x924], eax
cmp dword [ebp - 0x928], 0
je 0x1000aca6
push dword [ebp - 0x928]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x924], 0
jne 0x1000ad14
cmp dword [ebp - 0x910], 1
je 0x1000acc1
cmp dword [ebp - 0x910], 2
jne 0x1000ad14
cmp dword [ebp - 0x910], 2
jne 0x1000ad0f
push 0x104
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x1000ad0f
push 0xffffffffffffffff
lea eax, [ebp - 0x4f0]
push eax
lea eax, [ebp - 0xe0]
push 0x32
push eax
call fcn.10018d09
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
setne cl
jmp 0x1000ad16
xor ecx, ecx
inc ecx
jmp 0x1000ad16
mov ecx, ebx
test ecx, ecx
jne 0x1000ad5f
mov eax, dword [ebp - 0x91c]
inc eax
mov dword [ebp - 0x91c], eax
cmp eax, 3
jb 0x1000ac20
dec esi
mov dword [ebp - 0x920], esi
cmp esi, 0xe
jae 0x1000abf6
mov eax, dword [ebp - 0x918]
cmp eax, 1
je 0x1000aea3
test eax, eax
je 0x1000aea3
xor ebx, ebx
inc ebx
jmp 0x1000b0c4
mov eax, dword [ebp - 0x90c]
cmp dword [eax + 0x20], ebx
je 0x1000ae8b
push esi
push str.SoftwareMicrosoftOffice_i.0ClickToRunStoreApplications
lea eax, [ebp - 0x6f8]
push 0x104
push eax
call fcn.10018d09
add esp, 0x10
test eax, eax
je 0x1000ae8b
mov eax, dword [ebp - 0x90c]
mov ecx, dword [ebp - 0x91c]
mov dword [ebp - 0x914], ebx
mov dword [ebp - 0x90c], ebx
mov eax, dword [eax + 0x20]
mov ecx, dword [ecx*4 + 0x1003d830]
mov dword [ebp - 0x918], eax
test eax, eax
je 0x1000ae8b
lea eax, [ebp - 0x90c]
or ecx, 1
push eax
push ecx
push ebx
lea eax, [ebp - 0x6f8]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x908]
mov dword [ebp - 0x924], eax
test eax, eax
jne 0x1000ae20
lea eax, [ebp - 0x91c]
mov dword [ebp - 0x91c], 0x1048
push eax
push esi
lea eax, [ebp - 0x914]
push eax
push ebx
push dword [ebp - 0x918]
push dword [ebp - 0x90c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x924], eax
cmp dword [ebp - 0x90c], 0
je 0x1000ae35
push dword [ebp - 0x90c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x924], 0
jne 0x1000ae8b
cmp dword [ebp - 0x914], 1
je 0x1000ae50
cmp dword [ebp - 0x914], 2
jne 0x1000ae8b
cmp dword [ebp - 0x914], 2
jne 0x1000ae8b
push 0x104
lea eax, [ebp - 0x900]
push eax
push esi
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
ja 0x1000ae8b
push 0xffffffffffffffff
lea eax, [ebp - 0x900]
push eax
push 0x824
push esi
call fcn.10018d09
add esp, 0x10
mov eax, dword [ebp - 0x920]
mov ecx, ebx
mov dword [edi], eax
mov dword [edi + 4], ecx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], ecx
jmp 0x1000b0c4
push 0x2e
push dword [ebp - 0x904]
call fcn.10018d09
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x1000aec3
xor eax, eax
cmp ax, word [esi]
jne 0x1000b03f
mov ecx, dword [ebp - 0x904]
mov eax, ebx
add ecx, 0x2090
mov dword [ebp - 0x91c], ebx
mov dword [ebp - 0x920], ecx
mov edx, dword [eax + 0x1003e650]
mov di, word [ecx]
cmp di, word [edx]
mov edi, dword [ebp - 0x914]
jne 0x1000af22
cmp word [ecx], 0
je 0x1000af1e
mov di, word [ecx + 2]
cmp di, word [edx + 2]
mov word [ebp - 0x906], di
mov edi, dword [ebp - 0x914]
jne 0x1000af22
add ecx, 4
add edx, 4
cmp word [ebp - 0x906], 0
jne 0x1000aee3
mov ecx, ebx
jmp 0x1000af27
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1000af7f
mov edx, dword [eax + 0x1003e654]
mov ecx, dword [ebp - 0x920]
mov di, word [ecx]
cmp di, word [edx]
mov edi, dword [ebp - 0x914]
jne 0x1000af76
cmp word [ecx], 0
je 0x1000af72
mov di, word [ecx + 2]
cmp di, word [edx + 2]
mov word [ebp - 0x906], di
mov edi, dword [ebp - 0x914]
jne 0x1000af76
add ecx, 4
add edx, 4
cmp word [ebp - 0x906], 0
jne 0x1000af37
mov ecx, ebx
jmp 0x1000af7b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jne 0x1000af87
cmp dword [eax + 0x1003e658], ebx
je 0x1000afa6
inc dword [ebp - 0x91c]
add eax, 0xc
mov ecx, dword [ebp - 0x920]
cmp eax, 0xf0
jb 0x1000aedd
jmp 0x1000b076
mov eax, dword [ebp - 0x91c]
test eax, eax
js 0x1000b076
imul eax, eax, 0xc
mov dword [ebp - 0x92c], eax
mov eax, ebx
mov ecx, dword [eax + 0x1003df78]
test ecx, ecx
je 0x1000b02d
mov edx, dword [eax + 0x1003df70]
mov dword [ebp - 0x920], edx
test edx, edx
je 0x1000b02d
mov edx, dword [ebp - 0x92c]
mov edx, dword [edx + 0x1003e654]
mov di, word [ecx]
cmp di, word [edx]
mov edi, dword [ebp - 0x914]
jne 0x1000b024
cmp word [ecx], 0
je 0x1000b020
mov di, word [ecx + 2]
cmp di, word [edx + 2]
mov word [ebp - 0x906], di
mov edi, dword [ebp - 0x914]
jne 0x1000b024
add ecx, 4
add edx, 4
cmp word [ebp - 0x906], 0
jne 0x1000afe5
mov ecx, ebx
jmp 0x1000b029
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1000b039
add eax, 0x20
cmp eax, 0x200
jb 0x1000afbf
jmp 0x1000b03f
mov esi, dword [ebp - 0x920]
test esi, esi
je 0x1000b076
xor eax, eax
cmp ax, word [esi]
je 0x1000b076
mov ecx, dword [ebp - 0x904]
call fcn.10009ab8
test edi, edi
je 0x1000b070
mov edx, edi
mov ecx, esi
call fcn.10018d09
test eax, eax
je 0x1000b070
xor eax, eax
cmp dword [edi], 8
sete al
jmp 0x1000b072
mov eax, ebx
test eax, eax
jne 0x1000b07d
mov ebx, 0x80041605
jmp 0x1000b0c4
cmp dword [edi], 8
je 0x1000b0c4
mov dword [edi], 8
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
jmp 0x1000b0c4
mov ecx, dword [ebp - 0x910]
push ecx
push esi
push ecx
push dword [ebp - 0x904]
lea ecx, [ebp - 0x940]
call fcn.10018d09
cmp byte [ebp - 0x930], 0
je 0x1000ad57
lea esi, [ebp - 0x940]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x944], 0
je 0x1000b0d8
lea ecx, [ebp - 0x974]
call fcn.100169b9
mov eax, ebx
call fcn.1001f782
ret