Function at 0x10007cb5
Capabilities:
Query environment variable
Query or enumerate registry value
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebx], 0x1001cd44
lea edi, [ebx + 0xc]
mov dword [ebx + 4], 1
mov dword [ebx], 0x1001cd88
mov dword [ebx + 8], eax
call fcn.10010fce
push eax
mov ecx, edi
call fcn.10010df9
xor ecx, ecx
lea esi, [ebx + 0x230]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], ecx
mov dword [ebx + 0x18], ecx
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], ecx
mov dword [ebx + 0x24], ecx
call fcn.10010fce
push eax
mov ecx, esi
call fcn.10010df9
push dword [ebx + 8]
mov edx, str.bf1a281b_ad7b_4476_ac95_f47682990ce7
lea ecx, [esp + 0x14]
call fcn.1000a88e
pop ecx
push eax
mov ecx, esi
call fcn.10010ca5
mov ecx, dword [esp + 0x10]
add ecx, 0xfffffff0
call fcn.100110af
push ecx
push ecx
mov ecx, esi
call fcn.1000a930
cmp byte [ebp + 0xc], 0
je 0x10007fc4
xor eax, eax
mov dword [esp + 0xc], eax
push dword [eax*4 + 0x10019668]
mov edx, dword [ebx + 8]
lea ecx, [esp + 0x28]
call fcn.1001087d
mov edi, dword [esp + 0x28]
pop ecx
mov ecx, edi
call fcn.10011f76
test eax, eax
je 0x10007e47
lea eax, [esp + 0x24]
mov edx, str.bf1a281b_ad7b_4476_ac95_f47682990ce7
push eax
lea ecx, [esp + 0x2c]
call fcn.1000a88e
push ecx
lea ecx, [esp + 0x30]
call fcn.1000a930
mov esi, dword [esp + 0x28]
push edi
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
lea eax, [esp + 0x2c]
push eax
push 0x20019
push 4
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10007dd6
cmp dword [esp + 0xc], 0
jne 0x10007f7b
lea ecx, [esi - 0x10]
jmp 0x10007e42
lea eax, [esi - 0x10]
mov ecx, eax
mov dword [esp + 0x30], eax
call fcn.10010d87
mov ecx, dword [esp + 0x2c]
add eax, 0x10
mov dword [esp + 0x50], eax
add eax, 0xfffffff0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x54], ecx
mov ecx, dword [ebx + 0x1c]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], eax
cmp dword [ebx + 0x20], ecx
je 0x10007e27
mov ecx, eax
call fcn.10010d87
mov ecx, dword [esp + 0x1c]
add eax, 0x10
mov dword [ecx], eax
mov eax, dword [esp + 0x18]
mov dword [ecx + 4], eax
add dword [ebx + 0x1c], 8
jmp 0x10007e35
lea eax, [esp + 0x50]
push eax
push ecx
lea ecx, [ebx + 0x18]
call fcn.1000ea3d
mov ecx, dword [esp + 0x10]
call fcn.100110af
mov ecx, dword [esp + 0x30]
call fcn.100110af
lea ecx, [edi - 0x10]
call fcn.100110af
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
cmp eax, 0xa
jne 0x10007d55
push str.WindowsSystem32configSYSTEM
push dword [ebx + 8]
mov edx, str.bf1a281b_ad7b_4476_ac95_f47682990ce7
lea ecx, [esp + 0x40]
call fcn.1000a88e
pop ecx
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.1001087d
pop ecx
mov ecx, dword [esp + 0x38]
add ecx, 0xfffffff0
call fcn.100110af
push ecx
push ecx
lea ecx, [esp + 0x1c]
call fcn.1000a930
push str.Select
lea edx, [esp + 0x18]
lea ecx, [esp + 0x40]
call fcn.1001087d
pop ecx
lea edx, [esp + 0x40]
mov ecx, 0x80000002
push edx
mov edx, dword [eax]
push str.Default
call fcn.100120cd
pop ecx
pop ecx
mov ecx, dword [esp + 0x3c]
mov esi, eax
add ecx, 0xfffffff0
call fcn.100110af
test esi, esi
jne 0x10007fc0
push dword [esp + 0x40]
lea eax, [esp + 0x24]
push str.ControlSet_.3d
push eax
call fcn.10011126
add esp, 0xc
lea ecx, [esp + 0x4c]
mov edx, str.REGISTRYMACHINE_
push eax
lea eax, [esp + 0x18]
push eax
call fcn.1000a88e
pop ecx
mov edx, eax
lea ecx, [esp + 0x4c]
call fcn.1000a8da
lea edx, [esp + 0x18]
mov dword [esp], str.CurrentControlSet
lea ecx, [esp + 0x48]
mov esi, dword [eax]
call fcn.1001087d
pop ecx
push esi
mov edx, dword [eax]
call fcn.1001243c
pop ecx
mov ecx, dword [esp + 0x44]
mov esi, eax
add ecx, 0xfffffff0
call fcn.100110af
mov ecx, dword [esp + 0x48]
add ecx, 0xfffffff0
call fcn.100110af
mov ecx, dword [esp + 0x4c]
add ecx, 0xfffffff0
call fcn.100110af
mov ecx, dword [esp + 0x20]
lea ecx, [ecx - 0x10]
call fcn.100110af
test esi, esi
jne 0x10007fc0
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [esp + 0x14]
lea ecx, [ecx - 0x10]
jmp 0x10008164
push esi
lea eax, [esp + 0x38]
push 0x100184f0
push eax
call fcn.10011126
add esp, 0xc
push dword [eax]
push 0x10018508
push 1
call sym.CBSHost.dll_DismWriteLog
mov ecx, dword [esp + 0x34]
lea ecx, [ecx - 0x10]
call fcn.100110af
push 0xb
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi - 0x10]
call fcn.100110af
lea ecx, [edi - 0x10]
jmp 0x10008164
push 1
jmp 0x10007f69
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.10010d87
add eax, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [ebx + 8]
cmp dword [eax + 0xc], 0
lea eax, [ebx + 0x24]
push eax
je 0x10008001
push 0x20219
push str.SOFTWAREMicrosoftWindowsCurrentVersionComponent_Based_ServicingVersion
push 0x80000002
push ebx
call fcn.10008431
mov esi, str.WindowsSysWOW64downlevel_
jmp 0x1000801b
push 0x20019
push str.SOFTWAREMicrosoftWindowsCurrentVersionComponent_Based_ServicingVersion
push 0x80000002
push ebx
call fcn.10008431
mov esi, str.WindowsSystem32downlevel_
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
push eax
push esi
lea ecx, [esp + 0x14]
call fcn.100101eb
xor eax, eax
lea esi, [ebx + 0x28]
mov word [esi], ax
mov eax, dword [ebx + 0x24]
test eax, eax
jne 0x10008053
push 0x100186b0
push 0x10018508
push 1
call sym.CBSHost.dll_DismWriteLog
jmp 0x100080df
lea ecx, [esp + 0x18]
mov dword [esp + 0x1c], 0x104
push ecx
xor edx, edx
mov dword [esp + 0x1c], 0x208
lea ecx, [esp + 0x5c]
mov dword [esp + 0x14], edx
push ecx
push edx
push edx
lea ecx, [esp + 0x2c]
push ecx
push esi
push edx
push eax
jmp 0x100080a5
xor edx, edx
cmp word [esi], dx
jne 0x100080b1
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x5c]
inc eax
push ecx
push edx
push edx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], eax
push ecx
push esi
push eax
push dword [ebx + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1000807f
jmp 0x100080df
push edi
lea eax, [esp + 0x5c]
push eax
push ebx
call fcn.1000866a
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
test eax, eax
je 0x100080df
dec eax
mov ecx, edi
push eax
call fcn.10010278
push 0x5c
pop ecx
cmp ax, cx
je 0x100080df
push ecx
mov ecx, edi
call fcn.100103b2
mov esi, dword [esp + 0xc]
mov ecx, esi
call fcn.10011f76
test eax, eax
je 0x1000814a
push 0x3b
lea ecx, [esp + 0x10]
call fcn.100103b2
mov esi, dword [esp + 0xc]
mov eax, dword [esi - 0xc]
mov dword [esp + 0x20], eax
xor eax, eax
push eax
push eax
push str.Path
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1000813e
mov esi, dword [esp + 0x20]
lea ecx, [eax + 1]
push ecx
add eax, esi
lea ecx, [esp + 0x10]
push eax
call fcn.10010b77
lea eax, [eax + esi*2]
push eax
push str.Path
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, dword [esp + 0xc]
push esi
push str.Path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [edi]
xor edi, edi
cmp dword [eax - 0xc], edi
je 0x1000815a
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [esi - 0x10]
call fcn.100110af
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 8