Function at 0x10002008
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005de3e
mov eax, dword fs:[0]
push eax
sub esp, 0x50
push ebx
push esi
push edi
mov eax, dword [0x10072414]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov ebx, ecx
mov dword [esp + 0x1c], ebx
mov eax, dword [ebx + 8]
xor ecx, ecx
inc ecx
mov dword [esp + 0x20], ecx
cmp eax, ecx
jne 0x100020bf
push 0x104
lea esi, [ebx + 0x18]
mov edi, dword [esi]
push 0x105
call fcn.100029f5
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
call fcn.10002a2a
lea edi, [ebx + 0x1c]
mov eax, esi
call fcn.10002660
lea ecx, [esp + 0x3c]
mov eax, edi
call fcn.10002926
and dword [esp + 0x68], 0
mov esi, 0x10064408
push eax
mov ecx, esi
call fcn.10002cc2
test eax, eax
setne byte [esp + 0x13]
or dword [esp + 0x68], 0xffffffff
mov eax, dword [esp + 0x3c]
add eax, 0xfffffff0
call fcn.10003787
cmp byte [esp + 0x13], 0
je 0x100021e1
push esi
push edi
call fcn.100026a1
jmp 0x100021e1
test eax, eax
jne 0x100021e1
push 0x1006440c
lea esi, [ebx + 0xc]
push esi
xor edi, edi
call fcn.100026d6
test eax, eax
jne 0x100020e2
mov edi, 0x80000000
jmp 0x10002122
push str.hkcu
push esi
call fcn.100026d6
test eax, eax
jne 0x100020f8
mov edi, 0x80000001
jmp 0x10002122
push str.hklm
push esi
call fcn.100026d6
test eax, eax
jne 0x1000210e
mov edi, 0x80000002
jmp 0x10002122
push str.hkus
push esi
call fcn.100026d6
test eax, eax
jne 0x10002122
mov edi, 0x80000003
xor eax, eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x68], 1
push dword [ebx + 0x10]
mov eax, 0x20019
push edi
lea ebx, [esp + 0x54]
call fcn.100038f2
test eax, eax
jne 0x100021c7
mov eax, dword [esp + 0x1c]
mov edi, dword [eax + 0x14]
lea ebx, [eax + 0x1c]
push 0x105
mov esi, ebx
mov dword [esp + 0x40], 0x104
call fcn.100029f5
push edi
lea ecx, [esp + 0x50]
push ecx
lea esi, [esp + 0x44]
mov edi, eax
call fcn.1000382b
mov esi, ebx
call fcn.10002a2a
lea ecx, [esp + 0x3c]
mov eax, ebx
call fcn.10002926
mov esi, 0x10064408
push eax
mov ecx, esi
mov byte [esp + 0x6c], 2
call fcn.10002cc2
test eax, eax
mov byte [esp + 0x68], 1
mov eax, dword [esp + 0x3c]
setne byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.10003787
cmp byte [esp + 0x13], 0
je 0x100021c7
push esi
push ebx
call fcn.100026a1
or dword [esp + 0x68], 0xffffffff
cmp dword [esp + 0x4c], 0
je 0x100021dd
push dword [esp + 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [esp + 0x1c]
xor eax, eax
cmp dword [ebx + 0x24], eax
jbe 0x100021f9
mov ecx, dword [ebx + 0x1c]
cmp dword [ecx - 0xc], eax
jg 0x100021f9
mov dword [esp + 0x20], eax
jmp 0x10002458
mov eax, dword [ebx + 0x20]
mov esi, dword [eax]
mov dword [esp + 0x30], esi
cmp esi, eax
je 0x10002458
jmp 0x10002210
mov esi, dword [esp + 0x30]
lea eax, [esi + 8]
push eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x1c]
push eax
lea edi, [ebx + 0x1c]
call fcn.100029a6
pop ecx
pop ecx
mov dword [esp + 0x68], 3
push dword [esp + 0x18]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000242b
mov eax, dword [esi + 0xc]
xor edi, edi
cmp dword [eax - 0xc], edi
jle 0x10002409
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], edi
call fcn.1000be01
xor ebx, ebx
xor esi, esi
add esp, 0x10
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], esi
mov dword [esp + 0x54], edi
push 0x100644f8
lea eax, [esp + 0x18]
push eax
mov byte [esp + 0x70], 4
call fcn.100025cc
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x24]
add eax, 4
mov byte [esp + 0x68], 5
push ecx
mov dword [esp + 0x38], edi
push eax
lea edi, [esp + 0x3c]
mov dword [esp + 0x48], eax
call fcn.1000284e
jmp 0x1000235a
lea eax, [esp + 0x14]
cmp eax, esi
jae 0x1000231f
cmp ebx, eax
ja 0x1000231f
mov edi, eax
sub edi, ebx
sar edi, 2
cmp esi, dword [esp + 0x54]
jne 0x100022f5
lea ecx, [esp + 0x4c]
call fcn.10002ec1
mov esi, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
lea eax, [ebx + edi*4]
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
mov byte [esp + 0x68], 7
test esi, esi
je 0x10002318
mov eax, dword [eax]
sub eax, 0x10
call fcn.10003018
add eax, 0x10
mov dword [esi], eax
mov byte [esp + 0x68], 5
jmp 0x10002341
cmp esi, dword [esp + 0x54]
jne 0x10002336
lea ecx, [esp + 0x4c]
call fcn.10002ec1
mov esi, dword [esp + 0x50]
mov ebx, dword [esp + 0x4c]
lea eax, [esp + 0x14]
push eax
call fcn.10003465
pop ecx
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x44]
add esi, 4
lea edi, [esp + 0x3c]
mov dword [esp + 0x58], esi
call fcn.1000284e
lea edi, [esp + 0x14]
mov byte [esp + 0x68], 6
call fcn.10002660
push eax
mov ecx, 0x100644f8
call fcn.10002cc2
test eax, eax
mov byte [esp + 0x68], 5
mov eax, dword [esp + 0x24]
setne byte [esp + 0x13]
add eax, 0xfffffff0
call fcn.10003787
cmp byte [esp + 0x13], 0
jne 0x100022cb
sub esi, ebx
and esi, 0xfffffffc
cmp esi, 0x10
jne 0x100023ec
push dword [ebx]
call fcn.100434b8
push dword [ebx + 4]
mov esi, eax
call fcn.100434b8
push dword [ebx + 8]
mov edi, eax
call fcn.100434b8
push dword [ebx + 0xc]
mov dword [esp + 0x44], eax
call fcn.100434b8
add esp, 0x10
cmp dword [esp + 0x28], esi
jl 0x10002432
jne 0x100023ec
cmp dword [esp + 0x2c], edi
jl 0x10002432
jne 0x100023ec
mov ecx, dword [esp + 0x38]
cmp ecx, dword [esp + 0x34]
jl 0x10002432
jne 0x100023ec
cmp dword [esp + 0x3c], eax
jl 0x10002432
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
call fcn.10003787
lea esi, [esp + 0x4c]
call fcn.10002b76
mov ebx, dword [esp + 0x1c]
mov esi, dword [esp + 0x30]
or dword [esp + 0x68], 0xffffffff
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.10003787
mov esi, dword [esi]
mov dword [esp + 0x30], esi
cmp esi, dword [ebx + 0x20]
jne 0x1000220c
jmp 0x10002458
and dword [esp + 0x20], 0
jmp 0x1000244c
mov eax, dword [esp + 0x14]
and dword [esp + 0x20], 0
add eax, 0xfffffff0
call fcn.10003787
lea esi, [esp + 0x4c]
call fcn.10002b76
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.10003787
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret