Function at 0x1007c9b
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x854
push ebx
push esi
push edi
mov esi, 0x10016a8
lea edi, [ebp - 0x2c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x18]
push eax
mov edi, 0x20019
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
push 0x80000001
mov dword [ebp - 4], ebx
call esi
test eax, eax
je 0x1007cdf
xor eax, eax
jmp 0x1007ea6
call dword [sym.imp.KERNEL32.dll_GetACP]
push eax
lea eax, [ebp - 0x3c]
push 0x100168c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x18]
call esi
test eax, eax
je 0x1007d19
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1007ea3
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x444]
push eax
push ebx
push dword [ebp - 0x10]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 0x100
mov dword [ebp - 0x14], 0x208
call esi
test eax, eax
jne 0x1007e93
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x10014ec
lea eax, [ebp - 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1007d85
cmp dword [ebp - 4], eax
jne 0x1007e56
mov dword [ebp - 4], 1
mov edi, 0x104
push edi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x64c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp word [ebp - 0x242], 0x3a
jne 0x1007dc1
lea eax, [ebp - 0x244]
push 0x10016a4
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
jne 0x1007e01
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x854]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
push 0x1001694
lea eax, [ebp - 0x244]
push eax
call ebx
lea eax, [ebp - 0x854]
push eax
lea eax, [ebp - 0x244]
push eax
call ebx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x244]
push eax
call fcn.01006fc9
mov edi, eax
test edi, edi
lea eax, [ebp - 0x444]
jne 0x1007e37
push 0x10014ec
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1007e56
cmp dword [ebp - 4], eax
je 0x1007e56
and dword [ebp - 4], eax
jmp 0x1007e56
push eax
mov eax, dword [ebp + 8]
add eax, 0x1c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x1c]
push edi
push 0x10000004
push dword [ebp + 8]
call fcn.0100752b
inc dword [ebp - 0xc]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0xc]
mov dword [ebp - 8], 0x100
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 0x208
call esi
test eax, eax
je 0x1007d5f
push dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x18]
call esi
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 4