Function at 0x101de76
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8ec
mov eax, dword [0x102a0ec]
and dword [ebp - 0x8e4], 0
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x8e0], eax
mov eax, dword [ebp + 0x10]
test eax, eax
mov dword [ebp - 0x8dc], 1
je 0x101e474
push ebx
mov ebx, 0x117
push ebx
lea ecx, [ebp - 0x6d0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x6d0]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
cmp dword [0x102c67c], 0
pop ecx
lea eax, [ebp - 0x6d0]
je 0x101deeb
push eax
call fcn.0101b58b
jmp 0x101e473
push esi
push edi
push eax
push ebx
lea eax, [ebp - 0x234]
push eax
call fcn.0100c535
mov esi, 0x100796c
lea eax, [ebp - 0x234]
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
mov edi, dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
mov dword [ebp - 0x8ec], eax
je 0x101e00a
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
mov ecx, dword [ebp - 0x8ec]
and word [ecx + eax*2], 0
lea eax, [ebp - 0x234]
push 0x5c
push eax
call edi
add esp, 0xc
mov esi, eax
neg esi
sbb esi, esi
neg esi
je 0x101e00a
lea eax, [ebp - 0x234]
push 0x22
push eax
call edi
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x8ec], eax
je 0x101dff2
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
push 0x10045c4
call esi
pop ecx
mov ecx, dword [ebp - 0x8ec]
lea eax, [ecx + eax*2]
push eax
push 0x103
lea eax, [ebp - 0x43c]
push eax
call fcn.0100c535
lea eax, [ebp - 0x43c]
push 0x22
push eax
call edi
test eax, eax
pop ecx
pop ecx
jne 0x101e00a
lea eax, [ebp - 0x43c]
push eax
call esi
cmp eax, 8
pop ecx
jbe 0x101e00a
push dword [ebp - 0x43c]
call dword [sym.imp.msvcrt.dll_iswalpha]
test eax, eax
pop ecx
je 0x101e00a
cmp word [ebp - 0x43a], 0x3a
jne 0x101e00a
cmp word [ebp - 0x438], 0x5c
jne 0x101e00a
lea eax, [ebp - 0x43c]
push eax
push ebx
lea eax, [ebp - 0x234]
push eax
call fcn.0100c535
xor esi, esi
inc esi
test esi, esi
je 0x101e00a
lea eax, [ebp - 0x234]
push eax
call fcn.01016f8a
test eax, eax
je 0x101e46e
cmp dword [0x102c678], 0
jne 0x101e0fe
push dword [0x102a0f4]
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.0100c535
mov eax, dword [ebp + 8]
xor esi, esi
sub eax, esi
mov ebx, 0x118
je 0x101e050
dec eax
dec eax
lea eax, [ebp - 0x234]
je 0x101e049
push 0x1007950
jmp 0x101e05b
push 0x100793c
jmp 0x101e05b
push 0x1007920
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.0100d4ff
push dword [ebp - 0x8e0]
lea eax, [ebp - 0x234]
push ebx
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x8e4]
push eax
push 1
push esi
lea eax, [ebp - 0x234]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101e46e
lea eax, [ebp - 0x8e8]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x8dc]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x10078ec
push dword [ebp - 0x8e4]
mov ebx, 0x230
mov dword [ebp - 0x8e8], ebx
call esi
test eax, eax
jne 0x101e105
cmp dword [ebp - 0x8dc], 1
jne 0x101e105
push dword [ebp - 0x8e4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x234]
push 0x1001780
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x101e105
xor eax, eax
jmp 0x101e471
lea eax, [ebp - 0x8e8]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x8dc]
push eax
push 0
push 0x1007350
push dword [ebp - 0x8e4]
mov dword [ebp - 0x8e8], ebx
call esi
test eax, eax
jne 0x101e167
cmp dword [ebp - 0x8dc], 1
jne 0x101e167
push dword [ebp - 0x8e4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x234]
push 0x1003320
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
jmp 0x101e471
and dword [ebp - 0x8ec], 0
lea eax, [ebp - 0x8e8]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x8dc]
push eax
push 0
push 0x10078cc
push dword [ebp - 0x8e4]
mov dword [ebp - 0x8e8], ebx
call esi
test eax, eax
jne 0x101e1c7
cmp dword [ebp - 0x8dc], 1
jne 0x101e1c7
lea eax, [ebp - 0x234]
push 0x1003320
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x101e1c7
mov dword [ebp - 0x8ec], 1
lea eax, [ebp - 0x8e8]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x8dc]
push eax
push 0
push 0x10078b0
push dword [ebp - 0x8e4]
mov dword [ebp - 0x8e8], ebx
call esi
test eax, eax
jne 0x101e2b9
cmp dword [ebp - 0x8dc], 1
jne 0x101e2b9
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x234]
push eax
mov dword [ebp - 0x8e0], eax
push 0x103
lea eax, [ebp - 0x8d8]
push eax
call fcn.0100c535
lea eax, [ebp - 0x8d8]
push 0x7c
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x101e247
and word [eax], 0
lea eax, [ebp - 0x8d8]
push 0x1004ed8
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x101e277
lea eax, [ebp - 0x8d8]
push 0x10078a8
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x101e281
mov dword [ebp - 0x8ec], 1
lea eax, [ebp - 0x8d8]
push eax
lea eax, [ebp - 0x6d0]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
jne 0x101e2b2
push 0x7c
push dword [ebp - 0x8e0]
call edi
test eax, eax
pop ecx
pop ecx
je 0x101e2b9
inc eax
inc eax
jmp 0x101e21a
xor esi, esi
jmp 0x101e45e
lea eax, [ebp - 0x8e8]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x8dc]
push eax
push 0
push 0x1007890
push dword [ebp - 0x8e4]
mov dword [ebp - 0x8e8], ebx
call esi
test eax, eax
jne 0x101e45b
cmp dword [ebp - 0x8dc], 1
jne 0x101e45b
cmp dword [ebp - 0x8ec], eax
mov ebx, dword [sym.imp.msvcrt.dll__wcsicmp]
jne 0x101e336
lea eax, [ebp - 0x234]
push 0x1004ed8
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x101e45b
lea eax, [ebp - 0x234]
push 0x10078a8
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x101e45b
mov esi, dword [sym.imp.msvcrt.dll__wcslwr]
lea eax, [ebp - 0x234]
push eax
call esi
lea eax, [ebp - 0x6d0]
push eax
call esi
pop ecx
pop ecx
lea esi, [ebp - 0x234]
push esi
push 0x103
lea eax, [ebp - 0x43c]
push eax
call fcn.0100c535
lea eax, [ebp - 0x43c]
push 0x7c
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x101e37d
and word [eax], 0
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x6d0]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x8e0], eax
jne 0x101e3d1
cmp dword [ebp - 0x8ec], eax
jne 0x101e443
lea eax, [ebp - 0x43c]
push 0x1004ed8
push eax
call ebx
test eax, eax
pop ecx
pop ecx
je 0x101e3d1
lea eax, [ebp - 0x43c]
push 0x10078a8
push eax
call ebx
test eax, eax
pop ecx
pop ecx
jne 0x101e443
mov eax, dword [ebp - 0x8e0]
lea ecx, [ebp - 0x6d0]
cmp eax, ecx
je 0x101e45b
movzx eax, word [eax - 2]
push eax
call dword [sym.imp.msvcrt.dll_iswalnum]
neg eax
sbb eax, eax
inc eax
pop ecx
mov dword [ebp - 0x8e0], eax
jne 0x101e45b
cmp word [ebp - 0x43c], 0x5c
je 0x101e443
lea eax, [ebp - 0x43c]
push eax
push 0x1007888
lea eax, [ebp - 0x4a0]
push 0x31
push eax
call fcn.0100d4d1
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x6d0]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
add esp, 0x18
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x8e0], eax
jne 0x101e45b
push 0x7c
push esi
call edi
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x101e2b2
inc esi
inc esi
jmp 0x101e356
xor esi, esi
inc esi
push dword [ebp - 0x8e4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x101e471
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.0101672d
leave
ret 0xc