Function at 0x10010012
Capabilities:
Enumerate files on windows
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xe9c
mov eax, dword [0x100400b0]
xor eax, esp
mov dword [esp + 0xe98], eax
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov dword [esp + 0x18], edx
or ebx, 0xffffffff
xor edx, edx
mov dword [esp + 0x14], eax
push edi
mov edi, ecx
mov esi, edx
mov dword [esp + 0xc], esi
test edi, edi
je 0x100100d2
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, dx
jne 0x10010054
sub esi, ecx
lea eax, [esp + 0x270]
sar esi, 1
cmp edi, eax
je 0x10010084
push ecx
push edi
mov edx, 0x104
mov ecx, eax
call fcn.1001a3af
test eax, eax
je 0x100101de
push 0x5c
pop eax
cmp ax, word [esp + esi*2 + 0x26e]
je 0x100100b6
push 0xffffffffffffffff
push 0x100393f0
lea eax, [esp + 0x278]
push 0x104
push eax
call fcn.1001a3af
add esp, 0x10
cmp eax, 0x50
je 0x100101de
push 0x10039754
mov edx, 0x104
lea ecx, [esp + 0x274]
call fcn.1001a3af
mov esi, dword [esp + 0xc]
jmp 0x100100d4
mov eax, edx
test eax, eax
je 0x100101de
lea eax, [esp + 0x20]
push eax
cmp ebx, 0xffffffff
jne 0x10010100
lea eax, [esp + 0x274]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileW]
mov ebx, eax
xor eax, eax
cmp ebx, 0xffffffff
setne al
jmp 0x10010107
push ebx
call dword [sym.imp.kernel32.dll_FindNextFileW]
test eax, eax
je 0x10010182
mov ecx, 0x10039384
lea eax, [esp + 0x4c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1001013a
test dx, dx
je 0x10010136
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1001013a
add eax, 4
add ecx, 4
test dx, dx
jne 0x10010114
xor eax, eax
jmp 0x1001013f
sbb eax, eax
or eax, 1
test eax, eax
je 0x100100dc
mov ecx, 0x10039374
lea eax, [esp + 0x4c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10010172
test dx, dx
je 0x1001016e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10010172
add eax, 4
add ecx, 4
test dx, dx
jne 0x1001014c
xor eax, eax
jmp 0x10010177
sbb eax, eax
or eax, 1
test eax, eax
je 0x100100dc
xor esi, esi
inc esi
cmp ebx, 0xffffffff
je 0x1001018e
push ebx
call dword [sym.imp.kernel32.dll_FindClose]
test esi, esi
je 0x100105fe
test byte [esp + 0x20], 0x10
je 0x100105fe
xor ebx, ebx
test edi, edi
je 0x1001023e
mov esi, edi
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
cmp ax, bx
jne 0x100101b0
sub esi, ecx
lea eax, [esp + 0x270]
sar esi, 1
cmp edi, eax
je 0x100101fa
push ecx
push edi
mov edi, 0x104
mov ecx, eax
mov edx, edi
call fcn.1001a3af
test eax, eax
jne 0x100101ff
mov eax, 0x80041003
mov ecx, dword [esp + 0xea4]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.1001c65c
mov esp, ebp
pop ebp
ret 0x14
mov edi, 0x104
push 0x5c
pop eax
cmp ax, word [esp + esi*2 + 0x26e]
je 0x10010229
push 0xffffffffffffffff
push 0x100393f0
lea eax, [esp + 0x278]
push edi
push eax
call fcn.1001a3af
add esp, 0x10
cmp eax, 0x50
je 0x100101de
lea eax, [esp + 0x4c]
mov edx, edi
push eax
lea ecx, [esp + 0x274]
call fcn.1001a3af
jmp 0x10010245
mov eax, ebx
mov edi, 0x104
test eax, eax
je 0x100101de
lea ecx, [esp + 0x270]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10010253
sub ecx, edx
sar ecx, 1
push 0x5c
pop eax
cmp ax, word [esp + ecx*2 + 0x26e]
je 0x10010290
push 0xffffffffffffffff
push 0x100393f0
lea eax, [esp + 0x278]
push edi
push eax
call fcn.1001a3af
add esp, 0x10
cmp eax, 0x50
je 0x100101de
push 0x10039754
mov edx, edi
lea ecx, [esp + 0x274]
call fcn.1001a3af
test eax, eax
je 0x100101de
push 0xffffffffffffffff
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x890]
push edi
push eax
call fcn.1001a3af
add esp, 0x10
cmp eax, 0x50
je 0x100101de
mov esi, str..TEM
lea ecx, [esp + 0x888]
mov edx, esi
call fcn.1001a3af
test eax, eax
jne 0x10010300
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x890]
push edi
push eax
call fcn.1001a3af
add esp, 0x10
cmp eax, 0x50
je 0x100101de
push 0xffffffffffffffff
lea eax, [esp + 0x88c]
push eax
lea eax, [esp + 0x688]
push edi
push eax
call fcn.1001a3af
add esp, 0x10
cmp eax, 0x50
je 0x100101de
lea ecx, [esp + 0x680]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x1001032e
push 0x66
pop eax
push 0x6e
sub ecx, edx
mov dword [esp + 0x10], ebx
sar ecx, 1
mov dword [esp + 0x14], ebx
mov word [esp + ecx*2 + 0x682], ax
pop eax
push 0x69
mov word [esp + ecx*2 + 0x680], ax
pop eax
mov word [esp + ecx*2 + 0x67a], ax
lea eax, [esp + 0x10]
push eax
push 1
push ebx
push str.SoftwarePoliciesMicrosoftFrontPage
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x100103b0
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x208
push eax
lea eax, [esp + 0x47c]
push eax
lea eax, [esp + 0x14]
push eax
push ebx
push str.CustomWebsDir
push dword [esp + 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp dword [esp + 0x10], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x100103c3
push dword [esp + 0x10]
call edi
mov ebx, dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
test esi, esi
jne 0x10010431
cmp dword [esp + 0xc], 1
je 0x100103db
cmp dword [esp + 0xc], 2
jne 0x10010431
cmp dword [esp + 0xc], 2
jne 0x1001058f
mov esi, 0x104
lea eax, [esp + 0xa90]
push esi
push eax
lea eax, [esp + 0x480]
push eax
call ebx
dec eax
cmp eax, 0x102
ja 0x1001058f
push 0xffffffffffffffff
lea eax, [esp + 0xa94]
push eax
lea eax, [esp + 0x480]
push esi
push eax
call fcn.1001a3af
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
setne cl
xor edx, edx
jmp 0x10010435
xor edx, edx
mov ecx, edx
test ecx, ecx
jne 0x1001058f
lea eax, [esp + 0xc]
mov dword [esp + 0x10], edx
push eax
push 1
push edx
push str.SoftwareMicrosoftFrontPage
push SysReAllocString
mov dword [esp + 0x20], edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x10010491
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0x208
push eax
lea eax, [esp + 0x47c]
push eax
lea eax, [esp + 0x18]
push eax
xor eax, eax
push eax
push str.CustomWebsDir
push dword [esp + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp dword [esp + 0xc], 0
je 0x1001049e
push dword [esp + 0xc]
call edi
test esi, esi
jne 0x10010506
cmp dword [esp + 0x10], 1
je 0x100104b0
cmp dword [esp + 0x10], 2
jne 0x10010506
cmp dword [esp + 0x10], 2
jne 0x1001058f
mov esi, 0x104
lea eax, [esp + 0xc98]
push esi
push eax
lea eax, [esp + 0x480]
push eax
call ebx
dec eax
cmp eax, 0x102
ja 0x1001058f
push 0xffffffffffffffff
lea eax, [esp + 0xc9c]
push eax
lea eax, [esp + 0x480]
push esi
push eax
call fcn.1001a3af
xor ecx, ecx
add esp, 0x10
cmp eax, 0x50
setne cl
xor ebx, ebx
jmp 0x1001050f
xor ebx, ebx
mov esi, 0x104
mov ecx, ebx
test ecx, ecx
jne 0x1001058f
push ebx
push 0x1a
lea eax, [esp + 0x480]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x100101de
lea ecx, [esp + 0x478]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10010537
sub ecx, edx
sar ecx, 1
push 0x5c
pop eax
cmp ax, word [esp + ecx*2 + 0x476]
je 0x10010574
push 0xffffffffffffffff
push 0x100393f0
lea eax, [esp + 0x480]
push esi
push eax
call fcn.1001a3af
add esp, 0x10
cmp eax, 0x50
je 0x100101de
push str.MicrosoftFrontPageWebs
mov edx, esi
lea ecx, [esp + 0x47c]
call fcn.1001a3af
test eax, eax
je 0x100101de
push ecx
lea eax, [esp + 0x47c]
push eax
xor eax, eax
lea edx, [esp + 0x890]
push eax
lea eax, [esp + 0x484]
push eax
lea ecx, [esp + 0x280]
call fcn.1001a3af
test eax, eax
je 0x100101de
lea ecx, [esp + 0x270]
call fcn.1001a3af
push dword [ebp + 0x18]
lea eax, [esp + 0x47c]
xor ecx, ecx
push dword [esp + 0x1c]
lea edx, [esp + 0x688]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esp + 0x30]
push eax
push 0x10039838
call fcn.1001a3af
jmp 0x100101e3
mov eax, 0x80040013
jmp 0x100101e3