Function at 0x100e9b5
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
xor ebx, ebx
lea eax, [ebp - 8]
push eax
mov edi, 0x20019
push edi
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x14], ebx
push 0x80000002
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x101eb89
cmp dword [ebp - 8], ebx
je 0x101eb89
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
push 0x100ec10
push dword [ebp - 8]
call esi
test eax, eax
jne 0x100ebd2
cmp dword [ebp - 0xc], ebx
je 0x100ebd2
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
mov dword [ebp + 8], ebx
call dword [sym.imp.ole32.dll_StringFromCLSID]
cmp eax, ebx
jne 0x100eb69
lea eax, [ebp - 0x10]
push eax
push edi
push ebx
push dword [ebp + 8]
push dword [ebp - 0xc]
call esi
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test ebx, ebx
jne 0x100ebd2
cmp dword [ebp - 0x10], ebx
je 0x100ebd2
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 0x100ebf0
push dword [ebp - 0x10]
call esi
test eax, eax
jne 0x100ebd2
cmp dword [ebp - 4], eax
je 0x100ebd2
mov edi, dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x18]
push ecx
push eax
lea ecx, [ebp - 0x1c]
push ecx
push eax
push eax
push dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call edi
test eax, eax
jne 0x101eb89
mov esi, dword [ebp - 0x18]
shr esi, 1
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.01012e6e
mov ebx, eax
pop ecx
mov dword [ebp - 0x14], ebx
test ebx, ebx
je 0x101eb93
xor eax, eax
mov word [ebx], ax
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push dword [ebp - 4]
call edi
test eax, eax
jne 0x101eb89
mov eax, dword [ebp - 0x1c]
dec eax
je 0x100eb43
dec eax
jne 0x101eb9d
xor ecx, ecx
push 2
lea edi, [esi + 0x104]
pop edx
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.01012e6e
mov esi, eax
pop ecx
test esi, esi
je 0x101eb93
push edi
push esi
xor eax, eax
push ebx
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x100ebc7
push ebx
call fcn.01003800
pop ecx
mov dword [ebp - 0x14], esi
mov ebx, esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x100ebc7
push 0x100ebdc
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100ebc7
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0xc]
call eax
mov esi, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
cmp dword [ebp - 8], ebx
je 0x100eb7d
push dword [ebp - 8]
call edi
cmp dword [ebp - 0xc], ebx
je 0x100eb87
push dword [ebp - 0xc]
call edi
cmp dword [ebp - 0x10], ebx
je 0x100eb91
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 4], ebx
je 0x100eb9b
push dword [ebp - 4]
call edi
cmp dword [ebp - 0x14], ebx
je 0x100eba9
push dword [ebp - 0x14]
call fcn.01003800
pop ecx
mov edi, 0x8007000e
cmp esi, edi
je 0x101ebdc
cmp esi, ebx
jl 0x101ebe3
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x1c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x101ebbd
mov esi, 0x80040154
jmp 0x100eb6b
mov esi, 0x80040150
jmp 0x100eb6b
mov esi, 0x8007000e
jmp 0x100eb6b
cmp byte [ebp + 0x20], 0
je 0x101ebd4
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ole32.dll_CoGetClassObject]
jmp 0x100eb69
test eax, eax
jle 0x100eb69
and eax, 0xffff
or eax, 0x80070000
jmp 0x100eb69
mov esi, dword [ebp + 0x20]
jmp 0x100eb6b
mov eax, edi
jmp 0x100ebc0
cmp byte [ebp + 0x20], 0
je 0x100ebbe
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ole32.dll_CoGetClassObject]
cmp eax, ebx
jge 0x101ec0e
cmp eax, edi
jne 0x100ebbe
mov esi, eax
jmp 0x100ebbe