Function at 0x10013910
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x1012f5f0]
xor eax, esp
mov dword [esp + 0x214], eax
push ebp
mov ebp, dword [esp + 0x220]
mov dword [esp + 0xc], ebp
mov byte [esp + 0x10], 0
call fcn.10019e80
cmp eax, 3
jne 0x100139ab
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesTcpipParameters
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100139c4
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x118]
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.DatabasePath
push eax
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x104
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100139c4
cmp eax, 2
jne 0x10013c56
push 0x104
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x10]
add eax, 0xffffffff
jmp 0x100139d0
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x100139d0
mov edx, dword [str.hosts]
mov cx, word [0x1012a230]
mov dword [eax], edx
mov dl, byte [0x1012a232]
mov word [eax + 4], cx
push edi
mov byte [eax + 6], dl
lea eax, [esp + 0x14]
push 0x1012a234
push eax
call fcn.1002141c
mov edi, eax
add esp, 8
test edi, edi
mov dword [esp + 8], edi
jne 0x10013a5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 1
ja 0x10013a3b
lea eax, [edi + 4]
pop edi
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x218
ret
pop edi
mov dword [ebp], 0
mov eax, 0xe
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x218
ret
mov ecx, dword [ebx]
push esi
push ebp
push ecx
push edi
call fcn.1001a200
mov esi, eax
add esp, 0xc
test esi, esi
mov dword [esp + 0x10], esi
jne 0x10013bfd
lea ebx, [ebx]
mov edi, dword [ebp]
movsx edx, word [edi + 8]
mov eax, dword [ebx]
cmp eax, edx
jne 0x10013bcf
cmp eax, 2
jne 0x10013b37
mov edx, dword [edi + 0xc]
mov edx, dword [edx]
mov eax, 4
lea ecx, [ebx + 4]
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x10013ac3
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x10013aa7
test eax, eax
je 0x10013bc5
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x10013b22
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10013bc5
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x10013b22
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10013bc5
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x10013b22
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10013bc5
movzx esi, byte [edx]
movzx eax, byte [ecx]
sub esi, eax
je 0x10013bc5
test esi, esi
mov eax, 1
jg 0x10013bc7
or eax, 0xffffffff
jmp 0x10013bc7
cmp eax, 0x17
jne 0x10013bcf
mov edx, dword [edi + 0xc]
mov edx, dword [edx]
mov eax, 0x10
lea ecx, [ebx + 4]
lea ecx, [ecx]
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x10013b68
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x10013b50
test eax, eax
je 0x10013bc5
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x10013bb7
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10013bc5
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x10013bb7
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10013bc5
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x10013bb7
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x10013bc5
movzx esi, byte [edx]
movzx eax, byte [ecx]
sub esi, eax
je 0x10013bc5
test esi, esi
mov eax, 1
jg 0x10013bc7
or eax, 0xffffffff
jmp 0x10013bc7
xor eax, eax
test eax, eax
mov ebp, dword [esp + 0x14]
je 0x10013bf5
call fcn.1001af20
mov ecx, dword [ebx]
mov edx, dword [esp + 0xc]
push ebp
push ecx
push edx
call fcn.1001a200
mov esi, eax
add esp, 0xc
test esi, esi
mov dword [esp + 0x10], eax
je 0x10013a80
jmp 0x10013bf9
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
push edi
call fcn.1001f431
add esp, 4
cmp esi, 0xd
jne 0x10013c31
mov esi, 4
mov eax, esi
pop esi
pop edi
mov dword [ebp], 0
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x218
ret
test esi, esi
je 0x10013c3c
mov dword [ebp], 0
mov eax, esi
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x214]
xor ecx, esp
call fcn.1001d3e9
add esp, 0x218
ret
mov ecx, dword [esp + 0x218]
pop ebp
xor ecx, esp
mov eax, 4
call fcn.1001d3e9
add esp, 0x218
ret