Function at 0x1102a96
Capabilities:
Query environment variable
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x111121c]
push esi
xor esi, esi
push esi
push 0x102878c
push 0x102887c
push 0x80000000
mov dword [ebp - 4], eax
mov dword [ebp - 0x414], ecx
call fcn.01101101
cmp eax, esi
mov dword [ebp - 0x42c], eax
jne 0x1102ad8
xor eax, eax
jmp 0x1102e3c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push edi
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x420], esi
mov edi, 0x104
cmp dword [ebp - 0x41c], esi
je 0x1102b17
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x41c], esi
push dword [ebp - 0x420]
mov ecx, dword [ebp - 0x414]
call fcn.0110128f
push 0x100
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x428]
mov dword [ebp - 0x420], esi
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1102e08
mov ecx, dword [ebp - 0x414]
inc dword [ebp - 0x428]
push esi
push 0x102878c
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x42c]
call fcn.01101101
cmp eax, esi
mov dword [ebp - 0x41c], eax
je 0x1102afd
mov ecx, dword [ebp - 0x414]
push esi
push esi
lea eax, [ebp - 0x418]
push eax
push 0x1028874
push dword [ebp - 0x41c]
call fcn.01101208
cmp eax, esi
mov dword [ebp - 0x420], eax
je 0x1102afd
cmp dword [ebp - 0x418], 1
je 0x1102bc9
cmp dword [ebp - 0x418], 2
jne 0x1102afd
push edi
push dword [ebp - 0x420]
lea eax, [ebp - 0x108]
push eax
call ebx
push dword [ebp - 0x420]
mov ecx, dword [ebp - 0x414]
call fcn.0110128f
cmp dword [ebp - 0x418], 2
mov dword [ebp - 0x420], esi
jne 0x1102c2f
push edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x410]
push eax
call ebx
push edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, edi
ja 0x1102afd
cmp eax, esi
je 0x1102afd
mov ecx, dword [ebp - 0x414]
push esi
push esi
lea eax, [ebp - 0x418]
push eax
push 0x1028864
push dword [ebp - 0x41c]
call fcn.01101208
cmp eax, esi
mov dword [ebp - 0x420], eax
je 0x1102afd
cmp dword [ebp - 0x418], 1
jne 0x1102afd
push edi
push eax
lea eax, [ebp - 0x30c]
push eax
call ebx
push dword [ebp - 0x420]
mov ecx, dword [ebp - 0x414]
call fcn.0110128f
mov ecx, dword [ebp - 0x414]
push esi
push esi
lea eax, [ebp - 0x418]
push eax
push 0x102885c
push dword [ebp - 0x41c]
call fcn.01101208
cmp eax, esi
je 0x1102cc4
cmp dword [ebp - 0x418], 4
je 0x1102cba
cmp dword [ebp - 0x418], 3
jne 0x1102cc4
mov ecx, dword [eax]
mov dword [ebp - 0x434], ecx
jmp 0x1102cca
mov dword [ebp - 0x434], esi
mov ecx, dword [ebp - 0x414]
push eax
call fcn.0110128f
mov ecx, dword [ebp - 0x414]
push esi
push esi
lea eax, [ebp - 0x418]
push eax
push 0x1028854
push dword [ebp - 0x41c]
call fcn.01101208
cmp eax, esi
je 0x1102d15
cmp dword [ebp - 0x418], 4
je 0x1102d0b
cmp dword [ebp - 0x418], 3
jne 0x1102d15
mov ecx, dword [eax]
mov dword [ebp - 0x430], ecx
jmp 0x1102d1b
mov dword [ebp - 0x430], esi
mov ecx, dword [ebp - 0x414]
push eax
call fcn.0110128f
push 0x338
push 0x40
mov dword [ebp - 0x420], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1102e06
mov ecx, dword [ebp - 0x414]
push edi
lea eax, [esi + 0x104]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.01102925
test eax, eax
jne 0x1102d73
push edi
lea eax, [ebp - 0x108]
push eax
lea eax, [esi + 0x104]
push eax
call ebx
push edi
lea eax, [ebp - 0x208]
push eax
push esi
call ebx
push edi
lea eax, [ebp - 0x30c]
push eax
lea eax, [esi + 0x208]
push eax
call ebx
mov eax, dword [ebp - 0x430]
mov ecx, dword [ebp - 0x434]
mov dword [esi + 0x30c], eax
mov eax, dword [ebp - 0x424]
test eax, eax
mov dword [esi + 0x310], ecx
jne 0x1102dc5
mov dword [esi + 0x330], esi
mov dword [esi + 0x334], esi
mov dword [ebp - 0x424], esi
jmp 0x1102de7
test ecx, ecx
je 0x1102dee
lea ecx, [eax + 0x334]
mov edx, dword [ecx]
mov dword [edx + 0x330], esi
mov dword [esi + 0x330], eax
mov eax, dword [ecx]
mov dword [esi + 0x334], eax
mov dword [ecx], esi
xor esi, esi
jmp 0x1102afd
lea ecx, [eax + 0x330]
mov edx, dword [ecx]
mov dword [edx + 0x334], esi
mov edx, dword [ecx]
mov dword [esi + 0x330], edx
jmp 0x1102ddf
xor esi, esi
cmp dword [ebp - 0x41c], esi
pop edi
pop ebx
je 0x1102e1e
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x414]
push esi
call fcn.0110128f
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 4]
pop esi
call fcn.0105eca9
leave
ret