Function at 0x100a9f9
Capabilities:
Query or enumerate registry value
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x10106f0]
or dword [ebp - 0x104], 0xffffffff
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xfc], ebx
mov dword [ebp - 0xec], ebx
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
lea eax, [ebp - 0xfc]
push eax
push 0x20019
push ebx
push 0x1001eb0
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100ab10
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xec]
push eax
push ebx
lea eax, [ebp - 0xf4]
push eax
push ebx
mov edi, 0x1001e9c
push edi
push dword [ebp - 0xfc]
call esi
test eax, eax
jne 0x100ab04
mov eax, dword [ebp - 0xec]
cmp eax, 2
jbe 0x100ab04
cmp eax, 0xffffffbe
jae 0x100ab04
cmp dword [ebp - 0xf4], 7
jne 0x100ab04
add eax, 0x41
push eax
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, ebx
pop ecx
mov dword [0x1010c70], eax
je 0x100ab04
lea ecx, [ebp - 0xec]
push ecx
push eax
lea eax, [ebp - 0xf4]
push eax
push ebx
push edi
push dword [ebp - 0xfc]
call esi
test eax, eax
jne 0x100aaf1
mov eax, dword [0x1010c70]
mov ecx, dword [ebp - 0xec]
mov byte [eax + ecx - 1], bl
mov eax, dword [ebp - 0xec]
mov ecx, dword [0x1010c70]
mov byte [ecx + eax - 2], bl
jmp 0x100ab04
push dword [0x1010c70]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov dword [0x1010c70], ebx
push dword [ebp - 0xfc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1010c70]
cmp eax, ebx
je 0x100ab25
mov ecx, dword [ebp - 0xec]
lea edi, [eax + ecx - 1]
jmp 0x100ab39
push 0x41
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, ebx
pop ecx
mov dword [0x1010c70], eax
je 0x100ab44
mov edi, eax
push 0x10
mov esi, 0x1001e58
pop ecx
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0xf0]
push eax
push ebx
push 3
push ebx
push ebx
push ebx
push 0x1001e24
push bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x100ab90
mov al, byte [0x102aa64]
test al, 1
je 0x100afa3
test al, 2
je 0x100afa3
mov dword [0x102b24c], 0x102ba80
jmp 0x100afa3
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop edi
lea eax, [ebp - 0xec]
push eax
push 0x102b1d4
lea eax, [ebp - 0xf4]
push eax
push ebx
push 0x1001e10
push dword [ebp - 0xf0]
mov dword [ebp - 0xec], edi
call esi
test eax, eax
je 0x100abca
mov dword [0x102b1d4], ebx
lea eax, [ebp - 0xec]
push eax
push 0x10107c4
lea eax, [ebp - 0xf4]
push eax
push ebx
push 0x1001694
push dword [ebp - 0xf0]
mov dword [ebp - 0xec], edi
call esi
test eax, eax
je 0x100abff
mov dword [0x10107c4], 1
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push 0x30
lea eax, [ebp - 0x64]
push eax
push 0x79
push dword [0x102a9d0]
call ebx
mov al, byte [0x102aa64]
test al, 1
mov dword [ebp - 0xec], edi
je 0x100ac65
test al, 2
je 0x100ac65
mov eax, dword [ebp - 0xf8]
add eax, 0x30
lea ecx, [ebp - 0xec]
push ecx
push eax
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0xf4]
push eax
push 0
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0xf0]
call esi
test eax, eax
je 0x100ac91
mov eax, dword [ebp - 0x100]
or word [eax], 0x4080
jmp 0x100ac91
mov eax, dword [ebp - 0xf8]
add eax, 0x30
lea ecx, [ebp - 0xec]
push ecx
push eax
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0xf4]
push eax
push 0
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0xf0]
call esi
push 0x30
lea eax, [ebp - 0x64]
push eax
push 0x7a
push dword [0x102a9d0]
call ebx
lea eax, [ebp - 0xec]
push eax
mov eax, dword [ebp - 0xf8]
add eax, 0x2c
push eax
lea eax, [ebp - 0xf4]
push eax
push 0
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0xf0]
mov dword [ebp - 0xec], edi
call esi
lea eax, [ebp - 0xec]
push eax
push 0x102bb80
lea eax, [ebp - 0xf4]
push eax
push 0
push 0x1001834
push dword [ebp - 0xf0]
mov dword [ebp - 0xec], edi
call esi
test eax, eax
je 0x100ad00
and dword [0x102bb80], 0
lea eax, [ebp - 0xec]
push eax
push 0x102bb84
lea eax, [ebp - 0xf4]
push eax
push 0
push 0x1001818
push dword [ebp - 0xf0]
mov dword [ebp - 0xec], edi
call esi
test eax, eax
je 0x100ad33
and dword [0x102bb84], 0
lea eax, [ebp - 0xec]
push eax
push 0x101075c
lea eax, [ebp - 0xf4]
push eax
push 0
push 0x1001828
push dword [ebp - 0xf0]
mov dword [ebp - 0xec], edi
call esi
test eax, eax
je 0x100ad84
test byte [0x1010743], 0x80
je 0x100ad71
and dword [0x101075c], 0
jmp 0x100ad8d
mov dword [0x101075c], 1
or byte [0x102b261], 1
jmp 0x100ad94
cmp dword [0x101075c], 0
jne 0x100ad7b
and byte [0x102b261], 0xfe
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0
push 0x100180c
push dword [ebp - 0xf0]
mov dword [ebp - 0xec], 0x105
call esi
lea eax, [ebp - 0xe8]
push 0x1001e00
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x100ae06
lea eax, [ebp - 0xe8]
push 0x1001df0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x100ae06
lea eax, [ebp - 0xe8]
push 0x1001df0
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0xe8]
push eax
push 0x100138c
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov al, byte [0x102aa64]
test al, 1
je 0x100af97
test al, 2
je 0x100af97
push 0x30
lea eax, [ebp - 0x64]
push eax
push 0xc1
push dword [0x102a9d0]
call ebx
mov eax, dword [ebp - 0xf8]
add eax, 0x50
lea ecx, [ebp - 0xec]
push ecx
push eax
lea eax, [ebp - 0xf4]
push eax
push 0
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0xf0]
mov dword [ebp - 0xec], edi
call esi
test eax, eax
je 0x100ae7c
mov eax, dword [ebp - 0xf8]
add eax, 0x50
and dword [eax], 0
push 0x30
lea eax, [ebp - 0x64]
push eax
push 0xc2
push dword [0x102a9d0]
call ebx
mov dword [ebp - 0xec], edi
mov edi, dword [ebp - 0xf8]
lea eax, [ebp - 0xec]
push eax
add edi, 0x54
push edi
lea eax, [ebp - 0xf4]
push eax
push 0
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0xf0]
call esi
test eax, eax
je 0x100aee2
mov al, byte [0x102aa64]
test al, 1
je 0x100aedf
test al, 2
je 0x100aedf
xor ebx, ebx
inc ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardType]
cmp ah, 0xd
jne 0x100aedf
mov dword [edi], ebx
jmp 0x100aee2
and dword [edi], 0
test byte [edi], 1
jne 0x100af08
mov edx, dword [ebp - 0x100]
mov eax, dword [edx]
mov ecx, 0x280
mov edi, eax
and edi, ecx
cmp edi, ecx
jne 0x100af08
and eax, 0xfffffdff
or eax, 0x4080
mov dword [edx], eax
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp eax, 0x3a4
jne 0x100af5f
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0xf4]
push eax
push 0
push 0x1001634
push dword [ebp - 0xf0]
call esi
test eax, eax
jne 0x100af5f
mov edx, dword [ebp - 0x104]
test edx, edx
jl 0x100af5f
mov ecx, 0x100f878
cmp edx, dword [ecx]
je 0x100afb2
add ecx, 0x210
inc eax
cmp ecx, 0x10106e8
jl 0x100af4c
and byte [0x1010740], 0x3f
and byte [0x102b261], 0xef
and word [0x102b3d8], 0
and dword [0x102b3d4], 0
mov byte [0x1010741], 0
push 0x102b1cc
mov dword [0x102b24c], 0x102ba80
call fcn.010076a4
push dword [ebp - 0xf0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100cdd8
leave
ret 4
or byte [0x102b261], 0x10
imul eax, eax, 0x210
mov ecx, dword [eax + 0x100f878]
mov eax, dword [eax + 0x100f87c]
or ecx, 0x80
mov byte [0x1010741], 0
or dword [0x1010740], ecx
mov dword [0x102b3d4], eax
jmp 0x100af83