Function at 0x11029ed
Capabilities:
Query environment variable
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x111121c]
push esi
xor esi, esi
push esi
push 0x102876c
push 0x102885c
push accept
mov dword [ebp - 4], eax
mov dword [ebp - 0x414], ecx
call fcn.01101058
cmp eax, esi
mov dword [ebp - 0x42c], eax
jne 0x1102a2f
xor eax, eax
jmp 0x1102d93
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
push edi
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x420], esi
mov edi, 0x104
cmp dword [ebp - 0x41c], esi
je 0x1102a6e
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x41c], esi
push dword [ebp - 0x420]
mov ecx, dword [ebp - 0x414]
call fcn.011011e6
push 0x100
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x428]
mov dword [ebp - 0x420], esi
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1102d5f
mov ecx, dword [ebp - 0x414]
inc dword [ebp - 0x428]
push esi
push 0x102876c
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x42c]
call fcn.01101058
cmp eax, esi
mov dword [ebp - 0x41c], eax
je 0x1102a54
mov ecx, dword [ebp - 0x414]
push esi
push esi
lea eax, [ebp - 0x418]
push eax
push 0x1028854
push dword [ebp - 0x41c]
call fcn.0110115f
cmp eax, esi
mov dword [ebp - 0x420], eax
je 0x1102a54
cmp dword [ebp - 0x418], 1
je 0x1102b20
cmp dword [ebp - 0x418], 2
jne 0x1102a54
push edi
push dword [ebp - 0x420]
lea eax, [ebp - 0x108]
push eax
call ebx
push dword [ebp - 0x420]
mov ecx, dword [ebp - 0x414]
call fcn.011011e6
cmp dword [ebp - 0x418], 2
mov dword [ebp - 0x420], esi
jne 0x1102b86
push edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x410]
push eax
call ebx
push edi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp eax, edi
ja 0x1102a54
cmp eax, esi
je 0x1102a54
mov ecx, dword [ebp - 0x414]
push esi
push esi
lea eax, [ebp - 0x418]
push eax
push 0x1028844
push dword [ebp - 0x41c]
call fcn.0110115f
cmp eax, esi
mov dword [ebp - 0x420], eax
je 0x1102a54
cmp dword [ebp - 0x418], 1
jne 0x1102a54
push edi
push eax
lea eax, [ebp - 0x30c]
push eax
call ebx
push dword [ebp - 0x420]
mov ecx, dword [ebp - 0x414]
call fcn.011011e6
mov ecx, dword [ebp - 0x414]
push esi
push esi
lea eax, [ebp - 0x418]
push eax
push 0x102883c
push dword [ebp - 0x41c]
call fcn.0110115f
cmp eax, esi
je 0x1102c1b
cmp dword [ebp - 0x418], 4
je 0x1102c11
cmp dword [ebp - 0x418], 3
jne 0x1102c1b
mov ecx, dword [eax]
mov dword [ebp - 0x434], ecx
jmp 0x1102c21
mov dword [ebp - 0x434], esi
mov ecx, dword [ebp - 0x414]
push eax
call fcn.011011e6
mov ecx, dword [ebp - 0x414]
push esi
push esi
lea eax, [ebp - 0x418]
push eax
push 0x1028834
push dword [ebp - 0x41c]
call fcn.0110115f
cmp eax, esi
je 0x1102c6c
cmp dword [ebp - 0x418], 4
je 0x1102c62
cmp dword [ebp - 0x418], 3
jne 0x1102c6c
mov ecx, dword [eax]
mov dword [ebp - 0x430], ecx
jmp 0x1102c72
mov dword [ebp - 0x430], esi
mov ecx, dword [ebp - 0x414]
push eax
call fcn.011011e6
push 0x338
push 0x40
mov dword [ebp - 0x420], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1102d5d
mov ecx, dword [ebp - 0x414]
push edi
lea eax, [esi + 0x104]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0110287c
test eax, eax
jne 0x1102cca
push edi
lea eax, [ebp - 0x108]
push eax
lea eax, [esi + 0x104]
push eax
call ebx
push edi
lea eax, [ebp - 0x208]
push eax
push esi
call ebx
push edi
lea eax, [ebp - 0x30c]
push eax
lea eax, [esi + 0x208]
push eax
call ebx
mov eax, dword [ebp - 0x430]
mov ecx, dword [ebp - 0x434]
mov dword [esi + 0x30c], eax
mov eax, dword [ebp - 0x424]
test eax, eax
mov dword [esi + 0x310], ecx
jne 0x1102d1c
mov dword [esi + 0x330], esi
mov dword [esi + 0x334], esi
mov dword [ebp - 0x424], esi
jmp 0x1102d3e
test ecx, ecx
je 0x1102d45
lea ecx, [eax + 0x334]
mov edx, dword [ecx]
mov dword [edx + 0x330], esi
mov dword [esi + 0x330], eax
mov eax, dword [ecx]
mov dword [esi + 0x334], eax
mov dword [ecx], esi
xor esi, esi
jmp 0x1102a54
lea ecx, [eax + 0x330]
mov edx, dword [ecx]
mov dword [edx + 0x334], esi
mov edx, dword [ecx]
mov dword [esi + 0x330], edx
jmp 0x1102d36
xor esi, esi
cmp dword [ebp - 0x41c], esi
pop edi
pop ebx
je 0x1102d75
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x414]
push esi
call fcn.011011e6
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 4]
pop esi
call fcn.0105ec09
leave
ret