Function at 0x100a1db
Capabilities:
Get hostname
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6a8
mov eax, dword [0x1019214]
push 0x104
lea ecx, [ebp - 0x22c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ecx
push eax
mov dword [ebp - 0x644], eax
call fcn.01010377
test eax, eax
jl 0x100a4ec
push ebx
xor ebx, ebx
inc ebx
push ebx
call fcn.01005550
cmp word [ebp - 0x22c], 0x5c
jne 0x100a235
cmp word [ebp - 0x22a], 0x5c
lea eax, [ebp - 0x228]
je 0x100a23b
lea eax, [ebp - 0x22c]
push esi
push edi
push eax
mov dword [ebp - 0x638], eax
call dword [sym.imp.USER32.dll_CharLowerW]
push ebx
push dword [ebp - 0x638]
call dword [sym.imp.USER32.dll_CharUpperBuffW]
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x648], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x100a299
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x638]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100a299
mov dword [ebp - 0x63c], 0x99
jmp 0x100a4bf
mov eax, dword [0x1019080]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
mov edi, 0x110a
push edi
push eax
mov dword [ebp - 0x63c], eax
mov dword [ebp - 0x6a8], 0x15
call esi
lea ecx, [ebp - 0x434]
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x698], ecx
mov dword [ebp - 0x694], 0x104
jmp 0x100a314
lea eax, [ebp - 0x6a8]
push eax
push 0
push 0x113e
push dword [ebp - 0x63c]
call esi
lea eax, [ebp - 0x434]
push eax
push dword [ebp - 0x638]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100a366
jl 0x100a32f
mov eax, dword [ebp - 0x6a4]
push eax
push ebx
push edi
push dword [ebp - 0x63c]
mov dword [ebp - 0x640], eax
call esi
test eax, eax
mov dword [ebp - 0x6a4], eax
jne 0x100a2df
lea eax, [ebp - 0x64c]
push eax
push 0x80000002
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
xor ecx, ecx
cmp eax, ecx
je 0x100a380
cmp eax, 5
sete cl
lea ecx, [ecx + ecx + 0x9a]
mov dword [ebp - 0x63c], ecx
jmp 0x100a4bf
push dword [ebp - 0x6a4]
push 9
push 0x110b
push dword [ebp - 0x63c]
call esi
jmp 0x100a4e9
mov eax, dword [ebp - 0x640]
mov edi, dword [0x1019080]
mov dword [ebp - 0x67c], eax
mov eax, dword [ebp - 0x638]
mov dword [ebp - 0x668], eax
lea eax, [ebp - 0x680]
push eax
push ecx
push 0x1132
push edi
mov dword [ebp - 0x63c], ecx
mov dword [ebp - 0x680], 0xffff0000
mov dword [ebp - 0x678], 0x67
mov dword [ebp - 0x660], ebx
mov dword [ebp - 0x65c], ebx
mov dword [ebp - 0x658], ebx
mov dword [ebp - 0x654], ecx
call esi
mov dword [ebp - 0x680], eax
xor eax, eax
mov dword [ebp - 0x660], 2
mov dword [ebp - 0x65c], 3
mov dword [ebp - 0x638], eax
lea ecx, [eax + eax*2]
shl ecx, 2
cmp eax, ebx
mov edx, dword [ecx + 0x10019d0]
mov dword [ebp - 0x668], edx
je 0x100a46d
test eax, eax
je 0x100a46d
cmp eax, 2
jne 0x100a4f8
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0x654], eax
push 0x100
lea eax, [ebp - 0x634]
push eax
push 0
push dword [ebp - 0x654]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x658], eax
lea eax, [ebp - 0x680]
push eax
push 0
push 0x1132
push edi
call esi
mov eax, dword [ebp - 0x638]
inc eax
cmp eax, 6
mov dword [ebp - 0x638], eax
jb 0x100a402
push dword [ebp - 0x680]
push 2
push 0x1102
push edi
call esi
push dword [ebp - 0x680]
xor ebx, ebx
push ebx
push 0x1114
push edi
call esi
push ebx
call fcn.01005550
push dword [ebp - 0x680]
push 9
push 0x110b
push edi
call esi
push edi
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x63c], ebx
je 0x100a4e9
lea eax, [ebp - 0x22c]
push eax
movzx eax, word [ebp - 0x63c]
push 0x10
push 0x98
push eax
push dword [ebp - 0x644]
push dword [0x1019530]
call fcn.01009e27
add esp, 0x18
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.010167d4
leave
ret 4
cmp eax, 5
je 0x100a46d
cmp eax, 4
je 0x100a46d
lea eax, [ebp - 0x654]
push eax
push dword [ecx + 0x10019d4]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
test eax, eax
je 0x100a431
mov dword [ebp - 0x63c], 0x9b
jmp 0x100a467