Function at 0x10025c8
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd7c
mov eax, dword [0x10050b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0xd7c], ecx
mov edi, 0x104
push edi
lea ecx, [ebp - 0xa64]
mov dword [ebp - 0xd78], eax
mov eax, dword [ebp + 0x10]
push ecx
xor esi, esi
push eax
mov dword [ebp - 0xd5c], esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, esi
je 0x10028ca
cmp eax, edi
ja 0x10028ca
lea eax, [ebp - 0xd5c]
push eax
push 0x20119
push esi
push dword [0x1005004]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10028b2
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xd74]
push eax
lea eax, [ebp - 0x244]
push eax
push esi
push dword [ebp - 0xd5c]
mov dword [ebp - 0xd70], esi
mov dword [ebp - 0xd74], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10028b2
mov ebx, 0x206
mov ecx, dword [ebp - 0xd78]
lea eax, [ebp - 0x244]
push eax
call fcn.010019ec
test al, al
je 0x1002876
push 0x20
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x244]
push eax
mov dword [ebp - 0xd60], esi
call fcn.01003faa
push 0x100178c
lea eax, [ebp - 0x244]
push eax
push 0x10017a0
lea eax, [ebp - 0xc6c]
push edi
push eax
call fcn.01001f38
add esp, 0x14
test eax, eax
jne 0x1002876
lea eax, [ebp - 0xd60]
push eax
push 0x20119
push esi
lea eax, [ebp - 0xc6c]
push eax
push dword [ebp - 0xd5c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002876
push ebx
mov word [ebp - 0x44c], ax
lea eax, [ebp - 0x44a]
push esi
push eax
mov dword [ebp - 0xd6c], esi
call sub.msvcrt.dll_memset
xor eax, eax
push ebx
mov word [ebp - 0x85c], ax
lea eax, [ebp - 0x85a]
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push ebx
mov word [ebp - 0x654], ax
lea eax, [ebp - 0x652]
push esi
push eax
mov dword [ebp - 0xd64], 0x208
call sub.msvcrt.dll_memset
add esp, 0x24
lea eax, [ebp - 0xd64]
push eax
lea eax, [ebp - 0x44c]
push eax
push esi
push esi
lea eax, [ebp - 0xd68]
push eax
lea eax, [ebp - 0x654]
push eax
push esi
jmp 0x1002850
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0xa64]
push eax
push 0x10017a0
lea eax, [ebp - 0x85c]
push edi
push eax
call fcn.01001f38
add esp, 0x14
test eax, eax
jne 0x100281c
lea ecx, [ebp - 0xd58]
call fcn.010019c3
lea eax, [ebp - 0x85c]
push eax
lea eax, [ebp - 0xd58]
push eax
call fcn.01001e51
test al, al
je 0x100281c
mov eax, dword [ebp - 0xd78]
push dword [eax + 0xc]
lea ecx, [ebp - 0xd58]
call fcn.01001a1a
test al, al
je 0x100281c
lea ecx, [ebp - 0xd58]
call fcn.01001a5c
cmp word [ebp - 0x44], si
je 0x100281c
mov ecx, dword [ebp - 0xd7c]
cmp ecx, esi
je 0x100281c
cmp word [ecx], si
je 0x100281c
cmp eax, esi
je 0x100281c
cmp word [eax], si
je 0x100281c
push eax
push ecx
lea eax, [ebp - 0x44]
push eax
push 0x274c
call fcn.01003e0b
add esp, 0x10
inc dword [ebp - 0xd6c]
lea eax, [ebp - 0xd64]
push eax
lea eax, [ebp - 0x44c]
push eax
push esi
push esi
lea eax, [ebp - 0xd68]
push eax
lea eax, [ebp - 0x654]
push eax
push dword [ebp - 0xd6c]
mov dword [ebp - 0xd64], 0x208
push dword [ebp - 0xd60]
mov dword [ebp - 0xd68], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x100277f
push dword [ebp - 0xd60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0xd70]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xd74]
push eax
lea eax, [ebp - 0x244]
push eax
push dword [ebp - 0xd70]
mov dword [ebp - 0xd74], 0xff
push dword [ebp - 0xd5c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1002682
cmp dword [ebp - 0xd5c], esi
je 0x10028c6
push dword [ebp - 0xd5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10028cf
mov eax, 0x80004005
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100377d
leave
ret 0x10