Function at 0x10203b7
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
cmp eax, esi
je 0x1020425
cmp eax, 2
jne 0x102048f
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x1020419
cmp dword [ebp + 0xc], 7
jne 0x10203ff
push eax
call fcn.010212c1
add eax, eax
jmp 0x1020414
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1020402
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 4], eax
jmp 0x1020437
push 2
push 0x1005aa8
jmp 0x102059e
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 8], eax
je 0x1020434
xor eax, eax
jmp 0x10205f2
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x1020441
push 0x20
pop eax
mov dword [ebp - 4], eax
mov ecx, eax
and ecx, 1
lea ebx, [ecx + eax + 2]
push ebx
call fcn.0101e8e4
mov esi, eax
test esi, esi
je 0x10204e8
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
mov byte [ebx + esi - 1], 0
mov byte [ebx + esi - 2], 0
test byte [ebp - 4], 1
je 0x1020482
mov byte [ebx + esi - 3], 0
test eax, eax
je 0x1020539
cmp eax, 2
je 0x102049a
push eax
push 0x1005898
jmp 0x102059e
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x102052d
cmp dword [ebp + 0xc], 7
push edi
jne 0x102051a
call fcn.010212c1
add eax, eax
push eax
push edi
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1020539
push eax
push dword [ebp + 0x10]
push 0x1005850
call fcn.01021bf1
add esp, 0xc
push esi
call fcn.0101e9ef
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x10204f8
and dword [edi], 0
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x102042d
cmp dword [ebp + 0xc], 7
jne 0x10205aa
push ebx
call fcn.010212c1
add eax, eax
jmp 0x10205c1
push ebx
push esi
call fcn.01020347
test eax, eax
jge 0x10204be
push eax
push 0x1005a6c
jmp 0x102059e
push 0x1005a18
call fcn.01021bf1
jmp 0x10205a4
cmp dword [ebp + 0xc], 2
jne 0x102057c
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x10204e8
lea eax, [ebx + ebx + 2]
push eax
mov dword [ebp - 4], eax
call fcn.0101e8e4
mov dword [ebp + 0x10], eax
test eax, eax
je 0x10204e8
push ebx
push eax
push esi
call edi
test eax, eax
je 0x102058a
cmp eax, ebx
jg 0x102058a
push esi
call fcn.0101e9ef
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x10205f0
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x10205f0
push dword [ebp + 0x10]
call fcn.0101e9ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10059c0
call fcn.01021bf1
pop ecx
pop ecx
jmp 0x10204e8
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10205af
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 4], eax
call fcn.0101e8e4
mov esi, eax
test esi, esi
je 0x102042d
cmp dword [ebp + 0xc], 7
jne 0x10205f9
push dword [ebp - 4]
push ebx
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, edi
je 0x10205f0
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x14
push ebx
push dword [ebp - 4]
push esi
call fcn.01020347
test eax, eax
jge 0x10205e7
push eax
push 0x100597c
call fcn.01021bf1
pop ecx
pop ecx
push esi
call fcn.0101e9ef
jmp 0x102042d