Function at 0x101fcc1
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
xor esi, esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
cmp eax, esi
je 0x101fd2f
cmp eax, 2
jne 0x101fd99
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x101fd23
cmp dword [ebp + 0xc], 7
jne 0x101fd09
push eax
call fcn.0102005f
add eax, eax
jmp 0x101fd1e
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x101fd0c
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
mov dword [ebp - 4], eax
jmp 0x101fd41
push 2
push 0x10056d0
jmp 0x101fea8
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 8], eax
je 0x101fd3e
xor eax, eax
jmp 0x101fefc
mov eax, dword [ebp - 4]
cmp eax, esi
jne 0x101fd4b
push 0x20
pop eax
mov dword [ebp - 4], eax
mov ecx, eax
and ecx, 1
lea ebx, [ecx + eax + 2]
push ebx
call fcn.0102060a
mov esi, eax
test esi, esi
je 0x101fdf2
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
mov byte [ebx + esi - 1], 0
mov byte [ebx + esi - 2], 0
test byte [ebp - 4], 1
je 0x101fd8c
mov byte [ebx + esi - 3], 0
test eax, eax
je 0x101fe43
cmp eax, 2
je 0x101fda4
push eax
push 0x1005568
jmp 0x101fea8
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x101fe37
cmp dword [ebp + 0xc], 7
push edi
jne 0x101fe24
call fcn.0102005f
add eax, eax
push eax
push edi
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x101fe43
push eax
push dword [ebp + 0x10]
push 0x1005520
call fcn.0101f99c
add esp, 0xc
push esi
call fcn.010206a2
mov edi, dword [ebp + 0x18]
test edi, edi
je 0x101fe02
and dword [edi], 0
mov ebx, dword [ebp + 0x14]
test ebx, ebx
je 0x101fd37
cmp dword [ebp + 0xc], 7
jne 0x101feb4
push ebx
call fcn.0102005f
add eax, eax
jmp 0x101fecb
push ebx
push esi
call fcn.0101fc51
test eax, eax
jge 0x101fdc8
push eax
push 0x1005694
jmp 0x101fea8
push 0x1005640
call fcn.0101f99c
jmp 0x101feae
cmp dword [ebp + 0xc], 2
jne 0x101fe86
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x101fdf2
lea eax, [ebx + ebx + 2]
push eax
mov dword [ebp - 4], eax
call fcn.0102060a
mov dword [ebp + 0x10], eax
test eax, eax
je 0x101fdf2
push ebx
push eax
push esi
call edi
test eax, eax
je 0x101fe94
cmp eax, ebx
jg 0x101fe94
push esi
call fcn.010206a2
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x101fefa
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x101fefa
push dword [ebp + 0x10]
call fcn.010206a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x10055e8
call fcn.0101f99c
pop ecx
pop ecx
jmp 0x101fdf2
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101feb9
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 4], eax
call fcn.0102060a
mov esi, eax
test esi, esi
je 0x101fd37
cmp dword [ebp + 0xc], 7
jne 0x101ff03
push dword [ebp - 4]
push ebx
push esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, edi
je 0x101fefa
mov eax, dword [ebp - 4]
mov dword [edi], eax
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x14
push ebx
push dword [ebp - 4]
push esi
call fcn.0101fc51
test eax, eax
jge 0x101fef1
push eax
push 0x10055a8
call fcn.0101f99c
pop ecx
pop ecx
push esi
call fcn.010206a2
jmp 0x101fd37